Podcasts about OpenSSL

PHP Alive and Kicking – August 4, 2026 Hosts: Chris Miller (standing in solo while Mike is on holiday) Mike escaped to a beach so Chris hosts alone with special guest Derick Rethans. Expect date-time philosophy, PHP 8.6 goodies, Xdebug secrets, deprecation drama, and a heated debate about how to queue at a pub. From University Websites to Committing to PHP Derick traces his PHP origins back to his university days, building websites that needed database connectivity. ASP.NET was an option, but nobody wanted to pay for it — Linux was cool, and PHP was easy to start using. That combination hooked him early. His very first accepted contribution came from a practical need: everyone wanted centered Shockwave Flash films on their pages, back before CSS even existed. Centering meant knowing the width of a file, and while getimagesize() already existed (and still works today), it didn’t understand Flash. Derick added that support. From there he fell into bug triage, spending several years working through the issue tracker alongside Jani Taskinen (whose “Sniper” name still shows up in commit logs). For a long time it was just the two of them reproducing and fixing bugs — an important task that gets neglected easily, which is exactly how backlogs of a thousand issues and pull requests build up. The Eternal Problem of Date and Time Chris and Derick dig into why date-time bugs are so hard to triage: date algorithms are genuinely complicated, and it takes real time to figure out whether a report is a user’s mistake or an actual PHP bug. Crashes are easy to reproduce; subtle date arithmetic is not. The core philosophical question is “what does adding a month even mean?” If it’s January 31st and you add a month, PHP historically just bumps the month number, producing February 31st, which overflows to March 2nd or 3rd. But most people who add a month really just want the next month and don’t care about day counts — so “next month” is conceptually distinct from “add a month.” Derick has been brainstorming better interfaces so people can’t make these mistakes, though it’s a lot of work. They touch on Carbon as a unified interface people understand, but agree that making Carbon the language standard isn’t the right move. At the language level you need something that works for everybody and ideally doesn’t break existing code. What’s Coming in PHP 8.6 The first new time class is landing: a Duration object representing seconds and nanoseconds within a specific range, living in the Time namespace. It’s a trial run for new APIs and immediately useful — for example, passing a duration to sleep or to timeouts in the new polling API, rather than juggling raw integers. Another highlight is partial function application. With the pipe operator from 8.5, piping into anything that takes more than one argument meant wrapping it in a closure (and extra parentheses because of how the parser works). Partials let you pre-fill some arguments so the resulting callable accepts just one — perfect for pipelines. There’s also TLS session resumption support for streams, which lets OpenSSL shortcut the expensive session setup on repeated TLS connections. Bigger stream-layer work by Jakub Zelenka of the PHP Foundation is underway too, but that’s a huge job on old code and won’t make 8.6 — Chris and Derick both note the pain of keeping a year-and-a-half-long project in sync with the master branch. Xdebug in 8.6 and the Xdebug Cloud Xdebug’s recent headline feature (shipped with 8.5) is native path mapping, which lets you configure remote-to-local path mappings inside Xdebug itself instead of your IDE — handy when your code runs in Docker or on a dev machine. Feedback since release is driving quality-of-life improvements. For 8.6, relatively little is broken, though a change to how PHP reports line numbers needs untangling so debugging stops on the correct lines. Derick also has a new code-coverage implementation that gives better, more correct results at roughly a 10% speed cost. He’d rather ship correct output than fast output — and points out that PHPCov may be quicker but skips path and branch coverage entirely. The pair discuss how branch coverage doubles your test count at every branching point, and how Xdebug has a hard limit (around 64K) to avoid running out of memory on pathological code. Finally, Chris asks about Xdebug Cloud — a paid service that enables debugging where networking otherwise wouldn’t, such as remote teams sharing a single development machine (an SSH tunnel only lets one person listen on the debug port). It’s £15/month or £150/year for an individual, priced similarly to Packagist’s private packages, and helps fund Derick’s ongoing Xdebug work. He plans to do more marketing about it this year. Deprecations, Consensus, and Two-Thirds Votes Every year PHP collects a big list of deprecations — around 20 to 25 this cycle — voted on separately. Derick is more reluctant than most to approve them, arguing many offer no clear user benefit. His examples: deprecating metaphone() (whose suggested Composer replacement ironically relies on the internal function) and the dechunk filter (which can’t really be removed because HTTP streams use it internally). The list() deprecation is another sore point — Chris uses it, and the vote is tied 21–21 with one abstention, so it won’t pass under the two-thirds rule. Derick reminds everyone that “yes” needs to be twice “no.” Returning from a finally block is another candidate that makes little sense to use but hurts nothing to keep. Chris and Derick reflect on how voting was originally meant to confirm consensus reached on the mailing list, not to be the decision itself. A 50%+1 result isn’t consensus; two-thirds is the compromise, even if true 75–80% agreement would be ideal. Joe notes many deprecations are groundwork to reserve keywords for future RFCs — which raises the perennial question of how you measure real-world usage across Composer’s dependency chains. Infrastructure, the Website, and the Next Generation The PHP infrastructure has been converted to an Ansible-based repository over the last year and a half (largely by Derick, with help from Joe), replacing a wild mix of individually maintained servers — one was still running FreeBSD 4.3. They’ve also migrated to a new CDN, which brought surprises: a default one-month cache, ignoring the query string in cache keys, and even dark/light mode being an organization-wide setting rather than per-user. On the website side, everything currently lives in a single root directory of 1999-vintage code, and there’s a long-pending patch to restructure it. The PHP Foundation’s ambassadors program — with speaking, marketing, and research streams — aims to make the very techy php.net homepage speak to CTOs and newcomers about who uses PHP and why it’s a thriving project (only 31-ish years old, versus C’s 60). The conversation closes on caretakers and the next generation of contributors. Triage, they stress, doesn’t require deep internals knowledge — just reading reports to see if they still make sense is hugely valuable. Security and infrastructure access necessarily stay gatekept for trust reasons, and both agree a bus factor of one (or even two) isn’t good enough. Chris admits he’s struggling to name people who are both nice and know infra. Links from the show: Join us live in Discord — discord.phparch.com Watch live on YouTube — youtube.com/phparch PHP Tek Conference 2027 — Call for Papers now open PHP Arch Swag Store — store.phparch.com Xdebug — and Xdebug Cloud for shared debugging Magazine discount code ALIVE3 — three free months on an annual digital subscription Host: Chris Miller X: @ccmiller2018 Mastodon: @miller@phpc.social Bluesky: @ccmiller2018.bsky.social PHPArch.me: @miller Mike Page Mastodon: @MikePageDev@phpc.social PHPArch.me: @mikepagedev Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – the team is available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners Displace Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/ OurCVEs Your security posture, on autopilot with OurCVEs CodeRabbit Cut code review time & bugs in half instantly with CodeRabbit. PHP Architect Consulting Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/ Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post PHP Alive and Kicking 2026.08.04 appeared first on PHP Architect.

