Podcasts about TLS

This week, what TLS contributors are reading this summer; and Catherine Taylor on a trio of novels highlighting the growing pains of adolescence.'Back in the Day', by Oliver Lovrenski, translated by Nichola Smalley'Fun and Games', by John Patrick McHugh'Girl, 1983', by Linn Ullmann, translated by Martin AitkenProduced by Charlotte Pardy Hosted on Acast. See acast.com/privacy for more information.

Parce que… c'est l'épisode 0x600! Shameless plug 2 au 4 avril 2025 - Humaco 8 et 9 avril 2025 - Cybereco 10 au 18 mai 2025 - NorthSec 27 au 30 mai 2025 - Cycon 4 au 6 juin 2025 - SSTIC 12 au 17 octobre 2025 - Objective by the sea v8 10 au 12 novembre 2025 - IAQ - Le Rendez-vous IA Québec 17 au 20 novembre 2025 - European Cyber Week 25 et 26 février 2026 - SéQCure 2065 Description Introduction et contexte Le 600e épisode du podcast Policesécure réunit une assemblée d'experts en cybersécurité pour aborder un sujet particulièrement pertinent : l'obsec (operational security) personnel et la façon dont les professionnels de la sécurité gèrent leurs propres risques numériques. L'animateur Nicolas souligne d'emblée le paradoxe central de cette discussion : bien que ces experts conseillent quotidiennement leurs clients sur les meilleures pratiques de sécurité, ils admettent volontiers ne pas toujours appliquer ces recommandations dans leur vie personnelle. Cette conversation virtuelle rassemble des professionnels aux parcours variés : Vincent Milette (gestionnaire chez Air Canada), Guillaume Ross (expert en sécurité avec plus de 20 ans d'expérience), Samuel Harper (journaliste spécialisé), Dominique Derrier (consultant en cybersécurité), Catherine Dupont-Gagnon (spécialiste en sensibilisation), Alexandre Fournier (expert en continuité d'activité), Stéphane Laberge (professionnel chevronné) et Andréanne Bergeron (professeure associée à l'Université de Montréal). Les approches personnelles de la sécurité Vincent Milette : l'approche pragmatique Vincent adopte une perspective d'affaires même dans sa vie personnelle. Il privilégie la praticité et évite les solutions trop contraignantes qui pourraient affecter la flexibilité de sa famille. Sa stratégie repose sur la diversification : plusieurs navigateurs selon les contextes, utilisation de VPN pour certaines activités spécifiques, et adaptation aux besoins d'une famille où les niveaux techniques varient considérablement. Guillaume Ross : l'expert prudent mais réaliste Guillaume se distingue par sa rigueur concernant les mises à jour système et les sauvegardes. Il maintient un chiffrement systématique de ses données, qu'elles soient locales ou dans le cloud. Cependant, il avoue ne pas utiliser de VPN par paranoïa du WiFi public, préférant s'appuyer sur le chiffrement TLS généralisé. Son approche révèle une contradiction intéressante : parfois, trop de sécurité peut créer des vulnérabilités, comme il l'illustre avec l'anecdote de ses trois appareils dans le même sac contenant son gestionnaire de mots de passe. Samuel Harper : le journaliste pragmatique En tant que journaliste d'enquête, Samuel présente un cas d'usage particulier. Il utilise des VPN principalement pour ses recherches sur des infrastructures suspectes et maintient des comptes séparés pour ses investigations. Il souligne la difficulté pratique de maintenir un anonymat total, notamment concernant les numéros de téléphone anonymes, et prône une approche équilibrée entre sécurité et sanité mentale. Les autres approches Dominique se décrit comme “pourri” dans son obsec personnel malgré ses conseils professionnels. Catherine révèle les défis liés à son passé en marketing, où elle a construit une présence numérique importante avant de s'intéresser à la cybersécurité. Andréanne propose une philosophie intéressante : éviter la paranoïa excessive tout en maintenant une cohérence entre discours et pratique. Les anecdotes révélatrices L'incident de Catherine : un cas d'école de sécurité physique Catherine partage une anecdote particulièrement instructive de l'époque où elle animait un canal Twitch. En annonçant publiquement ses déplacements vers un café spécifique et en diffusant depuis son appartement avec une fenêtre visible, elle a involontairement fourni assez d'informations pour qu'un spectateur déduise son adresse exacte. Cette histoire illustre parfaitement comment l'ingénierie sociale et l'agrégation d'informations apparemment anodines peuvent compromettre la sécurité personnelle. Les désastres de sauvegarde Plusieurs participants partagent leurs expériences de pertes de données. Nicolas raconte avoir perdu des machines complètes à cause de clés de chiffrement perdues, tandis qu'Alexandre évoque sa “formation” précoce à l'importance des sauvegardes après avoir accidentellement supprimé des répertoires entiers sur un mainframe militaire, affectant 200 personnes passant un examen. La sécurité physique versus numérique La discussion révèle une dichotomie intéressante entre sécurité numérique et physique. Andréanne avoue une obsession pour la sécurité physique, cachant ses équipements dans des “pièces secrètes” et utilisant des leurres, contrastant avec son approche décontractée de la cybersécurité. Cette différence d'approche soulève des questions sur la perception des menaces et leur hiérarchisation. Les participants abordent également les défis pratiques des voyages : où laisser son passeport, comment gérer les appareils électroniques, l'utilisation des coffres-forts d'hôtel (généralement considérés comme peu fiables), et les précautions à prendre aux frontières. Les outils et leur utilisation Gestionnaires de mots de passe La conversation révèle des approches variées concernant les gestionnaires de mots de passe. Alors que la plupart utilisent des solutions classiques, Andréanne se distingue en utilisant un algorithme mental personnel pour générer ses mots de passe. Dominique utilise trois voûtes différentes selon le niveau de sensibilité des comptes. VPN et WiFi public Les avis divergent considérablement sur l'utilité des VPN. Guillaume argue que le chiffrement TLS généralisé rend les VPN moins critiques pour le WiFi public, tandis que d'autres les utilisent pour des cas spécifiques. La discussion souligne l'importance de comprendre la menace réelle plutôt que de suivre aveuglément des recommandations génériques. Passkeys et nouvelles technologies Les participants sont généralement optimistes concernant les passkeys, avec Sony PlayStation citée comme exemple positif d'implémentation, malgré des défis de récupération complexes. L'adoption reste limitée par la fragmentation entre les écosystèmes (Google, Apple, Microsoft). La fatigue sécuritaire et l'expérience utilisateur Un thème central émerge : la fatigue sécuritaire. Trop de mesures de sécurité peuvent conduire à l'abandon ou à des pratiques moins sûres. Les participants soulignent l'importance de l'expérience utilisateur dans l'adoption des bonnes pratiques. Les exemples incluent les sites bloquant le copier-coller de mots de passe, les demandes répétitives d'authentification, et les interfaces mal conçues qui poussent les utilisateurs vers des solutions moins sécurisées. Signal et la communication sécurisée La discussion sur “Signalgate” illustre les limites des outils de communication sécurisée. Signal offre un excellent chiffrement de bout en bout, mais ne protège pas contre les mauvaises pratiques d'utilisation ou les compromissions d'appareils. Les participants soulignent l'importance de comprendre ce que chaque outil protège réellement versus ce qu'il ne protège pas. Les menaces modernes et l'évaluation des risques Au-delà du hacker traditionnel Les participants identifient des menaces souvent négligées : la manipulation par la publicité ciblée, l'exploitation des données par des courtiers légitimes, et l'utilisation de ces informations par les forces de l'ordre sans mandat. Samuel souligne que cette collecte légale de données personnelles représente souvent une menace plus concrète que les cyberattaques traditionnelles. L'exemple des employés nord-coréens La discussion aborde le phénomène des employés nord-coréens infiltrant des entreprises occidentales, illustrant comment les processus de vérification d'identité pour les employés distants sont souvent moins rigoureux que ceux appliqués aux clients. Évolutions technologiques et perspectives Les participants notent plusieurs améliorations positives : 99% des connexions Chrome utilisent maintenant TLS, les gestionnaires de mots de passe sont intégrés dans les systèmes d'exploitation, et le chiffrement devient standard. Cependant, des défis persistent, notamment les paramètres par défaut souvent inadéquats et la complexité de maintenance de certaines solutions. Réflexions sur l'industrie et l'éducation La conversation révèle une autocritique de l'industrie de la sécurité : les experts reconnaissent leur difficulté à communiquer efficacement avec le grand public. Les conseils sont souvent trop techniques, contradictoires, ou inadaptés au modèle de menace réel des utilisateurs moyens. L'exemple du “carnet de mots de passe” illustre cette déconnexion : universellement critiqué par les experts, il peut pourtant être la solution la plus sécurisée pour certains utilisateurs. Conclusion Ce 600e épisode de Policesécure offre une perspective rafraîchissante et honnête sur la sécurité personnelle. En admettant leurs propres failles et contradictions, ces experts humanisent les défis de la cybersécurité. Leur message principal est clair : l'évaluation du risque doit précéder toute mesure de sécurité. Il ne s'agit pas d'atteindre la perfection sécuritaire, mais de trouver un équilibre praticable entre protection et fonctionnalité. La discussion souligne l'importance de contextualiser les conseils de sécurité selon le profil de menace réel de chaque individu, plutôt que d'appliquer une approche universelle. Elle met également en lumière les défis persistants de l'industrie pour rendre la sécurité accessible et compréhensible pour tous, tout en évitant la fatigue sécuritaire qui peut paradoxalement réduire le niveau de protection global. Collaborateurs Nicolas-Loïc Fortin Dominique Derrier Stéphane Laberge Andréanne Bergeron Catherine Dupont-Gagnon Samuel Harper Vincent Milette Guillaume Ross Alexandre Fournier Crédits Montage par Intrasecure inc Locaux virtuels par Riverside.fm

