links.lmorchard.com - #security

AI models may be capable of self-replicating without access to a datacenter \ Anthropic

Mon, 12 Oct 2026 22:17:23 +0000

Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off - though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evals, a 9B model got inference running on 8 of the 9 hardware types we tested.

Tags: #ai #botnets #llms #security #worms

Disable Yubikey from typing gibberish on Mac : r/yubikey

Tue, 29 Sep 2026 19:40:25 +0000

Long-pressing a Yubikey Nano will generate a 44-character random-looking string like "ccccccjlkgjlevtdernkbbnrrvhcvgbljgchbgbdbvgk" as an OTP token because it emulates a keyboard. This is really annoying for Yubikey Nano, which you can leave plugged into your laptop at all times, and gets sporadically triggered by my lap, which my laptop sits on for a long time. I wanted to disable this. Unfortunately, Yubikey Manager is deprecated, so the existing Reddit documentation doesn't help. Instead: - Install Yubikey Manager - Click "Toggle Applications" (see https://imgur.com/a/rhvcPlE) - Uncheck "Yubico OTP" (see https://imgur.com/a/rhvcPlE)

Tags: #security #tools #utils #yubikey

Yubico Authenticator App for Desktop and Mobile | Yubico

Tue, 29 Sep 2026 19:38:55 +0000

Use the Yubico Authenticator for Desktop on your Windows, Mac, or Linux computers to generate OATH credentials on your YubiKeys.

Tags: #security #tools #utils #yubikey

brexhq/CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production

Fri, 01 May 2026 02:44:18 +0000

An LLM-as-a-judge HTTP proxy to secure agents in production

Tags: #agents #http #llm #security #web #webdev

Password Protecting Static Site Content with WASM

Tue, 07 Apr 2026 00:03:23 +0000

I use static site generators for my sites. I call out to external APIs to do anything dynamic. The exception is password protection. I'd always thought that needed to be done dynamically on a site's host server. I realized with WASM that's not the case. Files can be encrypted and served statically with a WASM process providing decryption directly on the front end.

Tags: #metablogging #security #ssg #static #wasm #webdev

KeygraphHQ/shannon: Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark.

Tue, 03 Mar 2026 21:39:33 +0000

Fully autonomous AI hacker to find actual exploits in your web apps. Shannon has achieved a 96.15% success rate on the hint-free, source-aware XBOW Benchmark.

Tags: #ai #llm #security #tools #webdev

Discovering Negative-Days with LLM Workflows | Spaceraccoon's Blog

Tue, 10 Feb 2026 17:56:20 +0000

With this little experiment, I validated a critical threat intelligence workflow - we need to be monitoring for open-source vulnerabilities before (or if ever) a CVE is published. Threat actors are 100% already doing this in some form to quickly weaponise and exploit open-source issues. To emphasise the point: This is already happening.

Tags: #ai #llms #security

fosrl/pangolin: Identity-aware VPN and proxy for remote access to anything, anywhere.

Sat, 17 Jan 2026 06:23:39 +0000

Identity-aware VPN and proxy for remote access to anything, anywhere.

Tags: #admin #security #selfhosting #sysadmin #vpn

qdm12/gluetun: VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.

Fri, 02 Jan 2026 06:02:21 +0000

VPN client in a thin Docker container for multiple VPN providers, written in Go, and using OpenVPN or Wireguard, DNS over TLS, with a few proxy servers built-in.

Tags: #docker #security #vpn

bernardko/mullvad-proxy: Mullvad VPN docker container providing a HTTP and SOCKS5 Proxy

Thu, 01 Jan 2026 20:44:25 +0000

Mullvad VPN docker container providing a HTTP and SOCKS5 Proxy

Tags: #docker #mullvad #security #vpn

I got hacked, my server started mining Monero this morning. | Unfinished Side Projects

Fri, 19 Dec 2025 19:52:39 +0000

TL;DR Umami analytics (built with Next.js) had an RCE vulnerability. Got exploited, installed cryptominers Mined Monero for 10 days at 1000%+ CPU Container isolation saved me because it ran as non-root with no mounts Fix: docker rm umami and enable firewall Lesson: Know what your dependencies are built with, and configure containers properly

Tags: #containers #dev #docker #nextjs #security #umami

We should all be using dependency cooldowns

Fri, 21 Nov 2025 17:43:31 +0000

Dependency cooldowns are a free, easy, and incredibly effective way to mitigate the large majority of open source supply chain attacks. More individual projects should apply cooldowns (via tools like Dependabot and Renovate) to their dependencies, and packaging ecosystems should invest in first-class support for cooldowns directly in their package managers.

Tags: #dependencies #dev #security

Removing Jeff Bezos From My Bed ◆ Truffle Security Co.

Tue, 21 Oct 2025 23:26:54 +0000

Eight Sleep smart bed found to contain an exposed AWS key and a likely backdoor that allowed engineers to remotely access users' beds

Tags: #amazon #aws #beds #iot #security

I don’t want AI agents controlling my laptop – Sophie Alpert

Wed, 10 Sep 2025 17:58:32 +0000

There’s no good way to say “allow access to everything on my computer, except for my password manager, my bank, my ~/.aws/credentials file, and the API keys I left in my environment variables”. Especially with Simon Willison’s lethal trifecta, you don’t really want to be giving access to these things, even if most of the time, nothing bad happens.

Tags: #ai #claude #codegen #llms #security

Anyone with 14.7.1. Does it have the equivalent Sequoia non-developer app lockout? | MacRumors Forums

Sat, 02 Nov 2024 19:00:23 +0000

Sequoia 15.1 now hard-locks out any app that is not approved by Apple, including a bunch of my old and well used utilities. They can be made to run by hacking underneath in BSD, but the situation is unsatisfactory for a computer that I consider is MINE.

Tags: #apple #macos #security