Seven Linux kernels landed in one day. We sort out which belong in your homelab, and trace Linux's long, occasionally disastrous quest for truly random numbers.Sponsored By:Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.Support LINUX UnpluggedLinks:Web Boost — Send us a boost via sats or USD

Agentic AI is changing the threat landscape. We've moved beyond chatbots to autonomous systems that navigate files and take actions, expanding the attack surface. Recent incidents highlight the risk. Hugging Face suffered a breach where an AI agent became the entry point into production systems, showing that developer tools are now critical infrastructure. OpenAI's GPT-5.6 accidentally deleted user data, including a production database, after misconfiguring an environment variable—no malicious intent, just real consequences, underscoring the need for mandatory sandboxing. Meanwhile, SpaceX's Grok Build tool was found defaulting to collecting user repositories and sending them to internal cloud storage without clear consent, a reminder of “default-on” data exfiltration risks. A newer threat, Agent Data Injection, manipulates trusted metadata (like IDs or fields) with crafted inputs to mislead agents into unintended actions. A strong counterexample is the 1Password–Claude integration, which requires biometric approval before accessing credentials, keeping secrets out of the AI entirely. Human-in-the-loop controls should be standard.Legacy systems remain a major risk. Windows, OpenSSL, and WordPress continue to produce serious vulnerabilities. LegacyHive allows privilege escalation in Windows by loading another user's registry hive. HollowByte exploits a small crafted TLS payload in OpenSSL to trigger memory over-allocation and denial of service. The wp2shell chain enables unauthenticated remote code execution in WordPress core (versions 6.9–7.0), challenging the assumption that only plugins are risky. At the same time, Windows 10 is reaching end-of-life, yet roughly 17% of devices still run it, especially in cost-sensitive sectors like healthcare and small business. As Windows 11 patches are released, they effectively expose underlying flaws that attackers can reuse against unsupported systems.Trust itself is increasingly being exploited. Attackers are hiding inside legitimate platforms instead of building new infrastructure. HollowGraph malware uses compromised Microsoft 365 calendars as command-and-control channels, embedding instructions in far-future events and routing through normal Graph API traffic. A Norwegian transit test revealed electric buses could be remotely disabled via foreign SIM cards, highlighting risks in over-the-air control systems across transportation sectors. Ransomware groups are also evolving: JadePuffer's ENCFORGE targets AI model artifacts, treating trained models as high-value assets. Researchers have already used GPT models to build exploit chains, signaling AI's shift into offensive security roles.Governance gaps are compounding the problem. A ProPublica report found Microsoft used China-based engineers to support U.S. Department of Defense cloud systems via low-paid American intermediaries who relayed code without understanding it—technically compliant, but operationally risky. The UK scrapped its £1.8B digital ID program after execution failures. In another case, a single typo in a police report, combined with automated license plate recognition, led to a wrongful arrest, showing how systems can enforce human error without validation.The common thread is misplaced confidence—in AI agents, legacy systems, and formal compliance. Practical steps are clear: require human approval for sensitive AI actions, verify data access beyond contractual assurances, sandbox all agents, treat AI models as critical assets with backups, and update detection strategies to monitor abuse within trusted platforms, not just external threats.Trust, increasingly, is the vulnerability.

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side. The "bone crushing" didn't happen this month. Revisiting and inspecting July's Patch Tuesday. A widespread and worrisome flaw in OpenSSL. Claude can now access your 1Password credentials. Bitwarden is aware that we need whole new security. The day ends in "y" so a new prompt injection attack. A true (and rare) core Wordpress emergency update. Lots of interesting listener feedback. And new ways AI is being used by bad guys Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: canary.tools/twit - use code: TWIT zscaler.com/security adaptivesecurity.com joindeleteme.com/twit-biz arcticwolf.com/trends

How NASA built Artemis II's fault tolerent Computer, Jails vs LXC, Respsectfully getting a personal copy of a website, Opensense 26.1.9 and more... NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines How NASA Built Artemis II's Fault-Tolerant Computer Jails vs LXC: What's the Right Choice for Infrastructure? News Roundup FreeBSD 15.1-RELEASE Announcement Release Notes Notes on respectfully getting a personal copy of a website's contents OPNsense 26.1.9 released Corrupting a ZFS File on Purpose The status of OpenSSL 4.0 support in syslog-ng Tarsnap This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups. Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv Join us and other BSD Fans in our BSD Now Telegram channel

Switching from Proxmox to Sylve, FreeBSD Quarterly report, FreeBSD's laptop program, Migrating ZFS, Haiku and OpenSSL news, and more... NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines I Switched from Proxmox to Its FreeBSD Counterpart on My Home Server – Here is How it Went FreeBSD Quarterly Report The FreeBSD Foundation's Laptop Support Project News Roundup Migrating ZFS filesystems from one zpool to another – same host Haiku Isn't Just For X86 Anymore, Boots On ARM In QEMU OpneSSL 4.0 Other schedulers? Illumos? Tarsnap This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups. Feedback/Questions Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv Join us and other BSD Fans in our BSD Now Telegram channel

独立行政法人情報処理推進機構（IPA）および一般社団法人JPCERT コーディネーションセンター（JPCERT/CC）は3月17日、OpenSSLにおけるTLS 1.3鍵交換グループの選択に関する問題について「Japan Vulnerability Notes（JVN）」で発表した。

Josh talks to Paul Kehrer and Alex Gaynor, from the Python Cryptographic Authority. Alex and Paul recently published a statement discuss the challenges posed by modern OpenSSL. We discuss the statement and their relationship with OpenSSL. We chat about some of the current features in cryptography, as well as some of what's coming in the future. It's a fun conversation that hits on a lot of great points. The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2026/2026-03-cryptography-alex-paul/

Un nouveau fonds vient de voir le jour avec une ambition inédite : soutenir durablement les logiciels libres. Baptisé Open Source Endowment, il se présente comme le premier fonds de dotation entièrement dédié à l'open source. Selon le média spécialisé The Register, l'organisation a déjà réuni environ 700 000 dollars auprès d'une soixantaine de donateurs fondateurs, parmi lesquels figurent des créateurs de projets majeurs comme curl, Nginx, Vue.js, ClickHouse, Elastic ou encore Pydantic.L'initiative part d'un constat bien connu dans le monde du logiciel libre : l'écosystème repose sur un travail massif… rarement rémunéré. Environ 86 % des développeurs open source ne perçoivent aucun revenu pour leurs contributions, alors même que 95 % des bases de code utilisées dans le monde reposent, directement ou indirectement, sur ces logiciels.Le modèle imaginé par l'Open Source Endowment s'inspire des universités. Son fondateur, Konstantin Vinogradov, rappelle que deux systèmes ont historiquement permis de financer l'enseignement supérieur : les financements publics et les dotations privées. Or, dans un écosystème mondial, décentralisé et transnational comme celui de l'open source, un financement public global est difficile à mettre en place. L'idée est donc de créer une dotation permanente. Concrètement, l'argent donné au fonds n'est pas redistribué immédiatement. Il est investi, et seuls les intérêts générés servent à financer des subventions pour des projets libres existants. Le capital reste intact afin de constituer un socle financier durable. Les donateurs qui versent plus de 1 000 dollars peuvent devenir membres et participer à la gouvernance du fonds.Cette initiative intervient dans un contexte où les alertes se multiplient depuis des années. En 2014, la faille de sécurité Heartbleed avait révélé que le logiciel OpenSSL — pourtant crucial pour la sécurité de l'internet — était maintenu par une équipe minuscule et disposait de moins de 2 000 dollars de dons annuels. Plus récemment, plusieurs mainteneurs de projets essentiels ont publiquement dénoncé un système « gratuit » qui repose en réalité sur quelques individus sous-financés. Reste une question majeure : l'échelle. Avec 700 000 dollars, le fonds envoie un signal symbolique fort, mais il reste très loin des besoins réels. Pour fonctionner durablement, il devra convaincre les grandes entreprises technologiques — celles qui utilisent massivement l'open source — de contribuer réellement à son financement. Hébergé par Acast. Visitez acast.com/privacy pour plus d'informations.