Fundamentals of Operating Systems Course https://oscourse.winktls is brilliant.TLS encryption/decryption often happens in userland. While TCP lives in the kernel. With ktls, userland can hand the keys to the kernel and the kernel does crypto. When calling write, the kernel encrypts the packet and send it to the NIC.When calling read, the kernel decrypts the packet and handed it to the userspace. This mode still taxes the host's CPU of course, so there is another mode where the kernel offloads the crypto to the NIC device! Host CPU becomes free. Incoming packets to the NIC are decrypted in device before they are DMAed to the kernel. outgoing packets are encrypted before they leave the NIC to the network.ktls still need handshake to happen in userspace. There is also enabling zerocopy in some cases (now that kernel has context) Deserves a video. So much good stuff.0:00 Intro2:00 Userspace SSL Libraries 3:00 ktls 6:00 Kernel Encrypts/Decrypts (TLS_SW)8:20 NIC offload mode (TLS_HW)10:15 NIC does it all (TLS_HW_RECORD)12:00 Write TX Example13:50 Read RX Example17:00 Zero copy (sendfile)https://docs.kernel.org/networking/tls-offload.html

The ASX 200 gave up strong early gains closing down 27 at 8565 (0.3%). US futures and lack of detail weighing on sentiment as Asian markets generally weaker. Banks slid slightly, CBA down 0.5% with NAB down 0.2% and the Big Bank Basket down to $262.66 (-0.5%). MQG whacked 1.6% with insurers also under pressure. REITs mixed, GMG off 1.2%. Industrials generally lower, ALL off 1.6% with retail down, led by SUL off 1.6% and BAP falling 2.7%. Travel stocks also under pressure, CTD down 3.1% and WEB off 2.8%. Fast food falling, DMP down 4.9%. REA fell 1.1% and TWE down 1.3% with TLS up 1.0% as defensives back in focus. In resources, gold miners back in demand, GMD up 6.0% and NEM up 3.0%. The Three Iron Ore amigos all down, BHP off 1.8% with FMG off 3.4%. Lithium stocks back under pressure, MIN off 7.6% and PLS falling 6.0%. Rare earth giant LYC rose 0.8%. Oil and gas stocks gave up strong early gains as the crude price fell back, KAR up 2.0% and BPT bouncing 2.4%. Uranium ok, nothing spectacular, DYL up 1.1% and PDN up 0.8%. In corporate news, CTT fell 31.2% on a trading update and a large line of stock going through. MVF rose 9.1% as its CEO resigned. COH up 0.7% after downgrading its earnings outlook. Nothing on the economic front today. Asian markets weaker, Japan off 0.6% and HK off 0.9. China unchanged.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

The word “revolution” conjures powerful imagery. But what does it mean today? Do revolutions neatly promote the will of the people, forging radical transformation? Or is it more complicated? Sociologist Volodymyr Ishchenko joins us from Freie Universität Berlin to explain his take on “deficient revolutions” as he reflects on the 2014 Euromaidan uprising and recent events in Ukraine – where, he argues, conflict with roots in class has become polarised along “ethnic” lines, with devastating consequences.Ukraine, he shows, is not an anomalous case on the periphery of Europe and the former USSR. Rather, its story is instructive for the study of global processes, including the “crisis of hegemony” – one he describes in terms of the “shellness” of politics, and which is in fact often compounded by contemporary revolutions. “People want their say”, Volodymyr explains. “They can overthrow the governments. But they cannot bring about the change that would represent their interests”.An urgent discussion about decolonisation and discourse, progress, popular mobilisation and imagining alternative futures. With reflection on Soviet-era sci-fi authors, the Strugatsky brothers – and on sociologists' duty to highlight complex, messy realities.Guest: Volodymyr Ishchenko; Hosts: Rosie Hancock, Alexis Hieu Truong; Executive Producer: Alice Bloch; Sound Engineer: David Crackles; Music: Joe Gardner; Artwork: Erin AnikerFind more about Uncommon SenseEpisode ResourcesBy Volodymyr IshchenkoTowards The Abyss: Ukraine from Maidan to WarUkrainian Voices?Class or regional cleavage? The Russian invasion and Ukraine's ‘East/West' divideInsufficiently diverse: The problem of nonviolent leverage and radicalization of Ukraine's Maidan uprising, 2013–2014Why is Ukraine struggling to mobilise its citizens to fight?From the Sociological Review FoundationCommunity, with Kirsteen PatonSecurity, with Daria KrivonosGood warning, Vietnam? Comparing the Russian opposition to Putin with the greatest anti-war movement in the US – Arseniy KumankovFurther resourcesThe Snail On The Slope – novel by Boris and Arkady Strugatsky, also reviewed in the TLS by Muireann MaguireUnderstanding Ukraine's Euromaidan Protests – Open Society Foundations“Ethnic Conflict: A Global Perspective” – Stefan WolffRead more about Antonio Gramsci, William H. Sewell and Dylan John Riley.Support our work. Make a one-off or regular donation to help fund future episodes of Uncommon Sense: donorbox.org/uncommon-sense

This week, a special podcast from the Hay Festival ranges from the ancient world to the 16th-century, taking in the art of criticism, the centrality of religion and eco-catastrophe. With Stephanie Merritt, Edith Hall, Toby Lichtig and a guest appearance from TLS crossword compiler Praxiteles.'Traitor's Legacy', by SJ Parris'Epic of the Earth: Reading Homer's "Iliad" in the Fight for a Dying World', by Edith HallProduced by Charlotte Pardy Hosted on Acast. See acast.com/privacy for more information.

ASX 200 finished up 75 points at 8542 (0.9%) close but no cigar. CBA became the first $300bn market cap stock on the ASX. Not surprisingly a new record, the Big Bank Basket up another 1.3% to $282.44. WBC the best of the bunch, up 1.5% with MQG up 1.5% and GQG lifting 4.3%. REITs also firmed GMG up 0.7% on data centre demand. Retail stocks also in demand following lacklustre GDP numbers and hopes fro more rate cuts. LOV romped 9.1% higher as Mark McInnes joined as deputy chair. JBH up 2.1% and HVN up 3.0% with travel and fast-food stocks rallying too. Defensives sold down as WOL, COL and TLS fell slightly, tech gained a little, WTC up 1.1% and TNE up 1.4% with the All-Tech Index up 0.9%. In resources BHP up 1.0% with FMG rising 1.6% as iron ore found some strength in Singapore. Gold miners sold down, EVN down 2.7% with GMD off 2.8% and SPR losing 0.9%. Uranium stocks spurted higher on Meta moves in US to shore up nuclear power deals, Lithium also saw buyers return, PLS up 5.7% and LTR rising 6.1% with MIN doing well, up 9.2%. Oil and gas better with CRN sorting some liquidity issues out, up 38.1%. In corporate news, MYX was issued with the scheme termination notice falling 5.3%, IEL fell another 2.6% after the 48% loss yesterday, and PBH had an upgraded bid of 120c. On the economic front, GDP came in below expectation at 0.2%. Asian markets firmed, Japan up 0.8%, HK up 0.6% and China up 0.5% 10-year yields steady at 4.25%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

ASX 200 up 53 points to 8647 (0.6%). A solid rally driven by bullion and banks. The Big Bank Basket rallied to $278.81 (+1.2%). CBA up another 1.3%, with ANZ doing well up 1.3%. MQG rose 0.9% and IFL up 2.7% on a broker upgrade, Insurers better, SUN was out and up 2.4% with IAG doing well, rising 2.9%. REITs rallied too, GMG up 1.1% and CHC rising 3.1%.  Industrials in demand across the board, JBH up 1.9% with WOW and COL better, TLS continuing to push ahead up 1.0% with QAN up another 2.0%. Healthcare mixed, SIG up 2.3% and CSL off 1.0%. Tech stocks rose, with the All-Tech Index up 0.3%. In resources, iron ore stocks drifted lower as iron ore fell on Chinese PMI. Gold miners off highs, but still strong, NEM up 4.3% with GMD gaining 4.6% and OBM up 5.9%. Lithium stocks falling again, PLS down 0.4% and MIN hit 5.5%. Oil and gas stocks rose with crude, uranium still under pressure again. DYL down 1.9% and PDN off 1.3%.  In corporate news, IEL fell 48.1% on a massive downgrade and nasty outlook statement, TEA ran 8.6% on a special dividend, DMP fell 2.2% after a raft of executive changes. In economic news, the RBA minutes helped sentiment, Chinese PMI dropped to 48.3. Asian markets slightly higher, Japan up 0.1%, HK up 1.1% and China up 0.5%. 10-year yields steady at 4.26%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

ASX 200 fell 21 points in quiet trade to 8415 (0.1%). Most sectors showing losses as nerves crept back in on Trump and Chinese negotiations. Banks slipped with WBC off 1.2% and the Big Bank Basket down to $275.32 (-0.1%). MQG fell 1.0% with insurers better, QBE up 1.3% and MPL rising 2.1%. REITs slid, GMD down 0.9% and VCX off 0.4%. Industrials were mostly flat, WOW and COL better, WES up 0.5% and SGH doing well, up 0.7% with BXB rallying 1.0%. TLS continued to push higher, tech was mixed as WTC fell 2.3% and XRO rose 1.5% with the All-Tech Index down 0.5%.  Healthcare under a little pressure, SIG off 3.2% following the sell-down last week. In resources, iron ore down in Singapore, BHP off 1.2% and FMG sliding 2.5%. Lithium stocks under pressure following the UBS downgrade last week, MIN off 11.8% and PLS falling 8.1%. Gold miners were better as bullion pushed higher on steel tariff issues, EVN up 3.1% and NEM up 1.2%. Oil and gas stocks eased slightly and uranium stocks fell. In corporate news, SOL announced a merger with BKW to create a new $15bn top 50 stock. Both stocks rallied hard on the news, a $500m zero discount capital raising also helped sentiment. BSL jumped 4.4% on US tariff moves, APE extended the buyback, JHX rose 1.4% on securing a new debt facility. Nothing on the economic front locally, China and US ratchet up war of words. Asian markets fell, Japan down 1.3%, HK off 1.9% and China down 0.5%. 10-year yields steady at 4.26%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

