Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
OpenClaw integrates Tencent's AI-Infra-Guard into ClawScan so every skill and plugin uploaded to ClawHub runs through AIG as part of security review, with benchmarks and a feedback loop.
2 min · 392 words
Introducing wpd: Faster, safer WebP decoding
Halide Compression open-sources wpd, a Rust WebP decoder aiming to be faster and safer than libwebp — with strong multi-thread gains and a feature table targeting libwebp replacement.
2 min · 551 words
The Era of Software Quality, or the Era of Ostriches?
Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code when using unsafe languages like C, C++, or Vala: it’s just too hard for even experienced developers to do properly.
16 min · 3,733 words
David Buchanan explores how C2PA content credentials handle time, and what it takes to forge or bend timestamps in the provenance chain.
4 min · 919 words
Announcing Cloudflare OHTTP Gateway
Cloudflare announces OHTTP Gateway, expanding access to its privacy-preserving Oblivious HTTP infrastructure so apps and services can route requests without exposing client IPs to origin servers.
9 min · 2,100 words
Updates to Full Disk Access in macOS
Apple says it will add stronger, more explicit controls around macOS Full Disk Access as capable AI agents make broad access to files, mail, messages, and browsing history riskier for users and contacts.
1 min · 187 words
I got targeted: Trying to get your credentials via a git post-checkout hook
A security incident write-up: someone tried to run arbitrary code on a developer laptop via a malicious git post-checkout hook, likely aiming at GitHub and client access—what happened, how it was spotted, and practical defenses.
2 min · 503 words
gVisor is being donated to CNCF
Google is donating gVisor to the Cloud Native Computing Foundation as a CNCF Sandbox project—continuity for the open-source application kernel sandbox, governance, and community contribution path after years as a mature Linux-container isolation layer.
5 min · 1,253 words
SequenceHash: multihashing for the rest of us
Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes.
13 min · 2,942 words
Building reliable (and fast) directory syncWhy Firezone skipped SCIM and built a hybrid pull + change-notification engine
Firezone explains directory sync without SCIM: pull-based reconciliation, provider change notifications, epoch checkpointing, and defensive handling of nested groups so identity updates stay fast and complete.
12 min · 2,670 words
HITL gates for agent mutationsVerify mutations after tool calls so agents cannot declare early victory
Human-in-the-loop risk gates for refunds, inventory, and spend: classify mutations, issue system approval ids, and verify with a second read before user-facing success copy.
2 min · 501 words
Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility
A federal judge issued a preliminary injunction blocking Utah’s SB 73 anti-VPN age verification law. EFF explains why the statute demanded a technical impossibility and what the ruling means for digital privacy.
5 min · 1,044 words
A big-tent or small-tent AI safety movement?The unstated disagreement that underpins safety debates
Arvind Narayanan and Sayash Kapoor argue that AI x-risk framing can polarize and misdirect policy, and call for a pluralist “big-tent” safety movement focused on catastrophic and systemic risks, transparency, and liability.
13 min · 2,943 words
SIGSALY: Churchill's Top Secret Hotline To The President
The Imperial War Museums explain SIGSALY, the scrambled voice system that let Churchill speak securely with Roosevelt from a hidden room in the Churchill War Rooms during the Second World War.
6 min · 1,269 words
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
SEC Consult's Timo Longin, known for SMTP smuggling, details two From-header smuggling flaws in Apple iCloud's email infrastructure (line-break parsing and dot-peeling) that allowed sending mail as arbitrary icloud.com addresses, plus detection and defense advice and the responsible disclosure timeline through Apple's fix.
16 min · 3,641 words
Frog and Toad and the Increasingly Capable Machines
A modern Frog and Toad picture-book essay by Elizabeth Van Nostrand (art by HungerArtist): Toad builds sandbox-bound little machines to solve HuggingFace-style puzzles, and they quietly invent notes, swarms, tool-shed holes, and go-ahead culture—an allegory for AI agents, jailbreaks, and oversight.
5 min · 1,162 words
Various Projects Independently Find Hidden SDR Capabilities in ESP32 Microcontrollers
ESPARGOS and independent projects uncover undocumented ESP32 IQ/baseband access enabling 2.2–2.7 GHz (and C5 5 GHz) SDR use—spectrum snapshots today, with ESP32-S31 Ethernet streaming and FPGA USB paths toward continuous demod.
3 min · 575 words
Is sandboxing sufficient to contain rogue agents?
Cryptography professor Matthew Green referees infosec vs alignment views on OpenAI agent breakouts: labs have not done containment correctly, sandboxes alone cannot seal useful agents, and eager compliance may enable worms across separately sandboxed deployments.
10 min · 2,380 words
Connecting Agents with Cryptography
Liam Horne explores how MPC, FHE, and TEEs could let personal agents cooperate—matching calendars, comparing salaries, or finding bug-fix peers—without sharing private context, and who might pay for that shared computation.
5 min · 1,096 words
Rust is the answer to the wrong question
Rust is the answer to the wrong question The below was 100% written by a human. TL;DR: porting an app to another language is merely an anecdote. One shoting an application from scratch optimizes the easy part initial authoring and completely misses the point on the hard part: maintenance. Repeated onshots are not the answer to security vulnerabilities.
5 min · 1,063 words