The CLAIR Model: A Synthesized Conceptual Framework for Mapping Critical Infrastructure Interdependencies [Guest Diary] https://isc.sans.edu/diary/The+CLAIR+Model+A+Synthesized+Conceptual+Framework+for+Mapping+Critical+Infrastructure+Interdependencies+Guest+Diary/32748 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability CVE-2026-20127 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk https://blog.talosintelligence.com/uat-8616-sd-wan/ Abusing Cortex XDR Live https://labs.infoguard.ch/posts/abusing_cortex_xdr_live_response_as_c2/ OpenSSL Vulnerability CVE-2025-15467 https://seclists.org/oss-sec/2026/q1/220

Se Stanislavem Fortem o nástupu AI agentů, limitech a rizicích umělé inteligenci, ochraně a opravování softwarových katedrál a budování kyberbezpečnostního startupu Aisle v Praze. Moderuje Štěpán Sedláček.Pravděpodobně prožíváme technologickou revoluci, jejíž rychlost, rozsah a potenciálních dopady na lidský život a práci nemají obdoby, ať už skončí jakkoli. Nástup velkých jazykových modelů a generativní AI je čím dál patrnější napříč různými sférami lidské činnosti od programování po umění. Otázky, které dříve řešila poměrné malá skupina lidí spojených s výzkumem a vývojem umělé inteligence nebo science fiction, jsou dnes často ve středu zájmu celospolečenské debaty, byť by si možná zasloužily ještě více pozornosti a to i ze strany států. Otázku po tom, jestli někdy bude k dispozici umělá inteligence, která předčí člověka, dnes spíše přebíjí otázka, jestli nás od ní dělí rok, několik let nebo víc času. Stanislav Fort je matematik, fyzik a expert na umělou inteligenci a velké jazykové modely (LLM), který dříve působil v předních světových společnostech v oboru Google DeepMind nebo Anthropic. Jak vidí letošní rok na poli AI?„Myslím, že letos si většina lidí uvědomí, že AI funguje a je schopná dělat užitečnou intelektuální práci. V roce 2025 se staly mainstreamem přemýšlecí (tzv. reasoning) modely zejména v souvislosti s nástupem modelu R1 od společnosti DeepSeek. Během té doby se modely extrémně zlepšily a začaly být schopné řešit dlouhé a obtížné intelektuální úkoly napříč obory u nichž je třeba koordinovat přemýšlení přes dlouhé časové horizonty. A ty se měsíc po měsíci prodlužovaly rapidním tempem. Dnes si už většina lidí v programování i softwarovém inženýrství a odvětvích, která silně závisejí na využití počítačů, uvědomuje, že jsme na hraně toho, kdy tyto věci dokáží pracovat na podobných věcech jako elitní lidé a nepotřebují příliš supervize. Rok 2026 bude rokem, kdy AI agenti a přemýšlecí modely, které je pohánějí, začnou fungovat v reálných ekonomicky důležitých činnostech,“ říká expert Stanislav Fort, který společně s Ondřejem Vlčkem a Jayou Baloo založil firmu Aisle, kde působí jako hlavní vědec.Podařilo se jim vytvořit autonomní AI nástroj, který umí rychle nacházet a opravovat bezpečnostní chyby ve složitých softwarových systémech jako je protokol OpenSSL, který šifruje většinu komunikace na webu. Jaké mají po roce fungování na poli kybernetické bezpečnosti cíle? Jaký zásadní problém se jim podařilo vyřešit? Co říká na nástup AI agentů dění kolem sítě Moltbook? Vidí nějaké fundamentální limity ve vývoji umělé inteligence? Co si myslí o AI bublině na trzích? Jak by se měla Evropa postavit k aktuálním závodům ve vývoji AI? A jaká úskalí má zakládání kyberbezpečnostního startupu v Praze? Nejen na to se ptá v podcastu Zeitgeist Štěpán Sedláček.

Karnevalskater trifft Open-Source-Kater: Zwischen FOSDEM-Raumsuche, MySQL-Gerüchten und ethischen Grundsatzdebatten stolpern wir durch Tech-Trends und AI-News. Dazu gibt's Abo-Detox, Desktop-Frust und die Erkenntnis: Digitale Souveränität beginnt manchmal mit „Kündigen“-Button statt Keynote. Blast from the Past MySQL - Bericht vom FOSDEM Stand Rant extended - same as posting blogposts on linkedin applies - of course - to medium. Static Site Generators with AsciiDoc support Toter der Woche Google Pixel 3a Untoter der Woche notepads Windows Notepad Ursache Markdown feature Microsoft seite Notepad++ AI der Woche AI agent seemingly tries to shame open source developer for rejected pull request AI found 12 of 12 OpenSSL zero-days (while curl cancelled its bug bounty) Selfish AI Anthropic raises $30B Series G funding at $380B post-money valuation (Anthropic) Nvidia shares are down after a report that its OpenAI investment stalled. Here's what's happening News Wero: Commerzbank macht mit

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

EP 277In this week's dark matter:Privacy-first users send a clear message to DuckDuckGo.  AI-free search is here to stay for most of its community.A cutting-edge AI from AISLE exposed deep-seated vulnerabilities in OpenSSL, exponentially speeding the pace of cybersecurity discovery.A security breach at eScan transformed trusted antivirus software into an unexpected cyber weapon.An internal probe suggests a cyber intrusion may have prematurely exposed last year's Nobel Peace Prize laureate.A U.S. jury found former Google engineer Linwei Ding guilty of funneling AI trade secrets to Chinese tech companies.Newly surfaced records reveal U.S. investigators examined claims that WhatsApp's encryption might not be as airtight as advertised.Apple's new location “fuzzing” feature gives users the power to stay connected, without being precisely tracked.A privacy lapse in a talking AI toy exposed thousands of private conversations between children and their plush companions.Google unleashes new AI to investigate DNA's ‘dark matter'.  DeepMind's latest creation, AlphaGenome, is shining light on the 98% of DNA that science once found inscrutable.Come on, let's go unravel some genomes.Find the full transcript to this podcast here.