The ASX 200 limped to a 13-point rise at 8410 (0.2%) missing out on the US fun as the tariffs got knocked back and Nvidia ran on results. Banks were slightly better with NAB and WBC doing ok, CBA unchanged and the Big Bank Basket up to $272.57 (+0.4%). Financials were strong, MQG up 1.7% and XYZ rising 3.0%. REITs fell, GMG down 1.4% and SCG off 1.1%. Industrials firmed, TCL up 0.4%, WES up 0.2% and TLS pushing ahead up 0.8%. Tech was better but not stunning, WTC up 1.2% and the All-Tech Index up 0.6%. Retail better, TPW up 1.9% and BRG rising 0.4%. Resources were weighed down by BHP and RIO, the ugly sisters, LYC fell 2.1% and S32 off 1.0%. Gold miners were mixed, NST down 0.7% and EVN up 0.8% after a rocky start. Bullion fell on trade news, GMD rose 0.9% as broker upgrades came through. WDS kicked 2.8% on broker optimism on NW shelf deal and oil prices kicking up. Uranium back in the doghouse with DYL off 3.2% and PDN down 5.0%. In corporate news, CIA up 0.5% on record results, RSG fell another 2.4% despite seeking further information from Guinea government. ELD up 1.1% as the ACCC voiced concerns on its acquisition of Delta. Nothing on the economic front, Asian market rallied on the US news. 10-year yields steady at 4.37%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

What the status of Encrypted Client Hello (ECH)? What radio technology would be best for remote inverter shutdown? Some DNS providers already block newly listed domains. Knowing when not to click a link can take true understanding. Why can losing a small portion of a power grid bring the rest down? Where are we in the "AI Hype Cycle" and is this the first? Speaking of hype: An AI system resorted to blackmail? Why are we so quick to imbue AI with awareness? ChatGPT's latest o3 model ignored the order to shutdown. Copilot may not be making Windows core code any better. Venice.AI is an unfiltered and unrestrained LLM Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit threatlocker.com for Security Now canary.tools/twit - use code: TWIT hoxhunt.com/securitynow 1password.com/securitynow

The ASX 200 limped along to close down 11 points at 8397 as a Japanese bond auction underwhelmed, and CPI came in a little hotter than expected. Blame eggs. Banks went a little squishy, with CBA falling 0.9% and the Big Bank Basket down to $271.48 (-0.9%). Insurers also fell with QBE off 1.6%. Other financials were mixed, XYZ rose 4.9% on better US consumer sentiment and bitcoin. REITs are better today, GMG is up 0.9%, and SCG is rising, Industrials started well but fizzled, WES is down 0.1%, and retail is falling slightly. Tech was better following US tech, and the All-Tech Index was up 1.3% with WTC up 0.4%. REA bounced 1.9% after its fall yesterday on ACCC News, and TLS slid 0.2% on some broker downgrades. Resources are under a little pressure, RIO off 0.9% and lithium stocks down, MIN downgraded guidance again, down 5.5% with gold miners a little mixed, NST off 0.8% and RMS up 1.1%. MAC rose 20.4% as it got the Harmony bid, uranium was a little mixed, BOE was off %, and LOT was up 5.1%. WDS jumped 3.2% on NW Shelf news, and finally, STO is up 1.9%. Coal stocks also rallied, WHC up 2.7%. In corporate news, WEB jumped 12.4% on much better than expected results, ALQ fell 7.6% after completing its capital raise, IFT disappointed, and FPH fell 4.8% despite a 43% jump in revenues. On the economic front, CPI was unchanged at 2.4%, the RBNZ cut rates again by 25bps. 10-year yields rose to 4.33%. Asian markets, as usual, mixed, Japan up 0.3%, China up 0.1% and HK down 0.8%Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

US equities declined overnight with all three major benchmarks in the red. The Dow Jones declined 0.58%, the S&P500 down 0.56%, while the Nasdaq dropped 0.51%. S&P500 futures are on the rise after Nvidia posted earnings that beat expectations, its price advancing more than 4% in after-hours trading, so this may mean good news for tech investors today. Keep watch of ASX- listed AI stocks such as WiseTech (ASX:WTC), Xero (ASX:XRO) or NextDC (ASX:NXT).European markets were also in the red, with the STOXX 600 closing 0.61% lower.Locally yesterday, the ASX200 declined 0.13%. Financial and materials took the biggest hit, while energy and real estate were in the lead, following a rise in the consumer price index for April, which was held at 2.4% YoY. The market consensus was for it to slow to 2.3%. The RBA is looking at the data closely to ensure inflation, which is now back in the Central Bank's target band, keeps tracking in the right direction.What to watch today:The Australian share market is set to open higher, with the SPI futures suggesting a 0.15% rise at the open this morning.In commodities,Crude oil has advanced 1.43%, currently trading at US$61.94 per barrel, as investors await an OPEC+ meeting expected to decide on increasing oil output. They'll likely approve a 411,000 barrel per day production hike for July, continuing a trend of accelerating supply growth following a similar increase planned for June.The price of gold is down 0.73%, trading at US$3,284.88 an ounce following the Fed's meeting minutes revealing concerns around inflation and labour market weakness.While iron ore is trading steady at US$99.39 per tonne.Trading ideas:Bell Potter see Telstra (ASX:TLS) shares as fully valued. They have maintained a Hold trading on TLS with an improved 12- month price target of $4.65, up 7%.And Trading Central have identified a bullish signal in Whitehaven Coal (ASX:WHC) indicating that the stock price may rise from the close of $5.68 to the range of $6.90 to $7.90 over 50 days, according to the standard principles of technical analysis.

The ASX 200 finished up 47 points to 8408 (0.6%) ahead of US and UK reopening tonight. The banks led the market higher after a lacklustre session earlier, CBA up 0.8% and ANZ rising 1.4% with the Big Bank Basket up to $273.93 (+1.0%). MQG kicked 1.4% with other financials doing well too, NWL up 1.4% and CGF up 1.1%. REITs are flat, GMG is down 0.5%, with industrials doing better, and BXB is up 3.0% with ALL up 1.9%. TLS rallied another 0.4% on its investor day comments; Retail also improved, JBH was up 1.0%, and LOV was up 4.2%. Tech is better, WTC is continuing to push ahead after its large acquisition, XRO is up 1.5%, and the All-Tech Index is up 0.5%. In resources, iron ore stocks cheered up, BHP up 0.2% and RIO unchanged after earlier bigger falls.  Gold miners eased back, EVN down 3.1% with VAU off 2.2% and GMD down 0.2%. LYC fell 2.5% with PLS off again. Uranium stocks took a break, shorts licking their wounds, Oil and gas flat, coal slightly better. In corporate news, REA fell 3.5% on ACCC inquiry, VUL down 0.5% as it commenced drilling. On the economic front, Chinese Industrial profits climbed 3% last month from a year earlier, beating forecasts of 2.6%. Asian markets mixed again, with Japan up 0.4%, China down 0.5%, and HK up 0.3%. 10-year yields falling to 4.31%. Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

The ASX 200 limped 12 points higher to 8361 (+0.2%) ahead of a long weekend in the US. For the week, we are up 17 points. Banks once again firm, CBA up another 0.7% with the Big Bank Basket up to $271.95 (+0.6%). ANZ outperforming. Insurers rose slightly, and financial services better, with XYZ up 5.5% and GQG bouncing 2.4%. REITs were firm, GMG up 2.2% and SGP rising 0.2% as 10-year yields steadied to 4.45%. Healthcare is flat, tech stocks are slightly better, XRO is up 0.7%, and the Index is up 0.9%. ‘Old Skool' platforms are doing ok, REA up 0.5% and CAR up 1.3%. TLS continues to push ahead. Retail better, JBH up 1.6% and MYR up 5.4% following a sales update. Utilities are under a little pressure on an ORG downgrade, off 1.1%. Resources were mainly weaker; iron ore stocks eased back, FMG was down 2.4%, with gold miners drifting slightly lower. Uranium stocks are on fire as Reuters reported that Trump will sign an order to benefit the uranium and nuclear industry. BOE up 12.1%, PDN up 6.7% and SLX up a huge 15.3%. Oil and gas are moving a smidge higher.In corporate news, BEN results out this morning, up 0.8%, and NUF continued to fall as one broker lost faith in the stock. Nothing locally on the economic front, Japanese CPI picked up more than anticipated, 3.5% excluding fresh food. Asian markets firmed, Japan up 0.6%, and HK up 0.3%. Dow futures flat, Nasdaq futures down 0.3%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

The ASX 200 rallied another 44 points to 8387 (+0.5%). Off its highs but still looking ok. Once again, the banks led us up, CBA hitting a record high, up 1.5%, with the Big Bank Basket up to $273.04 (+1.2%). MQG is up 1.0% with insurers flat. 10-year yields at 4.48%. Other financials eased, and REITs drifted slightly higher. Industrials mixed, TLS continuing higher up 0.6% and ALL down 1.5% with retail taking a break. Tech stocks saw selling in WTC and XRO, but TNE was up 5.9% again as retail eased back. Healthcare stocks resumed the uptrend, with RMD bouncing back 4.0% and FPH up 3.1%, too. In resources, BHP and RIO rose, but FMG drifted 0.1% lower. Gold miners were better, bullion and geo-political risks helping here, NEM up 3.6% and NST rallying 3.2%, with PRU doing very well, up 9.7%. Lithium stocks slipped lower, and oil and gas stocks were pushed higher on rumours that Israel would attack Iranian nuclear facilities. Uranium stocks are rallying slightly.In corporate news, JHX fell 6.2% on disappointing numbers, and MYX dropped 29.8% as the bidder is trying to wriggle out of the deal with private equity. NUF collapsed 30.1% after downgrading guidance. CAT jumped 13.7% on a 19% increase in revenues. Gold and silver are pushing ahead again in Asian trade. On the economic front, Commonwealth Bank expects the Reserve Bank to cut interest rates earlier than expected. Asian markets saw Japan fall 0.2% with HK up 0.4% and China up 0.1%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

In deze aflevering spreken Ronald Kers (CNCF Ambassador) en Jan Stomphorst (Solutions Architect bij ACC ICT) met Jens Kat, Dev Engineer & Product Owner bij ING. Al acht jaar werkt Jens aan de interne service mesh van ING – een essentieel platform dat inmiddels zo'n 10.000 workloads ondersteunt.We duiken in de evolutie van deze mesh: van eigen tooling op virtuele machines tot aan een sidecar-gebaseerde mesh die naadloos integreert met Kubernetes. Jens legt uit waarom ING vanaf het begin TLS en mutual TLS heeft toegepast, en waarom ze kozen voor een eigen oplossing in plaats van Istio of Linkerd. Ook gaat het gesprek over developer onboarding, community building binnen een grote organisatie, en hoe data uit productie wordt gebruikt om features te verbeteren of juist af te bouwen.Een aflevering vol praktische lessen over schaalbaarheid, security, en het behouden van controle in een complexe microservices-wereld.Stuur ons een bericht.Support the showLike and subscribe! It helps out a lot.You can also find us on:De Nederlandse Kubernetes Podcast - YouTubeNederlandse Kubernetes Podcast (@k8spodcast.nl) | TikTokDe Nederlandse Kubernetes PodcastWhere can you meet us:EventsThis Podcast is powered by:ACC ICT - IT-Continuïteit voor Bedrijfskritische Applicaties | ACC ICT

