Bloomberg
A technical validation page requesting JavaScript and cookie verification to proceed with access, including instructions for reviewing Terms of Service and contacting support if needed.
Security
A 2023 study concluded CAPTCHAs are 'a tracking cookie farm for profit masquerading as a security service' that made us spend 819 million hours clicking on traffic lights to generate nearly $1 trillion for Google
A 2023 UC Irvine study reveals that Google's reCAPTCHA system has consumed 819 million human hours while generating nearly $1 trillion in value through tracking cookies and AI training data. The research demonstrates that bots now outperform humans in completing these security checks, suggesting reCAPTCHA primarily serves as a data collection tool rather than a security measure.
Open Source Security & Compliance
OpenComply is an open-source security and compliance platform designed to simplify infrastructure monitoring and policy enforcement across multiple cloud services and tools. The platform offers universal visibility, automated compliance checks, and integration with various cloud providers while maintaining an engineer-friendly approach with git-managed policies and pipeline integration.
QUIC action: patching a broadcast address amplification vulnerability
A group of researchers discovered a broadcast amplification vulnerability in Cloudflare's QUIC implementation, where a single packet to a broadcast IP address could trigger multiple responses from server workers. The vulnerability, which has been fully patched, highlighted how broadcast functionality combined with SO_REUSEPORT socket options can create significant amplification risks in UDP-based services.
Please complete security verification
A CAPTCHA verification system prompts users to press and hold a button until it turns green to verify their human status, with an option to contact support for errors.
Please complete security verification
A CAPTCHA verification page prompts users to confirm their human identity by pressing and holding a button until it turns green.
a tale of several distros joining forces for a common goal
A collaborative effort between Debian and Arch Linux developers showcases their work on reproducible builds using rebuilderd, a tool implemented since 2020 for Arch and 2024 for Debian, to verify package integrity across distributions.
Cloudflare incident on February 6, 2025
A 59-minute Cloudflare R2 storage outage occurred on February 6, 2025, causing widespread service disruptions across multiple Cloudflare products due to human error during phishing site remediation. The incident resulted in 100% failure rates for R2 operations and affected dependent services like Stream, Images, and Cache Reserve, though no data was lost or corrupted. Cloudflare has implemented immediate safeguards and is developing additional system-wide controls to prevent similar incidents.
Resolving a Mutual TLS session resumption vulnerability
A vulnerability in Cloudflare's Mutual TLS implementation allowed certificates from one zone to be used in another zone through session resumption, tracked as CVE-2025-23419. The security flaw was discovered through Cloudflare's Bug Bounty Program and was mitigated within 32 hours by disabling TLS session resumption for mTLS customers.
VSCode’s SSH Agent Is Bananas
The VSCode remote editing feature, unlike Emacs' Tramp, installs a full Node-based agent on remote systems with extensive filesystem and process control capabilities, raising security concerns for development and production environments, particularly when combined with LLM-powered code generation.
A Brief History of Code Signing at Mozilla
Mozilla's code signing process has evolved significantly over 20 years, progressing from manual GPG signatures to an automated system handling thousands of daily signatures through their Autograph service. The evolution includes improvements in security, automation, and cross-platform support, moving from Windows-only signing to a sophisticated cloud-based infrastructure with Hardware Security Modules.
GitHub - US-Artificial-Intelligence/scraper: A self-hosted API that takes a URL and returns a file with browser screenshots.
A web scraping API project built to support Abbey AI platform, offering high-quality website data extraction using Playwright in Docker containers with screenshot capabilities and security features. The service provides simple URL-based scraping with configurable memory allocation, proper handling of redirects, and download links through a blocking API interface.
OpenWrt 24.10.0 - First Stable Release - 6. February 2025
OpenWrt 24.10.0 brings major updates including Linux kernel 6.6, TLS 1.3 support, and improved WiFi6/WiFi7 capabilities across over 1970 supported devices. The release features significant core component upgrades, new hardware target support, and enhanced security features, though users should note specific upgrade requirements for certain devices.
n0rdy - What Okta Bcrypt incident can teach us about designing better APIs
A comprehensive analysis of how various programming languages and libraries handle Bcrypt's 72-character input limitation reveals widespread security vulnerabilities similar to the Okta incident. Most implementations silently truncate input exceeding the limit rather than throwing errors, potentially allowing authentication bypasses with long usernames. Only Go's standard library and a specific Java implementation properly validate input length, highlighting the importance of secure API design.