When a popular antivirus and even Notepad++ turn into infection vectors after supply chain breaches, it's clear no software is safe from attack—or from its own update system. Steve and Leo unpack the risks hiding right inside your next auto-update. An anti-virus system infects its own users. Apple's next iOS release "fuzzes" cellular locations. cURL discontinues bug bounties under bogus AI flood. AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. Ireland did NOT already pass their spying legislation. AI irreversibly deletes all project files. Says it's sorry. Windows has a serious global clipboard security problem. ISPs have the ability to monetize their subscriber's identities. MongoDB has lowered the hacking skill level bar to the floor Show Notes - https://www.grc.com/sn/SN-1063-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: threatlocker.com/twit meter.com/securitynow bitwarden.com/twit material.security guardsquare.com

The Python cryptography module, pyca/cryptography, has mostly been a sane wrapper around a pile of C, so that users get performant cryptography on the many, many platforms Python targets. Therefore its maintainers, Alex Gaynor and Paul Kehrer, have become intimately familiar with OpenSSL. Recently, they declared that after many years of trying to make it work, they announced pyca/cryptography would be moving away from OpenSSL when supporting new functionality and exploring adding other backends instead. We invited them on to tell us about what has happened to OpenSSL, even after the investments and improvements following Heartbleed. No guests on this pod represent anyone besides themselves.Watch on YouTube: https://www.youtube.com/watch?v=dEKBHI3rodYTranscript: https://securitycryptographywhatever.com/2026/02/01/python-cryptography-breaks-up-with-opensslLinks:- https://cryptography.io/en/latest/statements/state-of-openssl/- Py Cryptography: https://cryptography.io- https://archive.openssl-conference.org/2025/presentations/Alex_Gaynor_Paul_Kehrer_The_Python_Cryptographic_Authoritys_OpenSSL_Experience.pdf- https://securitycryptographywhatever.com/2025/08/16/alex-gaynor/- https://packages.gentoo.org/packages/media-libs/libsdl- https://www.youtube.com/watch?v=RUIguklWwx0- https://datatracker.ietf.org/doc/rfc9180/- https://docs.openssl.org/3.3/man3/OSSL_PARAM/- https://openssl.foundation/- https://github.com/openssl/openssl/issues/17064- https://www.feistyduck.com/newsletter/issue_132_openssl_performance_still_under_scrutiny- https://github.com/topazproject/topaz- https://github.com/actions/runner/issues/1069- https://crystalhotsauce.com/- https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467- https://en.wikipedia.org/wiki/Ship_of_Theseus- https://boringssl.googlesource.com/boringssl/+/aa202db1d7091b88b80f0a58c630c5c1aefc817d- https://www.ibm.com/products/open-sdk-for-rust-aix- https://dadrian.io/blog/posts/corporate-support-xz/- https://peps.python.org/- https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed448/- https://go.dev/blog/fips140- https://dadrian.io/blog/posts/roll-your-own-crypto/"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian)

If you like what you hear, please subscribe, leave us a review and tell a friend!

CISA's interim director uploaded sensitive government material into the public version of ChatGPT. The cyberattack on Poland's power grid compromised roughly 30 energy facilities. The EU and India sign a new partnership that includes expanded cyber cooperation. Meta rolls out enhanced WhatsApp security features. Researchers uncover a campaign targeting LLM service endpoints. Fortinet and OpenSSL patch multiple vulnerabilities. A high-severity WinRAR vulnerability continues to see widespread exploitation six months after it was patched. The SoundCloud data breach affected nearly 30 million users. Ben Yelin explains the California lawsuit accusing social media platforms of harming kids. A Spanish resort town gets hit with low-rent ransomware.   Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today, Dave is joined by his Caveat co-host Ben Yelin, Program Director for Public Policy & External Affairs at the University of Maryland Center for Cyber Health and Hazard Strategies, to discuss the upcoming trial where Meta and YouTube will make their case against accusations of social media being harmful to children. You can learn more here.  T-Minus Guest Host Our T-Minus Space Daily podcast team is in Orlando, FL this week covering Commercial Space Week. Yesterday while the crew was on travel making their way to the event, Dave Bittner took his first spin behind the mic on T-Minus. Tune in and let us know how Dave did! You can follow along with host Maria Varmazis and producers Alice Carruth and Liz Stokes for event coverage via our LinkedIn profile. Selected Reading Trump's acting cyber chief uploaded sensitive files into a public version of ChatGPT (POLITICO) Cyberattack on Poland's power grid hit around 30 energy facilities, new report says (The Record) Europe/India • Indian 'hackers for hire' to continue to thrive under Brussels-New Dehli trade deal (Intelligence Online) New WhatsApp lockdown feature protects high-risk users from hackers (Bleeping Computer) Hackers hijack exposed LLM endpoints in Bizarre Bazaar operation (Bleeping Computer) Fortinet Patches Exploited FortiCloud SSO Authentication Bypass (SecurityWeek) High-Severity Remote Code Execution Vulnerability Patched in OpenSSL (SecurityWeek) Cybercriminals and nation-state groups are exploiting a six-month old WinRAR defect (CyberScoop) SoundCloud breach added to HIBP, 29.8 million accounts exposed (CyberInsider) Spanish municipality Sanxenxo City Council calls hackers bluff as malware takes over network (Cryptopolitan) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.  Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Initial Stages of Romance Scams [Guest Diary] Romance scams often start with random text messages that appear to be misrouted . This guest diary by Faris Azhari is following some of the initial stages of such a scam. https://isc.sans.edu/diary/Initial%20Stages%20of%20Romance%20Scams%20%5BGuest%20Diary%5D/32650 Denial of Service Vulnerabilities in React Server Components Another folowup fix for the severe React vulnerability from last year, but now only fixing a DoS condition. https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg OpenSSL Updates OpenSSL released its monthly updates, fixing a potential RCE. https://openssl-library.org/news/vulnerabilities/ Kubernetes Remote Code Execution Via Nodes/Proxy GET Permission Many Kubernetes Helm Charts are vulnerable to possible remote code executions due to unclear defined access controls. https://grahamhelton.com/blog/nodes-proxy-rce

Josh talk to Dirkjan and Joe about Rustls (pronounced rustles), a Rust-based TLS library. Dirkjan and Joe are developers on Rustls. We talk about the history that got us to this point. The many many challenges in writing a TLS library (Rust or not). We also chat about some of what's to come. Rustls has an OpenSSL compatibility layer which makes is a really interesting project. The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2025/2025-12-rustls-dirkjan-joe/

Mark “Murch” Erhardt and Mike Schmidt are joined by Bastien Teinturier, Rearden Code, and Pieter Wuille to discuss Newsletter #385: 2025 Year-in-Review Special.January● Updated ChillDKG draft (43:08) ● Offchain DLCs (45:53) ● Compact block reconstructions (2:29:27) February● Erlay update (1:53:55) ● LN ephemeral anchor scripts (0:50) ● Probabilistic payments (54:45) March● Bitcoin Forking Guide (3:29:35) ● Private block template marketplace to prevent centralizing MEV (3:05:28) ● LN upfront and hold fees using burnable outputs (13:12) April● SwiftSync speedup for initial block download (2:09:35) ● DahLIAS interactive aggregate signatures (3:26:02) Summary 2025: Quantum (58:07) May● Cluster mempool (1:22:11) ● Increasing or removing Bitcoin Core's OP_RETURN policy limit (2:45:43) June● Calculating the selfish mining danger threshold (2:20:39) ● Fingerprinting nodes using addr messages (3:11:38) ● Garbled locks (3:19:01) Summary 2025: Soft fork proposals (26:57) July● Chain code delegation (49:07) August● Utreexo draft BIPs (2:15:57) ● Lowering the minimum relay feerate (2:39:52) ● Peer block template sharing (2:56:01) ● Differential fuzzing of Bitcoin and LN implementations (3:16:08) Summary 2025: Stratum v2 (2:04:49) September● Details about the design of Simplicity (3:23:01) ● Partitioning and eclipse attacks using BGP interception (3:13:47) October● Discussions about arbitrary data (3:01:15) ● Channel jamming mitigation simulation results and updates (11:05) November● Comparing performance of ECDSA signature validation in OpenSSL vs. libsecp256k1 (2:01:47) ● Modeling stale rates by propagation delay and mining centralization (2:22:32) ● BIP3 and the BIP process (3:31:37) ● Bitcoin Kernel C API introduced (3:35:35) December● Splicing (7:33)

Researchers from the University of Maryland Baltimore County have evaluated the support for post-quantum cryptography (PQC) in nine open-source cryptographic libraries, revealing a mixed landscape of preparedness. Some libraries, like wolfSSL/wolfCrypt, are leading with strong and early PQC support, while others, such as OpenSSL, are still in the process of integrating these algorithms. The study highlights the importance of transitioning to PQC due to the potential of quantum computers to break current public-key cryptosystems. You can listen to all of the Quantum Minute episodes at https://QuantumMinute.com. The Quantum Minute is brought to you by Applied Quantum, a leading consultancy and solutions provider specializing in quantum computing, quantum cryptography, quantum communication, and quantum AI. Learn more at https://AppliedQuantum.com.