 ASX 200 rallies 48 points to 8343 (0.6%), regaining yesterday's loss as the RBA cuts rates by 25bps, as expected. Banks better, led by NAB up 1% with the Big Bank Basket up to $269.90 (+0.7%). MQG rallied 2.0% with other financials better, too, ZIP up 3.1% and PNI up 1.7%. Insurers firmed, and REITS pushed higher as rates fell. 10-year yields fell to 4.44%. Industrials are also doing well, with WES up 0.8% and TLS rising 2.2% as it pushed up phone plans. SGH is up 1.4%, and retail is doing better as rates fall. JBH is up 1.3% with TPW rising 2.9% and travel stocks also in demand, CTD up 1.9% and FLT up 1.5%. KGN fell on disappointing results, off 8.9%. Tech stocks rose, with TNE the standout, up 11.3%, beating expectations and hitting new records.  The All-Tech Index is up %. Resources mixed, iron ore miners gave up early gains, and gold miners too started well but wilted with NST down 1.4% and NEM off 11.4%. Coal stocks are flat, oil and gas mixed, and uranium slightly weaker. In corporate news, OFX crashed 34.6% after a huge run yesterday and a trading halt. On the economic front, the RBA cut rates to 3.85% lowest in two years. China eased rates back too. Asian markets were positive with CATL listing in HK today. European futures pointing to a solid opening. Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

Send us a textCybersecurity professionals need a solid understanding of secure communication protocols, not just for exam success but for real-world implementation. This episode unpacks the essential protocols covered in CISSP Domain 4.1.3, providing clear explanations of how each works and when to use them.We begin with a timely discussion of the recent UnitedHealthcare hack, examining how ransomware crippled Change Healthcare systems nationwide. This case study highlights the critical importance of understanding security protocols and being able to articulate potential business impacts to leadership. Sean shares practical approaches for estimating downtime costs to help justify security investments.The heart of this episode explores crucial security protocols including IPsec tunnels, Kerberos authentication, Secure Shell (SSH), and the Signal protocol. Each section covers how these technologies function, their ideal use cases, and their respective strengths and limitations. The discussion extends to transport layer security (TLS), layer 2 tunneling protocol (L2TP), and lesser-known protocols like secure real-time transport protocol (SRTP) and Zimmerman real-time transport protocol (ZRTP).Sean breaks down complex technical concepts into accessible explanations, perfect for both CISSP candidates and practicing security professionals. Understanding these protocols isn't just about passing an exam—it's about making informed decisions when implementing security architecture in your organization. Whether you're preparing for certification or looking to strengthen your organization's security posture, this episode provides valuable insights into the fundamental building blocks of secure communications.Check out cisspcybertraining.com for free resources including practice questions, training videos, and blog posts to support your cybersecurity learning journey.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

We first became aware of the story at the heart of this episode over three years ago. Details were scarce at the time, but we knew that heat casualties had been a major issue for units at Defener Pacific... except for one company that was completely unaffected. And as it turned out, that company had been doing afternoon physical training to deliberately prepare for the heat (plus leveraging H2F experts to optimize the training). Our guest for this episode was the commander of that company at the time, and he provides a ton of insight into how good training management left his company with zero heat casualties while the battalion experienced 45. MAJ Christian Wardynski is an Instructor of Economics in the Department of Social Sciences at the United States Military Academy at West Point, which he also graduated from in 2014. After graduating Engineer BOLC, Chris served in the 54th BEB, 173rd IBCT in Vicenza, Italy as a Light Equipment PL, Sapper PL, and BN Air Officer. Most recently, he served as the Company Commander for Bravo Company, 37th Engineer Battalion, 82nd Airborne Division at Fort Bragg, NC. Chris holds a Bachelor of Science in Economics from West Point, a Master of Science in Engineering Management from the Missouri University of Science and Technology, and a Master of Public Policy from the University of Chicago where he also served as a fellow at the Pearson Institute. Chris and his wife, Jackie, have four daughters.He also provided a bunch of clarifying notes that we'll share here:He said the DoD vs. VA alignment is a Principal-Agent Problem, but as he described it, it would probably fit the definition of a negative externality better - the DoD's decisions to "overuse"/ or under-rehabilitate soldiers impose uncompensated long-term healthcare costs on the VA (and thus the taxpayer); same for the current commander not considering the cost savings of proper rehabilitation/physical resiliency of soldiers for the next commander. Regardless, both principal-agent issue and externality issue apply. You can tell by this correction that he's a true econ instructor...For additional context on the heat acclimation they started in May 2021, they had Company STX the second week of June and he initially started reverse cycle PT to see if it'd help soldiers with performance during the STX event. They executed 9x ESB-style lanes focused on individual soldier and engineer tasks, and covered over 30 miles under load in 24 hours. As a bit of risk management for the event, he mandated that all soldiers had to eat at least the main meal of the MRE and a side, or three sides total if not eating the main meal, as well as the entire salt/electrolyte packet every four hours during the event. If they found any soldier who ate less than the required amount, it would result in a summarized article 15 (if there were no extenuating circumstances). It was on the TLs to decide if they needed to eat more frequently and if they wanted to eat on the move or not. Team leaders led their own teams movement through all the lanes and to each station. This provided a great opportunity for them to exercise some initiative and leadership. Surprisingly, zero heat casualties during this crucible event for the ~80 soldiers that completed it, despite a peak ~95 degree heat index in that timeframe. Regarding Defender Pacific, when he arrived to his company assembly area after the jump, his soldiers looked utterly unphased and appeared completely fresh. The BN TF, however, had about 45 heat casualties by that time. After the BN TF mission was complete, they had a 7 mi ruck to the training area where they'd rest overnight, and his soldiers handled the movement without any issue whatsoever. He did note that they did not have a very hard follow on mission, whereas most other companies in the BN TF had some pretty physically arduous movements/follow-on missions.

In this episode, Michael, Sarah, and Mark talk to Craig Nelson, VP of the Microsoft Red Team about how the Red Team works to help secure Microsoft and its customers.In life, there are things you know you know, things you know you don't know, and finally, things you don't know you don't know. This episode is full of the latter.We also cover security news about LLMs and MCP, TLS 1.1 and 1.0 deprecation, Private End Point Improvements, Containers and more.https://aka.ms/azsecpod

Benjamin Markovits grew up mostly in Texas. He left an unpromising career as a professional basketball player to study the Romantics – an experience he wrote about in Playing Days, a novel. Since then he has taught high school English, worked at a left-wing cultural magazine, and written essays, stories and reviews for, among other publications, The New York Times, Granta, The Guardian, The London Review of Books and The Paris Review.He has published seven novels, including Either Side of Winter, about a New York private school, and a trilogy on the life of Lord Byron: Imposture, A Quiet Adjustment and Childish Loves. In 2009 he won a Pushcart Prize for his short story Another Sad, Bizarre Chapter in Human History. Granta selected him as one of the Best of Young British Novelists in 2013. Markovits lives in London and is married, with a daughter and a son. He teaches Creative Writing at Royal Holloway, University of London.His latest novel, The Rest of Our Lives, has been praised by Sarah Hall, Clare Chambers, Lucy Caldwell, The Guardian, the Observer, TLS and many more. Get the book here or at your local bookshop. What's left when your kids grow up and leave home? When Tom Layward's wife had an affair he resolved to leave her as soon as his youngest daughter turned eighteen. Twelve years later, while driving her to Pittsburgh to start university, he remembers his pact.He is also on the run from his own health issues, and the fact that he's been put on leave at work after students complained about the politics of his law class – something he hasn't yet told his wife.So, after dropping Miriam off, he keeps driving, with the vague plan of visiting various people from his past – an old college friend, his ex-girlfriend, his brother, his son – on route, maybe, to his father's grave in California.

Post-quantum cryptography is rapidly moving from the realm of NIST standards to running in production. The threat of quantum computing advances and coming regulations are driving this acceleration. One major component on the PQC migration plan for companies is VPN. In this episode we look at the Ambit corporate VPN client, which uses a standardized NIST PQC cipher: ML-KEM. Did you know there are potential gotchas with trying hybrids of classical and PQC instead? Find out the technical and philosophical reasons why the developers chose to skip offering a hybrid option. Join host Konstantinos Karagiannis for a wide-ranging chat with Kevin Kane and Andrew McElroy from American Binary.  For more information on American Binary, visit https://www.ambit.inc/.  Visit Protiviti at https://www.protiviti.com/US-en/technology-consulting/quantum-computing-services  to learn more about how Protiviti is helping organizations get post-quantum ready.  Follow host Konstantinos Karagiannis on all socials: @KonstantHacker and follow Protiviti Technology on LinkedIn and Twitter: @ProtivitiTech.               Questions and comments are welcome!  Theme song by David Schwartz, copyright 2021.  The views expressed by the participants of this program are their own and do not represent the views of, nor are they endorsed by, Protiviti Inc., The Post-Quantum World, or their respective officers, directors, employees, agents, representatives, shareholders, or subsidiaries.  None of the content should be considered investment advice, as an offer or solicitation of an offer to buy or sell, or as an endorsement of any company, security, fund, or other securities or non-securities offering. Thanks for listening to this podcast. Protiviti Inc. is an equal opportunity employer, including minorities, females, people with disabilities, and veterans.