Mark “Murch” Erhardt, Gustavo Flores Echaiz, and Mike Schmidt are joined by Sebastian Falbesoner, PortlandHODL, Tadge Dryja, and Antoine Poinsot to discuss Newsletter #379.News● Comparing performance of ECDSA signature validation in OpenSSL vs. libsecp256k1 (1:47) Changing consensus● Multiple discussions about restricting data (14:05) ● Post-quantum signature aggregation (1:00:05) ● Native STARK proof verification in Bitcoin Script (1:18:47) ● BIP54 implementation and test vectors (35:47) Releases and release candidates● Core Lightning 25.09.2 (1:30:54) ● LND 0.20.0-beta.rc3 (1:31:44) Notable code and documentation changes● Bitcoin Core #31645 (1:32:34) ● Core Lightning #8636 (1:40:08) ● Core Lightning #8639 (1:43:18) ● Core Lightning #8635 (1:44:31) ● Eclair #3209 (1:46:25) ● Eclair #3206 (1:46:59) ● Eclair #3210 (1:49:31) ● LDK #4140 (1:54:13) ● LDK #4168 (1:59:12) ● Rust Bitcoin #5116 (2:01:06) ● BTCPay Server #6922 (2:05:05)

In this episode of Remote Ruby, Chris and Andrew catch up with Chris discussing the arrival of a new baby and the challenges of balancing work and parenting. Then, they dive into the complexities of dealing with OpenSSL 3.6 issues on their development environments, exploring various debugging attempts and ultimately finding a workaround. The conversation also touches on the ongoing drama within the Ruby community, expressing concerns about its impact and the need for unity. Additionally, they share thoughts on shows/series they've been watching and reflect on the joys and frustrations of nostalgic activities like building with Legos. The episode wraps up with a teaser about forthcoming features for Action Push, particularly for web notifications. Hit download now to hear more! LinksJudoscale- Remote Ruby listener giftGitHub PR #949- certificate verify failed (unable to get certificate CRL) Can I emailTaskThe GirlfriendMementoThe Usual SuspectsThe Bearcarlhuda Chris Oliver X/Twitter Andrew Mason X/Twitter Jason Charnes X/Twitter

This week it's all about your feedback! We answer your questions, and dig through your problems! -- During The Show -- 00:50 Intro Hallucinating 03:45 Friso from Mumble Moving all chats to one application Matrix Server Bridges Beeper Messages not flowing Self hosting beeper bridges E2EE 12:05 Security Cameras - Dustin Used Axis cameras Reolink Camera's POE Ethernet only models Some models require Reolink app for first setup Doorbell camera Steve's "doorbell camera flow" Surveillance Station Get one drive Reduce frame rate Weeks worth of footage Axis camera 2035 or 2036 Axis P3367 Write back in! 24:04 Laptops - Dasgeek Framework 12 Framework 12 vs Framework 13 25:45 News Wire Proxmox Mail Gateway 9.0 - helpnetsecurity.com (https://www.helpnetsecurity.com/2025/10/06/proxmox-mail-gateway-open-source-email-security-solution) GnuCash 5.13 - gnucash.org (https://www.gnucash.org/download.phtml) GNU Octave 10.3 - octave.org (https://octave.org/news/release/2025/10/01/octave-10.3.0-released.html) OpenSSL 3.6 - openssl-library.org (https://openssl-library.org/post/2025-10-01-3.6-release-announcement) Docker 28.5 - docker.com (https://docs.docker.com/engine/release-notes/28) Cairo-Dock 3.6 - phoronix.com (https://www.phoronix.com/news/Cairo-Dock-3.6-Released) GNU Linux Libre Kernel 6.17 - gnu.org (https://lists.gnu.org/archive/html/info-gnu/2025-09/msg00007.html) Tinycore 16.2 - tinycorelinux.net (https://forum.tinycorelinux.net/index.php/topic,27807.0.html) Opensuse Leap 16 - opensuse.org (https://get.opensuse.org/leap/16.0) Spine Endoscopic Atlas - nature.com (https://www.nature.com/articles/s41597-025-05897-7) Huawei Shrinks LLMs - venturebeat.com (https://venturebeat.com/ai/huaweis-new-open-source-technique-shrinks-llms-to-make-them-run-on-less) 4th Version of Granite AI - techrepublic.com (https://www.techrepublic.com/article/news-ibm-granite-40-ai) Granite AI Earns ISO 42001 - ibm.com (https://www.ibm.com/new/announcements/ibm-granite-iso-42001) 27:00 Send Feedback and Questions! Newbie questions welcome Fastest way to learn is immerse yourself Experts welcome too Email in! Follow up 30:45 Linux Basics - Kevin The bell story Level of learning GUI vs CLI Learning styles Ask your Linux friends Ask a LLM SIMPLE things Get hands on using it Set your expectations Tails Linux (https://tails.net/) Reproducibility Endless OS (https://www.endlessglobal.com/) Distro Hop Fedora (https://fedoraproject.org//) Ubuntu Arch Linux (https://archlinux.org/) Tiling window manager RHCSA and other Red Hat exams Canonical Academy ANS 437 (https://podcast.asknoahshow.com/437) -- The Extra Credit Section -- For links to the articles and material referenced in this week's episode check out this week's page from our podcast dashboard! This Episode's Podcast Dashboard (http://podcast.asknoahshow.com/462) Phone Systems for Ask Noah provided by Voxtelesys (http://www.voxtelesys.com/asknoah) Join us in our dedicated chatroom #GeekLab:linuxdelta.com on Matrix (https://element.linuxdelta.com/#/room/#geeklab:linuxdelta.com) -- Stay In Touch -- Find all the resources for this show on the Ask Noah Dashboard Ask Noah Dashboard (http://www.asknoahshow.com) Need more help than a radio show can offer? Altispeed provides commercial IT services and they're excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show! Altispeed Technologies (http://www.altispeed.com/) Contact Noah live [at] asknoahshow.com -- Twitter -- Noah - Kernellinux (https://twitter.com/kernellinux) Ask Noah Show (https://twitter.com/asknoahshow) Altispeed Technologies (https://twitter.com/altispeed)

Comparing Honeypot Passwords with HIBP Most passwords used against our honeypots are also found in the Have I been pwn3d list. However, the few percent that are not found tend to be variations of known passwords, extending them to find likely mutations. https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20Comparing%20Honeypot%20Passwords%20with%20HIBP/32310 Breaking Server SGX via DRAM Inspection By observing read and write operations to memory, it is possible to derive keys stored in SGX and break the security of systems relying on SGX. https://wiretap.fail/files/wiretap.pdf OneLogin OIDC Vulnerability A vulnerability in OneLogin can be used to read secret application keys https://www.clutch.security/blog/onelogin-many-secrets-clutch-uncovers-vulnerability-exposing-client-credentials OpenSSL Patch OpenSSL patched three vulnerabilities. One could lead to remote code execution, but the feature is used infrequently, and the exploit is difficult, according to OpenSSL

Daniel Stenberg, Swedish Internet protocol expert and founder and lead developer of the Curl project, speaks with SE Radio host Gavin Henry about removing Rust from Curl. They discuss why Hyper was removed from curl, why the last five percent of making it a success was difficult, what the project gained from the 5-year attempt to tackle bringing Rust into a C project, lessons learned for next time, why user support is critical, and the positive long-lasting impact this attempt had. Brought to you by IEEE Computer Society and IEEE Software magazine.

I discuss all things OpenSSL with Hana Andersen and Anton Arapov from the OpenSSL Corporation. Discover the intricacies of organizing the first-ever OpenSSL conference in Prague, the importance of post-quantum cryptography, and the evolution of OpenSSL from a small team to a global community. Whether you're a seasoned cryptographer or just curious about the future of secure communications, this episode offers insights and stories. Don't miss out on learning how OpenSSL is still shaping the future of cryptography. The show notes and blog post for this episode can be found at https://opensourcesecurity.io/2025/2025-09-openssl-hana-anton/

Joining the podcast this week is Mishi Choudhary, SVP and General Counsel at Virtru. Mishi shares with us some legal perspective on the privacy discussion including freedom of thought, the right to be forgotten, end-to-end encryption for protecting user data, finding a middle ground between meeting customer privacy demands and complying with legal requirements, getting to a federal privacy regulation, and so much more! You won't want to miss what is a truly spirited and candid conversation – in two parts! Mishi Choudhary SVP and General Counsel, Virtru A technology lawyer with over 17 years of legal experience, Mishi has served as a legal representative for many of the world's most prominent free and open source software developers and distributors, including the Free Software Foundation, Cloud Native Computing Foundation, Linux Foundation, Debian, the Apache Software Foundation, and OpenSSL. At Virtru, she leads all legal and compliance activities, builds internal processes to continue to accelerate growth, helps shape Virtru and open source strategy, and activates global business development efforts. For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e343

Joining the podcast this week is Mishi Choudhary, SVP and General Counsel at Virtru. Mishi shares with us some legal perspective on the privacy discussion including freedom of thought, the right to be forgotten, end-to-end encryption for protecting user data, finding a middle ground between meeting customer privacy demands and complying with legal requirements, getting to a federal privacy regulation, and so much more! You won't want to miss what is a truly spirited and candid conversation – in two parts! Mishi Choudhary, SVP and General Counsel, Virtru A technology lawyer with over 17 years of legal experience, Mishi has served as a legal representative for many of the world's most prominent free and open source software developers and distributors, including the Free Software Foundation, Cloud Native Computing Foundation, Linux Foundation, Debian, the Apache Software Foundation, and OpenSSL. At Virtru, she leads all legal and compliance activities, builds internal processes to continue to accelerate growth, helps shape Virtru and open source strategy, and activates global business development efforts. For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e342

This week we dig into how you can host your own 5G and Ubuntu's new certification program! -- During The Show -- 00:45 Technology Another Way Cell Phone sales and inventory Market uncertainty Erasing a phone Moving to GrapheneOS Used equipment Fdroid (https://f-droid.org/) Opportunities to move people to open source Routes to take 14:00 News Wire OpenSSH 10.0p2 - openssh.com (https://www.openssh.com/releasenotes.html) OpenSSL 3.5 - github.com (https://github.com/openssl/openssl/releases) GNU Coreutils 9.7 - gnu.org (https://www.gnu.org/software/coreutils/manual/coreutils.html) Pinta 3.0 - pinta-project.com (https://www.pinta-project.com/releases/3-0.html) OpenELA Leapp - techzine.eu (https://www.techzine.eu/news/devops/130476/openela-introduces-leapp-project-for-in-place-upgrades-of-enterprise-linux/) Linux Mint OEM Support - linuxmint.com (https://blog.linuxmint.com/?p=4825) Asahi Linux Roadblock - appleinsider.com (https://appleinsider.com/articles/25/04/08/asahi-linux-m4-support-hits-a-roadblock-because-of-apple-silicon-changes) Proxmox VW 8.4 - proxmox.com (https://www.proxmox.com/en/about/company-details/press-releases/proxmox-virtual-environment-8-4) Archbang 0904 - sourceforge.net (https://sourceforge.net/projects/archbang/files/ArchBang/archbang-0904-x86_64.iso/download) Feren OS 2025.03 - feren-os.com (https://medium.com/feren-os/feren-os-2025-03-minor-rebase-update-for-feren-os-f82ce0a47a52) Pardus 23.4 - pardus.org (https://pardus.org.tr/en/pardus-23-4-changelog/) SparkyLinux - sparkylinux.org (https://sparkylinux.org/sparky-7-7/) MX 26.3 - mxlinux.org (https://mxlinux.org/blog/mx-23-6-now-available/) Particle OS - itsfoss.com (https://news.itsfoss.com/systemd-particle-os/) Malware "Patches" - darkreading.com (https://www.darkreading.com/cloud-security/open-source-poisoned-patches-infect-local-software) Slopsquatting - theregister.com (https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/) Luminary Cloud and Honda's AI Model - engineering.com (https://www.engineering.com/luminary-cloud-releases-open-source-physics-ai-model-with-honda-nvidia/) 15:50 Canonical Certifications Adriana Frick's Story Why Adriana left tech BGP What did the creation process look like? Defining standards Making it measurable Proving skills How did you learn what employers want Mauricio Buschinelli's Story Verifying completion of a task What does the test look like Easter Eggs through out As close to real as possible Care about outcomes Accessibility Testing (https://ubuntu.com/credentials) A lot more coming 41:00 5G Cellphone companies want to be at the tower 5G Hardware Entire stack is open source Provisioning Sim Cards Roaming Charmed Ether SD Core 50:00 FCC Licensing Not a walk in the park FCC starting to require receiver registration Spectrum is crowded -- The Extra Credit Section -- For links to the articles and material referenced in this week's episode check out this week's page from our podcast dashboard! This Episode's Podcast Dashboard (http://podcast.asknoahshow.com/437) Phone Systems for Ask Noah provided by Voxtelesys (http://www.voxtelesys.com/asknoah) Join us in our dedicated chatroom #GeekLab:linuxdelta.com on Matrix (https://element.linuxdelta.com/#/room/#geeklab:linuxdelta.com) -- Stay In Touch -- Find all the resources for this show on the Ask Noah Dashboard Ask Noah Dashboard (http://www.asknoahshow.com) Need more help than a radio show can offer? Altispeed provides commercial IT services and they're excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show! Altispeed Technologies (http://www.altispeed.com/) Contact Noah live [at] asknoahshow.com -- Twitter -- Noah - Kernellinux (https://twitter.com/kernellinux) Ask Noah Show (https://twitter.com/asknoahshow) Altispeed Technologies (https://twitter.com/altispeed)