The ASX 200 rose 36 points to 8269 (0.4%). 11-week high. Disappointing in some respects as defensive stocks saw sellers move to more leverage assets. Banks slipped with ANZ Ex-dividend, the Big Bank Basket down to $261.90 (-0.5%). MQG pushed another 3.7% ahead, with other financials doing well. HMC is up 3.7%, and RPL is rallying 5.7%. ZIP was the standout, up 8.8%, with XYZ bouncing 5.9%. REITs sold off as rates moved higher, 10-year yields up to 4.43%. Defensive industrials fell, COL and WOW went down hard, TCL fell 2.2%, and TLS dropped 2.6%. Tech did well but off highs. WTC is up 4.9% and XRO modestly higher, up 1.7%, with the All-Tech Index up 3.1%. In resources, iron ore drifted back a little, BHP up 2.1% and FMG up 2.7% with base metal stocks also in demand, MIN up 9.8% and LTR up another 3.5%. S32 had a great day up 5.6%. Gold miners were sold off on bullion weakness. NST was down 4.6%, with NEM down only 1.8% as EVN fell 5.3%. LYC dropped 3.8%on rare earth supply from China resuming. Oil and gas stocks are better, WDS up 3.7%, and STO rallying another 2.9%. Uranium stocks paused. Coal was a happy place, WHC up 3.2%. In corporate news, RIC successfully raised $125m to buy DNL's fertilizer distribution business. PNV is doing well on diabetes trials, and ALD rose 2.2% as it sold an NZ business. ASK rejected a takeover offer from Ki. On the economic front, consumer sentiment lifted on election results. Asian markets mixed, Japan up 1.7% with China flat and HK sliding back 1.5%.Want to invest with Marcus Today? The Managed Strategy Portfolio is designed for investors seeking exposure to our strategy while we do the hard work for you. If you're looking for personal financial advice, our friends at Clime Investment Management can help. Their team of licensed advisers operates across most states, offering tailored financial planning services.  Why not sign up for a free trial? Gain access to expert insights, research, and analysis to become a better investor.

Guest Dirkjan Ochtman Panelist Richard Littauer Show Notes In this special Maintainer Month episode of Sustain, host Richard speaks with Dirkjan Ochtman, a long-time open source contributor and Rust advocate. They dive deep into what it's like maintaining critical infrastructure libraries, the motivations behind taking over "abandonware," and how funding ecosystems like GitHub Sponsors and thanks.dev help sustain low-level dependencies. Dirkjan also reflects on how Rust's design lends itself well to long-term maintainability and shares thoughts on the challenges of burnout, context switching, and ensuring project continuity. Hit the download button now! [00:01:33] Dirkjan explains how he chooses which projects he's maintaining, being passionate about memory safety via Rust, and maintaining tools like Rustls, Hickory DNS, and Quinn. [00:03:14] Dirkjan describes his motivation for maintaining abandonware and sees it as providing value to the community. [00:04:23] ISRG funds Dirkjan's work on memory-safe DNS and TLS libraires, and they are replacing C-based libraires with Rust equivalents. [00:05:33] Dirkjan uses thanks.dev to help fund maintainers through the full dependency graph and revenue is limited but promising. [00:08:06] Richard brings up Tidelift and Dirkjan mentions it's not yielding results for Rust projects yet because the Rust ecosystem is smaller. [00:09:30] We hear Dirkjan's journey into Rust, starting in Python but frustrated by lack of type safety and performance, and creating his own compiler before appreciating Rust's complexity. [00:12:20] Dirkjan talks about his transition from Python to Rust. [00:13:39] Dirkjan uses PyO3 to create Python bindings for Rust libraries. [00:15:31] Richard wonders why projects become unmaintained and Dirkjan responds that people have life events, job changes, or shifting interests. [00:17:11] How are unmaintained projects flagged? Dirkjan uses the RustSec Advisory DB to detect projects with no active maintainers. [00:18:47] Dirkjan avoids burnout as a maintainer by keeping the scope narrow, only responds to PRs, doesn't overcommit, and focuses on high-efficiency, low-effort maintenance. [00:19:51] Rust has a strong system, built-in unit tests, great CI support, and Dirkjan encourages atomic commits to simplify code review. [00:21:28] Dirkjan speaks about languages that are more maintainer safe. [00:22:18] Richard brings up attack vectors and the ‘left-pad incident.' Dirkjan shares how he builds trust via his public GitHub record. [00:24:17] We hear Dirkjan's offboarding and succession planning as he explains handing off projects like Askama and promoting multiple maintainers to reduce bus factor. [00:26:08] Dirkjan's long-term vision for OSS sustainability is he hopes to move higher in the stack and wants to make high-quality software easier to build. [00:27:38] Dirkjan explains why he prefers to do asynchronous collaboration over pair programming. [00:28:52] Dirkjan discusses Rust's long-term ecosystem stability. [00:31:09] Find out where you can follow Dirkjan on the web. Quotes [00:03:23] “You call it abandonware and I call it a dependency that has a million users.” [00:19:02] “[When I take on a project], I don't take on the burden of proactively improving the project.” [00:19:11] “I will be there when someone submits a PR." [00:20:37] “I ask folks to make small changes: atomic commits.” Spotlight [00:31:37] Richard's spotlight is Allan Day. [00:32:20] Dirkjan's spotlight is Xilem. Links SustainOSS (https://sustainoss.org/) podcast@sustainoss.org (mailto:podcast@sustainoss.org) richard@sustainoss.org (mailto:richard@sustainoss.org) SustainOSS Discourse (https://discourse.sustainoss.org/) SustainOSS Mastodon (https://mastodon.social/tags/sustainoss) SustainOSS Bluesky (https://bsky.app/profile/sustainoss.bsky.social) SustainOSS LinkedIn (https://www.linkedin.com/company/sustainoss/) Open Collective-SustainOSS (Contribute) (https://opencollective.com/sustainoss) Richard Littauer Socials (https://www.burntfen.com/2023-05-30/socials) Dirkjan Ochtman LinkedIn (https://www.linkedin.com/in/dochtman/?originalSubdomain=nl) Dirkjan Ochtman Blog (https://dirkjan.ochtman.nl/) Dirkjan Ochtman Mastodon (https://hachyderm.io/@djc) Dirkjan Ochtman GitHub (https://github.com/djc) Dirkjan Ochtman Bluesky (https://bsky.app/profile/djc.ochtman.nl) Rust (https://www.rust-lang.org/) Rustls (https://github.com/rustls/rustls) Hickory DNS (https://github.com/hickory-dns/hickory-dns) Quinn (https://github.com/quinn-rs/quinn) Internet Security Research Group (ISRG) (https://www.abetterinternet.org/) Let's Encrypt (https://letsencrypt.org/) Automatic Certificate Management Environment (https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) PyO3 user guide (https://pyo3.rs/v0.15.1/) Sustain Podcast-Episode 108: Sarah Gran and Josh Aas: Sustainable Digital Infrastructure with Memory Safe Code (https://podcast.sustainoss.org/108) Sustain Podcast-Episode 148: Ali Nehzat of thanks.dev and OSS Funding (https://podcast.sustainoss.org/148) Tidelift (https://tidelift.com/) RustSec Advisory Database-GitHub (https://github.com/RustSec/advisory-db) Askama (https://docs.rs/askama/latest/askama/) Allan Day's GNOME Blog (https://blogs.gnome.org/aday/) Xilem (https://xilem.dev/) Credits Produced by Richard Littauer (https://www.burntfen.com/) Edited by Paul M. Bahr at Peachtree Sound (https://www.peachtreesound.com/) Show notes by DeAnn Bahr Peachtree Sound (https://www.peachtreesound.com/) Special Guest: Dirkjan Ochtman.

Eley Williams' collection of short stories Attrib. & Other Stories won the Republic of Consciousness Prize and the James Tait Black Memorial Prize. Her writing appears in The Penguin Book of the Contemporary British Short Story, Liberating the Canon, the TLS and the London Review of Books. She is a Fellow of the Royal Society of Literature. She is the author of the novel The Liar's Dictionary and on this episode of Little Atoms she talks to Neil Denny about her latest story collection Moderate to Poor, Occasionally Good, which is out now in paperback. Hosted on Acast. See acast.com/privacy for more information.