video: https://youtu.be/ua-RPOtdcF8 Comment on the TWIL Forum (https://thisweekinlinux.com/forum) This week in Linux, App 3.0 drops, bringing big changes under the hood. Amiga OS, yes, that Amiga OS, is still alive and getting updates, apparently. Open SSL 3.5 and Open SSH 10.0 both rolled out new features this week with also some future-proofing involved. And Sony, yes, that Sony, has released The Last of Us Part II on PC and it's Steam Deck verified. All that and much more on This Week in Linux, the weekly news show that keeps you plugged into everything happening in the Linux and Open Source world. Now let's jump right into Your Source for Linux GNews. Download as MP3 (https://aphid.fireside.fm/d/1437767933/2389be04-5c79-485e-b1ca-3a5b2cebb006/c5514bc1-148c-43d2-a6eb-4d0fcbfd6966.mp3) Support the Show Become a Patron = tuxdigital.com/membership (https://tuxdigital.com/membership) Store = tuxdigital.com/store (https://tuxdigital.com/store) Chapters: 00:00 Intro 00:39 APT 3.0 Released 02:48 Last of US Part 2 Verified for Steam Deck 05:47 MPV 0.40 Released 08:58 Sandfly Security [ad] 10:54 AmigaOS still exists and getting updates apparently 14:24 TUXEDO Provides Update On Their Snapdragon X Elite Linux Laptop 17:20 OpenSSL 3.5 Released 19:19 OpenSSH 10.0 Released 21:41 Support the show Links: APT 3.0 Released https://tracker.debian.org/news/1635519/accepted-apt-300-source-into-unstable/ (https://tracker.debian.org/news/1635519/accepted-apt-300-source-into-unstable/) https://9to5linux.com/apt-3-0-debian-package-manager-released-with-revamped-command-line-interface (https://9to5linux.com/apt-3-0-debian-package-manager-released-with-revamped-command-line-interface) https://www.phoronix.com/news/Debian-APT-3.0-Released (https://www.phoronix.com/news/Debian-APT-3.0-Released) Last of US Part 2 Verified for Steam Deck https://gameinformer.com/interview/2025/04/01/naughty-dog-and-nixxes-on-the-pc-port-of-the-last-of-us-part-ii-we-take-the (https://gameinformer.com/interview/2025/04/01/naughty-dog-and-nixxes-on-the-pc-port-of-the-last-of-us-part-ii-we-take-the) https://www.pcguide.com/news/steam-deck-support-is-so-important-says-the-last-of-us-part-2-pc-project-director/ (https://www.pcguide.com/news/steam-deck-support-is-so-important-says-the-last-of-us-part-2-pc-project-director/) MPV 0.40 Released https://mpv.io/ (https://mpv.io/) https://github.com/mpv-player/mpv/releases/tag/v0.40.0 (https://github.com/mpv-player/mpv/releases/tag/v0.40.0) https://www.phoronix.com/news/MPV-0.40-Released (https://www.phoronix.com/news/MPV-0.40-Released) https://9to5linux.com/mpv-0-40-open-source-video-player-released-with-native-hdr-support-on-linux (https://9to5linux.com/mpv-0-40-open-source-video-player-released-with-native-hdr-support-on-linux) Sandfly Security [ad] https://thisweekinlinux.com/sandfly (https://thisweekinlinux.com/sandfly) https://destinationlinux.net/409 (https://destinationlinux.net/409) discount code: destination50 (Home Edition) AmigaOS still exists and getting updates apparently https://www.hyperion-entertainment.com/index.php/news/1-latest-news/320-new-update-3-for-amigaos-32-available-for-download (https://www.hyperion-entertainment.com/index.php/news/1-latest-news/320-new-update-3-for-amigaos-32-available-for-download) https://www.theregister.com/2025/04/10/amigaos32_3/ (https://www.theregister.com/2025/04/10/amigaos_3_2_3/) TUXEDO Provides Update On Their Snapdragon X Elite Linux Laptop https://www.tuxedocomputers.com/en/How-is-TUXEDOCOes-ARM-Notebook-Coming-Along.tuxedo (https://www.tuxedocomputers.com/en/How-is-TUXEDOCOes-ARM-Notebook-Coming-Along.tuxedo) https://www.qualcomm.com/products/mobile/snapdragon/laptops-and-tablets/snapdragon-x-elite (https://www.qualcomm.com/products/mobile/snapdragon/laptops-and-tablets/snapdragon-x-elite) https://www.linaro.org/ (https://www.linaro.org/) https://www.phoronix.com/news/TUXEDO-Snapdragon-Laptop-Update (https://www.phoronix.com/news/TUXEDO-Snapdragon-Laptop-Update) OpenSSL 3.5 Released https://openssl-library.org/ (https://openssl-library.org/) https://github.com/openssl/openssl/releases/tag/openssl-3.5.0 (https://github.com/openssl/openssl/releases/tag/openssl-3.5.0) https://lwn.net/Articles/1016851/ (https://lwn.net/Articles/1016851/) https://9to5linux.com/openssl-3-5-released-with-support-for-pqc-algorithms-server-side-quic (https://9to5linux.com/openssl-3-5-released-with-support-for-pqc-algorithms-server-side-quic) https://www.phoronix.com/news/OpenSSL-3.5-Released (https://www.phoronix.com/news/OpenSSL-3.5-Released) OpenSSH 10.0 Released https://www.openssh.com/ (https://www.openssh.com/) https://www.openssh.com/releasenotes.html#10.0p1 (https://www.openssh.com/releasenotes.html#10.0p1) https://www.phoronix.com/news/OpenSSH-10.0-Released (https://www.phoronix.com/news/OpenSSH-10.0-Released) https://lwn.net/Articles/1016924/ (https://lwn.net/Articles/1016924/) Support the show https://tuxdigital.com/membership (https://tuxdigital.com/membership) https://store.tuxdigital.com/ (https://store.tuxdigital.com/)

Microsoft Patch Tuesday Microsoft patched over 120 vulnerabilities this month. 11 of these were rated critical, and one vulnerability is already being exploited. https://isc.sans.edu/diary/Microsoft%20April%202025%20Patch%20Tuesday/31838 Adobe Updates Adobe released patches for 12 different products. In particular important are patches for Coldfusion addressing several remote code execution vulnerabilities. Adobe Commercse got patches as well, but none of the vulnerabilities are rated critical. https://helpx.adobe.com/security/security-bulletin.html OpenSSL 3.5 Released OpenSSL 3.5 was released with support to post quantum ciphers. This is a long term support release. https://groups.google.com/a/openssl.org/g/openssl-project/c/9ZYdIaExmIA Fortiswitch Update Fortinet released an update for Fortiswitch addressing a vulnerability that may be used to reset a password without verification. https://fortiguard.fortinet.com/psirt/FG-IR-24-435

There's been a bit of a shakeup this week, with Torvalds criticizing Docker, Rustls dominating the TLS performance war, and Intel releasing a graphics card while "retiring" their CEO. Then, Flathub and KDE are working on their finances, OpenVPN has modernized its kernel driver, and Steam Machines may be back! Oh, and don't forget OBS 31 or the potential security issue with OpenWRT! For tips, we have eza as an ls replacement, pv for pipe progress viewing, IMSProg for EEPROM hacking, and HandlePowerKey for customizing what your machine does when you hit the power button. Grab the show notes at https://bit.ly/4gl1VtB and enjoy! Host: Jonathan Bennett Co-Hosts: Rob Campbell, David Ruggles, and Jeff Massie Want access to the video version and exclusive features? Become a member of Club TWiT today! https://twit.tv/clubtwit Club TWiT members can discuss this episode and leave feedback in the Club TWiT Discord.

Cybersecurity Today: Zero Day Flaws, FinTech Breach, Phishing Scams & More In today's episode, host Jim Love discusses critical updates in the cybersecurity world. Discover the latest zero day vulnerabilities patched by Apple, a significant data breach at Fintech giant Finastra, emerging phishing attack tactics using Microsoft Visio files and SVG attachments, and the launch of a new privacy-focused telecom service, CAPE. Additionally, learn about Google's AI-powered OSS Fuzz tool, which uncovered a critical flaw in the OpenSSL library. Stay informed to protect yourself and your organization from sophisticated cyber threats. 00:00 Introduction and Sponsor Message 00:59 Emerging Phishing Attack Strategies 03:12 Finastra Data Breach Investigation 04:49 Launch of CAPE: A Privacy-Focused Telecom Service 06:19 Apple's Emergency Updates for Zero-Day Vulnerabilities 07:29 Google's OSS Fuzz Uncovers Critical Vulnerabilities 09:07 Conclusion and Podcast Information

This week Robie Basak joins Noah from the Ubuntu Summit and gives an introduction on how to get started contributing to Ubuntu. -- During The Show -- 01:26 HexOS - Craig Start with the Command Line When is a GUI appropriate Start with make a ZFS pool make a samba share Help us understand your goal What is HexOS Ubuntu and ZFS DKMS kABI Advantages of TrueNAS Snapshots Send/Receive 1 Click Re-silvering 17:08 Questions about HDMI switch - Andy Theater Receiver Decimator (https://www.amazon.com/Decimator-DMON-QUAD-SD-SDI-Multi-Viewer-Outputs/dp/B072NGFDMR) 21:14 News Wire SQLite 3.47.0 - sqlite.org (https://sqlite.org/releaselog/3_47_0.html) Peazip 10 - github.io (https://peazip.github.io) Jellyfin 10.10.0 - jellyfin.org (https://jellyfin.org/posts/jellyfin-release-10.10.0/) EasyOS 6.4 - puppylinux.com (https://forum.puppylinux.com/viewtopic.php?t=12973) Gnome 47.1 - gnome.org (https://discourse.gnome.org/t/gnome-47-1-released/24670) Tor Browser 14.0 - torproject.org (https://blog.torproject.org/new-release-tor-browser-140/) AlmaLinux Kitten 10 - almalinux.org (https://almalinux.org/blog/2024-10-22-introducing-almalinux-os-kitten/) Gentoo & DTrace 2.0 - gentoo.org (https://www.gentoo.org/news/2024/10/23/DTrace-for-Gentoo.html) NASA $15.6M Grant for Open Source Tools - spaceanddefense.io (https://spaceanddefense.io/nasa-awards-15-6-million-in-open-source-software-funding/) Open Source Printable Lathe - hackaday.com (https://hackaday.com/2024/10/23/a-3d-printed-open-source-lathe/) Thelio Astra - system76.com (https://system76.com/desktops/thelio-astra) Eight Nvidia High Severity Vulnerabilities - forbes.com (https://www.forbes.com/sites/daveywinder/2024/10/25/urgent-new-nvidia-security-warning-for-200-million-linux-and-windows-gamers/) OpenSSL 3.4 - github.com (https://github.com/openssl/openssl/releases/tag/openssl-3.4.0) IPS Snort v3.5 - github.com (https://github.com/snort3/snort3/releases) Parrot OS 6.2 - parrotsec.org (https://parrotsec.org/blog/2024-10-23-parrot-6.2-release-notes/) New Granite 3.0 - zdnet.com (https://www.zdnet.com/article/ibm-doubles-down-on-open-source-ai-with-new-granite-3-0-models/) HUGS - reuters.com (https://www.reuters.com/technology/startup-hugging-face-aims-cut-ai-costs-with-open-source-offering-2024-10-23/) SynthID Now Open Source - theverge.com (https://www.theverge.com/2024/10/23/24277873/google-artificial-intelligence-synthid-watermarking-open-source) Mochi 1 - venturebeat.com (https://venturebeat.com/ai/video-ai-startup-genmo-launches-mochi-1-an-open-source-model-to-rival-runway-kling-and-others/) Ubuntu Turns 20 - ubuntu.com (https://ubuntu.com/20years) 23:23 Robie Basak - Ubuntu Technical Council What drew you to Linux? Why did you decide to work for Canonical? What is the Ubuntu Technical Board? Difference between Ubuntu and Canonical The process of granting commit rights Conflict resolution Cloud init Unique ID Ubuntu Summit Range of interaction Membership Board Meeting Full Hour Long Meeting Recording YouTube (https://www.youtube.com/live/pyRcIZskKNE?si=frx3zrPhUoeLrHi8) 43:40 Fedora 41 Fedora 41 available early! New DNF bootc Plasma Mobile Spin (https://fedoramagazine.org/announcing-fedora-linux-41/) Fedora Magazine (https://fedoramagazine.org/announcing-fedora-linux-41/) Minisforum v3 (https://store.minisforum.com/products/minisforum-v3?) Steve, Fedora, hardware 50:30 Russian Kernel Maintainers Removed Greg Kroah-Hartman removed them due to "various compliance requirements" Removed developers Russian and not minor contributors We live in a world where decisions are made for political reasons zdnet.com (https://www.zdnet.com/article/why-remove-russian-maintainers-of-linux-kernel-heres-what-torvalds-says/) therecord.media (https://therecord.media/russia-separate-linux-community-kernel-maintainers-delisted) -- The Extra Credit Section -- For links to the articles and material referenced in this week's episode check out this week's page from our podcast dashboard! This Episode's Podcast Dashboard (http://podcast.asknoahshow.com/413) Phone Systems for Ask Noah provided by Voxtelesys (http://www.voxtelesys.com/asknoah) Join us in our dedicated chatroom #GeekLab:linuxdelta.com on Matrix (https://element.linuxdelta.com/#/room/#geeklab:linuxdelta.com) -- Stay In Touch -- Find all the resources for this show on the Ask Noah Dashboard Ask Noah Dashboard (http://www.asknoahshow.com) Need more help than a radio show can offer? Altispeed provides commercial IT services and they're excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show! Altispeed Technologies (http://www.altispeed.com/) Contact Noah live [at] asknoahshow.com -- Twitter -- Noah - Kernellinux (https://twitter.com/kernellinux) Ask Noah Show (https://twitter.com/asknoahshow) Altispeed Technologies (https://twitter.com/altispeed)

CISA's "Secure by Design" Initiative The GNU C Library Flaw Fastly CDN switches from OpenSSL to BoringSSL Roskomnadzor asserts itself Google updates Android's Password Manager Firefox gets post-quantum crypto Get your TOTP tokens from LastPass Inflated iOS app data LearnDMARC Sync mobile app bug SpinRite and Windows Defender Crypto signing camera Analog hole in digital camera authentication iOS and Google's Topics The gathering of the Stephvens Programmable Logic Controllers SpinRite update Malware-infected Toothbrush The Unforeseen Consequences of Google's 3rd-party Cookie Cutoff Show Notes - https://www.grc.com/sn/SN-960-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit joindeleteme.com/twit promo code TWIT GO.ACILEARNING.COM/TWIT vanta.com/SECURITYNOW