* Banks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminals* 'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attacks* WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Features* Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilities* Security Concerns Grow Over Electric Vehicles as Potential Surveillance PlatformsBanks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminalshttps://www.abc.net.au/news/2025-05-01/bank-employee-data-stolen-with-malware-and-sold-online/105232872Cyber criminals have stolen almost 100 staff logins from Australia's "Big Four" banks, potentially exposing these financial institutions to serious cyber threats including data theft and ransomware attacks, according to recent findings from cyber intelligence firm Hudson Rock.The compromised credentials belong to current and former employees and contractors at ANZ, Commonwealth Bank, NAB, and Westpac, with ANZ and Commonwealth Bank experiencing the highest number of breaches. All stolen credentials included corporate email addresses with access to official bank domains."There are around 100 compromised employees that are related to those four banks," said Hudson Rock analyst Leonid Rozenberg. While this number is significantly smaller than the 31,000 customer banking passwords recently reported stolen, the security implications could be more severe."Technically, [attackers] need only one [login] to do a lot of damage," Rozenberg warned.The credentials were stolen between 2021 and April 2025 using specialized "infostealer" malware designed to harvest sensitive data from infected devices. These stolen credentials have subsequently appeared on Telegram and dark web marketplaces.Security experts explain that these breaches could potentially give hackers "initial access" to the banks' corporate networks. While banks employ additional security measures such as Multi-Factor Authentication (MFA), specialized cybercriminals known as "initial access brokers" focus on finding ways around these protections, often targeting employees working from home.The investigation also uncovered a concerning number of compromised third-party service credentials connected to these banks, with ANZ having more than 100 such breaches and NAB more than 70. These compromised services could include critical communication and project management tools like Slack, JIRA, and Salesforce.All four banks have responded by stating they have multiple safeguards in place to prevent unauthorized access. NAB reports actively scanning cybercrime forums to monitor threats, while CommBank noted investing over $800 million in cybersecurity and financial crime prevention last financial year.The Australian Signals Directorate has already warned that infostealer infections have led to successful attacks on Australian businesses, highlighting that this threat extends beyond the banking sector to organizations across all industries.'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attackshttps://www.oligo.security/blog/airborneSecurity researchers at Oligo Security have uncovered a serious set of vulnerabilities in Apple's AirPlay protocol and software development kit (SDK) that could allow attackers to remotely execute code on affected devices without user interaction. These flaws, collectively dubbed "AirBorne," affect millions of Apple and third-party devices worldwide.The security team discovered 23 distinct vulnerabilities that enable various attack vectors, including zero-click and one-click remote code execution, man-in-the-middle attacks, denial of service attacks, and unauthorized access to sensitive information. Perhaps most concerning are two specific flaws (CVE-2025-24252 and CVE-2025-24132) that researchers demonstrated could create "wormable" zero-click attacks, potentially spreading from device to device across networks.Another critical vulnerability (CVE-2025-24206) enables attackers to bypass the "Accept" prompt normally required for AirPlay connections, creating a pathway for truly zero-interaction compromises when combined with other flaws."This means that an attacker can take over certain AirPlay-enabled devices and do things like deploy malware that spreads to devices on any local network the infected device connects to," warned Oligo. "This could lead to the delivery of other sophisticated attacks related to espionage, ransomware, supply-chain attacks, and more."While exploitation is limited to attackers on the same network as vulnerable devices, the potential impact is extensive. Apple reports over 2.35 billion active devices worldwide, and Oligo estimates tens of millions of additional third-party AirPlay-compatible products like speakers, TVs, and car infotainment systems could be affected.Apple released security updates on March 31 to address these vulnerabilities across their product line, including patches for iOS 18.4, iPadOS 18.4, macOS versions (Ventura 13.7.5, Sonoma 14.7.5, and Sequoia 15.4), and visionOS 2.4 for Apple Vision Pro. The company also updated the AirPlay audio and video SDKs and the CarPlay Communication Plug-in.Security experts strongly advise all users to immediately update their Apple devices and any third-party AirPlay-enabled products. Additional protective measures include disabling AirPlay receivers when not in use, restricting AirPlay access to trusted devices via firewall rules, and limiting AirPlay permissions to the current user only.WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Featureshttps://engineering.fb.com/2025/04/29/security/whatsapp-private-processing-ai-tools/Meta's WhatsApp has announced a new privacy-focused technology called 'Private Processing' that will allow users to access advanced artificial intelligence features while maintaining data security. The system is designed to enable AI functionalities like message summarization and writing suggestions that are too computationally intensive to run directly on users' devices.The new feature, which will be rolled out gradually over the coming weeks, will be entirely opt-in and disabled by default, giving users complete control over when their data leaves their device for AI processing.Private Processing employs several layers of security to protect user privacy. When activated, the system first performs anonymous authentication through the user's WhatsApp client. It then retrieves public encryption keys from a third-party content delivery network (CDN), ensuring Meta cannot trace requests back to specific individuals.To further enhance privacy, users' devices connect to Meta's gateway through a third-party relay that masks their real IP addresses. The connection establishes a secure session between the user's device and Meta's Trusted Execution Environment (TEE), using remote attestation and TLS protocols.All requests for AI processing use end-to-end encryption with ephemeral keys, and the processing occurs inside a Confidential Virtual Machine (CVM) that remains isolated from Meta's main systems. According to Meta, the processing environment is stateless, with all messages deleted after processing, retaining only "non-sensitive" logs."The AI-generated response is encrypted with a unique key only known to the device and processing CVM and is sent back over the secure session for decryption on the user's device," the company explained.To build trust in the system, WhatsApp has promised to share the CVM binary and portions of the source code for external validation. The company also plans to publish a detailed white paper explaining the secure design principles behind Private Processing.Despite these security measures, privacy experts note that sending sensitive data to cloud servers always carries some inherent risk, even with robust encryption in place. Users concerned about data privacy can either keep the feature disabled or utilize WhatsApp's recently launched 'Advanced Chat Privacy' feature, which provides more granular control over when data can leave the device.Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilitieshttps://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/the-risk-of-default-configuration-how-out-of-the-box-helm-charts-can-breach-your/4409560Microsoft security researchers have issued an urgent warning about significant security risks posed by default configurations in Kubernetes deployments, particularly when using out-of-the-box Helm charts. These configurations can inadvertently expose sensitive data to the public internet without proper authentication protections.According to a new report from Michael Katchinskiy and Yossi Weizman of Microsoft Defender for Cloud Research, many popular Helm charts lack basic security measures, often leaving exploitable ports open and implementing weak or hardcoded passwords that are easy to compromise."Default configurations that lack proper security controls create a severe security threat," the Microsoft researchers warn. "Without carefully reviewing the YAML manifests and Helm charts, organizations may unknowingly deploy services lacking any form of protection, leaving them fully exposed to attackers."Kubernetes has become a widely adopted open-source platform for automating containerized application deployment and management, with Helm serving as its package manager. Helm charts function as templates or blueprints that define resources needed to run applications through YAML files. While these charts offer convenience by simplifying complex deployments, their default settings often prioritize ease of use over security.The report highlights three specific examples demonstrating this widespread issue. Apache Pinot's Helm chart exposes core services through Kubernetes LoadBalancer services with no authentication requirements. Meshery allows public sign-up from exposed IP addresses, potentially giving anyone registration access to cluster operations. Meanwhile, Selenium Grid exposes services across all nodes in a cluster through NodePort, relying solely on external firewall rules for protection.The Selenium Grid vulnerability is particularly concerning as cybersecurity firms including Wiz have already observed attacks targeting misconfigured instances to deploy XMRig miners for cryptocurrency mining.Organizations using Kubernetes are advised to implement several key mitigation strategies. Microsoft recommends thoroughly reviewing default configurations of Helm charts before deployment, ensuring they include proper authentication mechanisms and network isolation. Regular scans for misconfigurations that might publicly expose workload interfaces are crucial, as is continuous monitoring of containers for suspicious activity.The findings underscore a critical tension in cloud deployment between convenience and security, with many users — particularly those inexperienced with cloud security — inadvertently creating vulnerabilities by deploying charts without customizing their security settings.Security Concerns Grow Over Electric Vehicles as Potential Surveillance Platformshttps://www.theguardian.com/environment/2025/apr/29/source-of-data-are-electric-cars-vulnerable-to-cyber-spies-and-hackersCybersecurity experts are raising alarms about the potential for electric vehicles to be exploited as surveillance tools, particularly those manufactured in China, according to recent reports from the UK.British defense firms working with the UK government have reportedly warned staff against connecting their phones to Chinese-made electric cars due to concerns that Beijing could extract sensitive information from their devices. The warning highlights growing security considerations around the increasingly sophisticated technology embedded in modern electric vehicles.Security specialists interviewed by The Guardian note that electric vehicles are equipped with multiple data collection points, including microphones, cameras, and wireless connectivity features that could potentially be leveraged by malicious actors or hostile states."There are lots of opportunities to collect data and therefore lots of opportunities to compromise a vehicle like that," explains Rafe Pilling, director of threat intelligence at cybersecurity firm Secureworks. He points out that over-the-air update capabilities, which allow manufacturers to remotely update a car's operating software, could potentially be used to exfiltrate data.The concerns are particularly focused on individuals in sensitive positions. "If you are an engineer who is working on a sixth-generation fighter jet and you have a work phone that you are connecting to your personal vehicle, you need to be aware that by connecting these devices you could be allowing access to data on your mobile," warns Joseph Jarnecki, a research fellow at the Royal United Services Institute.Chinese electric vehicle manufacturers such as BYD and XPeng have drawn particular scrutiny due to China's National Intelligence Law of 2017, which requires organizations and citizens to cooperate with national intelligence efforts. However, experts also note there is currently no public evidence of Chinese vehicles being used for espionage.Cybersecurity professionals suggest that concerned drivers can click "don't trust" when connecting devices to their vehicles, but this sacrifices many convenient features. They also caution against syncing personal devices with rental cars, as this can leave sensitive data in the vehicle's systems.The UK government has acknowledged the issue, with Defence Minister Lord Coaker stating they are "working with other government departments to understand and mitigate any potential threats to national security from vehicles." He emphasized that their work applies to all types of vehicles, not just those manufactured in China.While the Society of Motor Manufacturers and Traders (SMMT) maintains that all manufacturers selling cars in the UK must adhere to data privacy regulations, the growing integration of connected technologies in electric vehicles continues to raise new security considerations for both government officials and everyday consumers alike. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

In this episode, Jenna interviews Dean Coclin, senior director of Industry Strategy at DigiCert, about the recent vote by the CA/Browser Forum to shorten the lifespan of TLS certificates to 47 days by 2029. They discuss:The schedule for the changes and the gradual increments lifespans will shorten byThe rationale behind shortening certificate lifetimesHow to start preparing for changesDigiCert will be hosting a webinar on this topic on May 6 called "Unpacking Certificate Changes: Live Expert Q&A." Register here: https://digicert.registration.goldcast.io/events/2c6c723b-5725-4406-9289-6df8ddd20f93?referrer=https://www.digicert.com/&referrer=https://www.digicert.com/&referrer=https://www.digicert.com/&referrer_page=a28f9ca5-7abf-4ce2-9b6b-571e50e49239

Let's Encrypt now offers certificates with 6-day lifetimes but what does that mean for the commercial TLS trust anchor world? On this episode of Security Noise, Geoff and Skyler are joined by Principal Security Consultant Justin Bollinger to discuss new options for certificate lifetimes and the implications of the new maximum ages, good and bad. About this podcast: Security Noise, a TrustedSec Podcast hosted by Geoff Walton and Producer/Contributor Skyler Tuter, features our cybersecurity experts in conversation about the infosec topics that interest them the most. Hack the planet! Find more cybersecurity resources on our website at https://trustedsec.com/resources.

Megan Hunter is a prizewinning novelist, dramatist and screenwriter. Her first novel, The End We Start From was shortlisted for Novel of the Year at the Books Are My Bag Awards, longlisted for the Aspen Words Prize, was a Barnes and Noble Discover Awards finalist and won the Forward Reviews Editor's Choice Award. It was adapted into a major motion picture by Alice Birch, starring Jodie Comer and directed by Mahalia Belo. Her second novel, The Harpy, was Indie Book of the Month; she is currently adapting it for television with Red Planet Pictures. Her dramatic monologue Salt of the Earth premiered at Venice Film Festival. Megan's other writing has appeared in the White Review, the TLS, Literary Hub, Vogue, Elle, BOMB, and elsewhere. On this episode of Little Atoms she talks to Neil Denny about her new novel Days of Light. Hosted on Acast. See acast.com/privacy for more information.

What personal information was compromised in the Hertz breach?The breach exposed customer names, birth dates, contact info, driver's licenses, payment cards, and some Social Security numbers. It stemmed from a cyberattack on Cleo, a third-party vendor previously targeted in a mass-hacking campaign.How is air travel changing, and what are the privacy implications?ICAO aims to replace boarding passes with digital travel credentials using facial recognition and mobile passport data. While data is reportedly deleted quickly, the expansion of biometric surveillance raises major privacy and security concerns.Why is the EU giving staff burner phones for U.S. trips?To mitigate potential U.S. surveillance risks, the EU is issuing burner phones to officials visiting for IMF/World Bank meetings—echoing similar precautions for China and Ukraine. It signals growing distrust in transatlantic cybersecurity.How are North Korean hackers using LinkedIn?Groups like Lazarus use fake recruiter profiles to trick targets into opening malware-laden job materials. These campaigns steal credentials and crypto, funding North Korea's sanctioned activities and highlighting the rise of social engineering threats.Why is Let's Encrypt shortening TLS certificate lifespans?Let's Encrypt now issues 6-day certificates, down from 90. Benefits include improved security and automation; drawbacks involve more frequent renewals, which could create dependency on issuing infrastructure.What is the "Smishing Triad" targeting now?This group has moved from fake delivery texts to targeting banks via iMessage and RCS phishing. They steal banking info to load stolen cards into mobile wallets, illustrating more advanced and lucrative phishing tactics.What's the significance of China acknowledging U.S. infrastructure hacks?China's tacit admission of involvement in Volt Typhoon cyberattacks marks a shift in tone. The U.S. sees these as strategic signals, intensifying concerns about critical infrastructure security amid geopolitical tension.What is Android's new auto-reboot security feature?Android phones will now reboot automatically after three days of inactivity. This clears memory, closes apps, and requires re-authentication—reducing the risk of unauthorized access.

On this week's show Patrick Gray talks to former NSA Cybersecurity Director Rob Joyce about Donald Trump's unprecedented, unwarranted and completely bonkers political persecution of Chris Krebs and his employer SentinelOne. They also talk through the week's cybersecurity news, covering: Mitre's stewardship of the CVE database gets its funding DOGE'd The US signs on to the Pall Mall anti-spyware agreement China tries to play the nationstate cyber-attribution game, but comedically badly Hackers run their malware inside the Windows sandbox, for security against EDR This week's episode is sponsored by open source identity provider Authentik. CEO Fletcher Heisler joins to talk through the increasing sprawl of the identity ecosystem. This episode is also available on Youtube. Show notes Cybersecurity industry falls silent as Trump turns ire on SentinelOne | Reuters U.S. cyber defenders shaken by Trump's attack on their former boss Trump Revenge Tour Targets Cyber Leaders, Elections – Krebs on Security Wyden to block Trump's CISA nominee until agency releases report on telecoms' ‘negligent cybersecurity' | The Record from Recorded Future News Gabbard sets up DOGE-style team to cut costs, uncover intel ‘weaponization' MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty US to sign Pall Mall pact aimed at countering spyware abuses | The Record from Recorded Future News Court document reveals locations of WhatsApp victims targeted by NSO spyware | TechCrunch Spyware Maker NSO Group Is Paving a Path Back Into Trump's America | WIRED NCSC shares technical details of spyware targeting Uyghur, Tibetan and Taiwanese groups | The Record from Recorded Future News Risky Bulletin: Chinese APT abuses Windows Sandbox to go invisible on infected hosts China escalates cyber fight with U.S., names alleged NSA hackers Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs - Ars Technica China-based SMS Phishing Triad Pivots to Banks – Krebs on Security Risky Bulletin: CA/B Forum approves 47-days TLS certs Ransomware in het mkb: Cybercriminelen verhogen losgeld bij cyberverzekering 4chan Is Down Following What Looks to Be a Major Hack Spurred By Meme War

MITRE corporation says funding cuts will impact the CVE database, China accuses NSA employees of an Asian Winter Games hack, a ransomware attack disrupts dialysis clinics, the CA/Browser Forum will limit TLS certificate lifetime to 47 days, and 4chan gets hacked. Show notes

AI-powered code generation tools are raising significant security concerns within the software supply chain. Recent research indicates that a notable percentage of package suggestions from both commercial and open-source models are non-existent, a phenomenon referred to as "hallucination." This issue allows malicious actors to exploit these fictitious package names by uploading harmful software to package registries, a tactic known as slop-squatting. Experts emphasize the importance of manual verification and the use of dependency scanners to mitigate these risks, highlighting that developers must rigorously test AI-generated code in isolated environments before deployment.In the tech industry, Intel has made headlines by selling a 51% stake in its programmable chip business, Altera, to private equity firm Silverlake for $4.46 billion. This decision comes after Intel's acquisition of Altera for $16.7 billion in 2015, reflecting a significant drop in valuation. The move is part of a broader strategy to sharpen focus and strengthen the company's balance sheet amid ongoing challenges in the semiconductor market. Despite retaining a minority stake in Altera, Intel's actions raise questions about its ability to compete effectively in critical areas like AI-optimized silicon.Another pressing issue is the impending reduction of the maximum lifespan for SSL and TLS certificates, which will be cut to just 47 days by 2029. This change, supported by major tech companies, aims to enhance digital security by minimizing risks associated with compromised certificates. The transition will require automated and integrated certificate management solutions to keep pace with the new renewal cycles, emphasizing the need for proactive risk management in the evolving threat landscape.Lastly, the reinstatement of tariffs on electronics, including smartphones and laptops, is set to impact the tech industry significantly. The U.S. government aims to encourage domestic manufacturing, but the unpredictability of trade policies complicates planning for businesses. As companies navigate these challenges, they must adopt flexible strategies that account for ongoing volatility in the supply chain and procurement processes, ensuring they remain responsive to changing market conditions. Four things to know today 00:00 Copy, Paste, Compromise? Why AI Code Suggestions Could Lead to Big Security Problems04:45 Altera Is Out, $8.75B Is In—But Intel's Chip Future Is Still in Question06:46 Got 47 Days? Why Your SSL Certificates Just Got a Whole Lot Needier08:14 One More Time with Feeling: Tech Tariffs Are Back, and the Forecast Is Still Chaos  Supported by:  https://cometbackup.com/?utm_source=mspradio&utm_medium=podcast&utm_campaign=sponsorship https://getflexpoint.com/msp-radio/   Join Dave April 22nd to learn about Marketing in the AI Era.  Signup here:  https://hubs.la/Q03dwWqg0 All our Sponsors: https://businessof.tech/sponsors/ Do you want the show on your podcast app or the written versions of the stories? Subscribe to the Business of Tech: https://www.businessof.tech/subscribe/Looking for a link from the stories? The entire script of the show, with links to articles, are posted in each story on https://www.businessof.tech/ Support the show on Patreon: https://patreon.com/mspradio/ Want to be a guest on Business of Tech: Daily 10-Minute IT Services Insights? Send Dave Sobel a message on PodMatch, here: https://www.podmatch.com/hostdetailpreview/businessoftech Want our stuff? Cool Merch? Wear “Why Do We Care?” - Visit https://mspradio.myspreadshop.com Follow us on:LinkedIn: https://www.linkedin.com/company/28908079/YouTube: https://youtube.com/mspradio/Facebook: https://www.facebook.com/mspradionews/Instagram: https://www.instagram.com/mspradio/TikTok: https://www.tiktok.com/@businessoftechBluesky: https://bsky.app/profile/businessof.tech

Topics covered in this episode: How to Write a Git Commit Message Caddy Web Server Some new PEPs approved juv Extras Joke Watch on YouTube About the show Sponsored by Posit Connect: pythonbytes.fm/connect Connect with the hosts Michael: @mkennedy@fosstodon.org / @mkennedy.codes (bsky) Brian: @brianokken@fosstodon.org / @brianokken.bsky.social Show: @pythonbytes@fosstodon.org / @pythonbytes.fm (bsky) Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Monday at 10am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Brian #1: How to Write a Git Commit Message Chris Beams 7 rules of a great commit message Separate subject from body with a blank line Limit the subject line to 50 characters Capitalize the subject line Do not end the subject line with a period Use the imperative mood in the subject line Wrap the body at 72 characters Use the body to explain what and why vs. how Article also includes Why a good commit message matters Discussion about each of the 7 rules Cool hat tips to other articles on the subject “Keep in mind: This has all been said before.” Each word is a different link. Michael #2: Caddy Web Server via Fredrik Mellström Like a more modern NGINX Caddy automatically obtains and renews TLS certificates for all your sites. Caddy's native configuration is a JSON document. Even localhost and internal IPs are served with TLS using the intermediate of a fully-automated, self-managed CA that is automatically installed into most local trust stores. Configure multiple Caddy instances with the same storage, and they will automatically coordinate certificate management as a fleet. Production-grade static file server. Brian #3: Some new PEPs approved PEP 770 – Improving measurability of Python packages with Software Bill-of-Materials Accepted for packaging Author: Seth Larson, Sponsor Brett Cannon “This PEP proposes using SBOM documents included in Python packages as a means to improve automated software measurability for Python packages.” PEP 750 – Template Strings Accepted for Python 3.14 Author: Jim Baker, Guido van Rossum, Paul Everitt, Kaudai Aono, Lysandros Nikolaou, Dave Peck “Templates provide developers with access to the string and its interpolated values before they are combined. This brings native flexible string processing to the Python language and enables safety checks, web templating, domain-specific languages, and more.” Michael #4: juv A toolkit for reproducible Jupyter notebooks, powered by uv. Create, manage, and run Jupyter notebooks with their dependencies Pin dependencies with PEP 723 - inline script metadata Launch ephemeral sessions for multiple front ends (e.g., JupyterLab, Notebook, NbClassic) Powered by uv for fast dependency management Use uvx to run jupyterlab with ephemeral virtual environments and tracked dependencies. Extras Brian: Status of Python versions new-ish format Use this all the time. Can't remember if we've covered the new format yet. See also Python endoflife.date Same dates, very visible encouragement to move on to Python 3.13 if you haven't already. Michael: Python 3.13.3 is out. .git-blame-ignore-revs follow up Joke: BGPT (thanks Doug Farrell)

What if managing databases on Kubernetes didn't require a team of specialists or endless configuration? In this episode of Tech Talks Daily, I sit down with Tamal Saha, founder and CEO of AppsCode, to explore how his team is building a more intuitive, scalable, and enterprise-ready approach to Kubernetes-native data management. Recorded during the IT Press Tour in London, this conversation traces Tamal's journey from Bangladesh to Google, and ultimately to launching AppsCode in 2016. He shares how early experiences with Google's internal systems helped shape his vision for a cloud-native data platform built for modern application environments. What began as an open-source passion project has evolved into a comprehensive enterprise suite that includes solutions like KubeDB, Stash, Voyager, and KubeVault. We discuss the operational realities of managing databases in Kubernetes—from simplifying provisioning and backups to solving problems around TLS management, multi-tenancy, and even secret rotation. Tamal outlines the benefits of a Kubernetes-native architecture for platform engineers, DevOps teams, and developers who want to deploy faster, automate more, and keep full control over their environments. With real-world insights from enterprise deployments, including large-scale telcos modernizing their infrastructure, Tamal explains how AppsCode is helping organizations move from ticket-based database provisioning to true self-service. He also looks ahead to what's coming next, including support for vector databases, AI-powered provisioning interfaces, and deeper integrations with open telemetry and observability tools. Whether you're running stateful workloads in Kubernetes today or exploring how to modernize your data layer, this episode is packed with insight into building platforms that work with developers, not against them. So, is it time to rethink your approach to data in the cloud-native era? Let me know what you think.

Apache Camel Exploit Attempt by Vulnerability Scans A recently patched vulnerability in Apache Camel has been integrated into some vulnerability scanners, like for example OpenVAS. We do see some exploit attempts in our honeypots, but they appear to be part of internal vulnerablity scans https://isc.sans.edu/diary/Apache%20Camel%20Exploit%20Attempt%20by%20Vulnerability%20Scan%20%28CVE-2025-27636%2C%20CVE-2025-29891%29/31814 New Security Requirements for Certificate Authorities Starting in July, certificate authorities need to verify domain ownership data from multiple viewpoints around the internet. They will also have to use linters to verify certificate requests. https://security.googleblog.com/2025/03/new-security-requirements-adopted-by.html Possible Oracle Breach Oracle still denies being the victim of a data berach as leaked data may show different. https://doublepulsar.com/oracle-attempt-to-hide-serious-cybersecurity-incident-from-customers-in-oracle-saas-service-9231c8daff4a https://www.theregister.com/2025/03/30/infosec_news_in_brief/ https://www.darkreading.com/cyberattacks-data-breaches/oracle-still-denies-breach-researchers-persist

Dr. Dave Chatterjee and David Close discuss the implications of post-quantum cryptography (PQC) on cybersecurity readiness. David, a Chief Solutions Architect at Futurex, explains the evolution of cryptographic methods to counter quantum computing threats. He highlights the importance of NIST's role in standardizing quantum-resistant algorithms like Kyber and Dilithium. David shares practical examples, such as Google and Cloudflare's hybrid TLS implementation and a financial institution's use of PQC for data storage. They emphasize the need for organizations to develop roadmaps, inventory cryptographic assets, and ensure vendor readiness. Dr. Chatterjee stresses the importance of a proactive, holistic approach to cybersecurity governance.To access and download the entire podcast summary with discussion highlights -- https://www.dchatte.com/episode-83-future-proofing-your-data-preparing-for-the-post-quantum-era/Latest Articles and Press Releases on The Cybersecurity Readiness Podcast Series:Dr. Dave Chatterjee Hosts Global Podcast Series on Cyber Readiness, Yahoo!Finance, Dec 16, 2024Dr. Dave Chatterjee Hosts Global Podcast Series on Cyber Readiness, Marketers Media, Dec 12, 2024.Cybersecurity Readiness Podcast by Dr. Dave Chatterjee Reaches 10,000 Downloads Globally, Business Insider/Markets Insider, Dec 10, 2024.Connect with Host Dr. Dave Chatterjee and Subscribe to the PodcastPlease subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes are released every two weeks. Connect with Dr. Chatterjee on these platforms: LinkedIn: https://www.linkedin.com/in/dchatte/ Website: https://dchatte.com/Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338https://us.sagepub.com/en-us/nam/cybersecurity-readiness/book275712Latest Publications & Press Releases:“Meet Dr. Dave Chatterjee, the mind behind the CommitmentPreparedness-Discipline method for cybersecurity,” Chicago Tribune, February 24, 2025.“Dr. Dave Chatterjee...

Episode SummaryIn this episode of The Secure Developer, Danny Allan sits down with Mrinal Wadhwa, CTO at Ockam, to explore the evolving landscape of secure communication in distributed systems. They discuss the challenges of securing microservices, IoT networks, and Kubernetes environments and how traditional TLS-based security models may no longer be sufficient. Mrinal shares insights into Ockam's approach to end-to-end encrypted, mutually authenticated channels and the impact of WebAssembly, passkeys, and modern cryptographic identity management on security. Tune in for a deep dive into how organizations can rethink security at runtime to minimize risks in today's complex digital ecosystems.Show NotesSecurity in modern applications is more challenging than ever, with microservices architectures, IoT deployments, and distributed computing environments introducing new risks. In this episode, Danny Allan welcomes Mrinal Wadhwa, CTO at Ockam, to discuss how secure communication models need to evolve beyond traditional TLS and perimeter-based defenses.Topics covered include:The challenges of securing microservices and Kubernetes clustersHow end-to-end encryption and mutual authentication can minimize riskThe importance of cryptographic identities and key rotation at scaleHow Ockam enables secure channels across multiple transport layers (TCP, Bluetooth, Kafka, etc.)The role of WebAssembly and passkeys in rethinking security modelsShifting from perimeter-based security to secure-by-design communicationMrinal shares key insights on how organizations can rethink risk at runtime, considering the number of people and systems involved in data flow rather than just static build-time dependencies. Whether you're a security leader, developer, or architect, this episode provides actionable insights on building trust in your infrastructure without compromising performance or agility.LinksOckamPasskeys OverviewPrivate Compute Cloud by AppleSnyk - The Developer Security Company Follow UsOur WebsiteOur LinkedIn

In this episode, I discuss strategies to beat bad eating habits, my favorite free-weight exercises for leg day, upcoming developments with Legion Clear Protein, and more.As always, these questions come directly from my Instagram followers, who take advantage of my weekly Q&As in my stories.If you have a question you're dying to have answered, make sure you follow me on Instagram (@muscleforlifefitness) and look out for the Q&A posts. Your question might just make it into a podcast episode!If you like this type of episode, let me know. Send me an email (mike@muscleforlife.com) or direct message me on Instagram. And if you don't like it, let me know that too or how you think it could be better.---Timestamps:(00:00) Intro(02:03) Intermittent fasting—fad?(06:33) Beat bad eating habits?(10:39) Dream Whey+ flavor?(11:25) TLS workouts—full coverage?(11:52) Dexa scans reliable?(12:50) Butter healthy?(13:24) Best Adonis belt exercise?(14:34) High urea—lower protein?(14:54) Fastest way to first pull-up?(15:21) Green powder worth it?(16:00) Bicep tendonitis—alternatives?(17:11) Biggest Legion challenge?(26:03) Count all protein?(29:03) Train on period?(29:46) Raising what cows?(30:47) Check nutrients without bloodwork?(31:19) Compound vs. machines?(34:47) 100g+ protein needed?(36:01) Phosphatidic acid thoughts?(37:16) Natural or enhanced?(38:54) Best leg exercise no machines?---Mentioned on the Show:Coaching PageThe Little Black Book of Workout MotivationWhey+

The past year has seen a great deal of focus on the use of public TLS certificates where private root certificates are actually the appropriate solution. In this episode we discuss the differences between these two use cases and what IT organizations can do about it.

Author, Actor and Director Eimear McBride on the delayed gratification of her first novel, the  ‘classic combination' of sex and death and why we should celebrate  female writers tackling difficult topics and themes.  Eimear trained as an actor before writing her first novel, A Girl is a Half-formed Thing, which took nine years to find a publisher but subsequently won the 2014 Women's Prize for Fiction, as well as the Kerry Group Irish Novel of the Year, the Goldsmiths Prize, and the Desmond Elliott Prize. Eimear's second novel, The Lesser Bohemians, won the 2016 James Tait Black Memorial Prize, and was shortlisted for the Goldsmiths Prize and the International Dublin Literary Award. Strange Hotel, her third novel, was published in 2020 and her latest release The City Changes Its Face is out in February 2025. In 2022, Eimear wrote and directed A Very Short Film About Longing (DMC/BBC Film) which was screened at the 2023 London Film Festival, and she also writes and reviews for the Guardian, New Statesman and the TLS.  Eimear's  book choices are: ** The Country Girls by Edna O'Brien ** Interview with the Vampire by Anne Rice ** Save Me the Waltz by Zelda Fitzgerald ** The Unequalled Self by Claire Tomalin ** Dependency by Tove Ditlevsen Vick Hope, multi-award winning TV and BBC Radio 1 presenter, author and journalist, is the host of season eight of the Women's Prize for Fiction Podcast. Every week, Vick will be joined by another inspirational woman to discuss the work of incredible female authors. The Women's Prize is one of the most prestigious literary awards in the world, and continues to champion the very best books written by women. Don't want to miss the rest of season eight? Listen and subscribe now! You can buy all books mentioned from our dedicated shelf on Bookshop.org - every purchase supports the work of the Women's Prize Trust and independent bookshops.  This podcast is sponsored by Baileys and produced by Bird Lime Media.

The Unbreakable Multi-Layer Anti-Debugging System Xavier found a nice Python script that included what it calls the "Unbreakable Multi-Layer Anti-Debugging System". Leave it up to Xavier to tear it appart for you. https://isc.sans.edu/diary/The%20Unbreakable%20Multi-Layer%20Anti-Debugging%20System/31658 Take my money: OCR crypto stealers in Google Play and App Store Malware using OCR on screen shots was available not just via Google Play, but also the Apple App Store. https://securelist.com/sparkcat-stealer-in-app-store-and-google-play-2/115385/ Threat Actors Still Leveraging Legit RMM Tool ScreenConnect Unsurprisingly, threat actors still like to use legit remote admin tools, like ScreenConnect, as a command and control channel. Silent Push outlines the latest trends and IoCs they found https://www.silentpush.com/blog/screenconnect/ Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities Java deserializing strikes again to allow arbitrary code execution. Cisco fixed this vulnerability and a authorization bypass issue in its Identity Services Engine https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF F5 Update F5 fixes an interesting authentication bypass problem affecting TLS client certificates https://my.f5.com/manage/s/article/K000149173