This is a very thorough description of a bug detected in a Zero Knowledge Proof (ZKP) library used by a blockchain. If you are interested in how modern ZKPs work, this article gives a condensed overview of what is happening in a ZKP, and what the security guarantees are. As always, the devil is in the details, and in this case, a missing verification allowed an attacker to prove anything they wanted.
https://osec.io/blog/2026-04-30-unverified-evaluations-dusk-plonk/
#C4DT_EPFL #WeeklyPicks Google startete schon im 2010 ein 'Vulnerability Reward Program', ein Bug-Bounty für alle Services von Google, das Belohnungen auszahlt, alleine 17 Millionen US-$ im 2025. Diese Prämie wurde über mehr als 700 Analysten verteilt, die Fehler fanden in Android, der Google Cloud, aber auch in verbreiteten und häufig gebrauchten Open Source Programmen und Bibliotheken.
#WeeklyPick #C4DT_EPFL #EPFL #digiges #SocNum @digiges
Un sujet qui m'inquiète en tant que supporteur des logiciels libres et de la souveraineté qui les accompagne: Google veut fermeture sa plate-forme Android pour toute application qui n'est pas signé par un développeur agréé par Google. Le sujet fait débat surtout en Europe, où Apple a dû ouvrir ses iPhones aux applications étrangères.
En verouillant l’accès aux applications, Google cherche à transformer Android, historiquement ouvert, en une plateforme sous contrôle strict, tout en renforçant encore davantage un pouvoir déjà excessif. Cette dérive met en péril le logiciel libre, les alternatives indépendantes et les libertés d’usage sur nos téléphones. Elle fait peser un risque sérieux sur nos services numériques et la souveraineté de la Suisse. Société Numérique lance une contre-offensive.
I always liked Anthropic's stance of doing the good thing and setting standards with regards to security and ehtics in LLMs. Unfortunately they changed their mind and will now only define 'goals that we will openly grade our progress towards'. So these goals will be non-binding. At least they kept the rules of 'no AI controlled weapons' and 'no mass domestic surveillance'.
https://edition.cnn.com/2026/02/25/tech/anthropic-safety-policy-change
The Center for Digital Trust (C4DT) is organising a special edition of our bi-annual open-source software services meet-up with an external guest speaker, David Monniaux from Université Grenoble Alpes.
https://rse.swiss/events/2026_03_04_oss_services_meet_up_special_edition/
We are pleased to share some output of our work on electronic credentials in our technical blog: "Choosing a Cryptographic Library for Anonymous Credentials":
https://eid-privacy.github.io/wp2/2026/01/27/docknetwork-crypto-library.html
In WP1 we created a list of existing algorithms and tools for anonymous proofs in electronic identities. The findings of WP1 were used to create an overview of existing libraries which we can use to build our research on. This post describes how we evaluated the relevant libraries we found, and for which ones we did a deeper evaluation.
Long live Friday: here is a short article pointing to our Proof-of-Concept on privacy-preserving #eID presentation of credentials. It includes proofs for issuer signature, holder binding, predicate proofs, and non-revocation proofs.
Spoiler alert: #NoirLang is awesome! It's easy to understand AND fast!
Have a look here:
For the milestone 2 of our Innosuisse project, we created a proof-of-concept for our suggested implementations regarding a privacy-preserving e-ID. Our work packages included the following four presentations, which should be as privacy-preserving (unlinkeable and data minimizing) as possible:
Finland is combatting Fake News at its destination. It teaches media literacy in schools, starting from the age of three, on through the whole curriculum of the students. This approach is paying off, with the country ranking at the top of the European Media Literacy Index. Meanwhile, here in Switzerland, students are mostly left to figure out for themselves what is real and what is fake.
This thought-provoking article challenges the rationale behind the increasing integration of large language models (LLMs) into our daily workflows. Is it the result of thorough risk-benefit analyses or because of our growing normalization of the problems inherent in these systems and complacency towards the potentially disastrous consequences?
https://embracethered.com/blog/posts/2025/the-normalization-of-deviance-in-ai/
Linus Gasser
o lаvrоvsky
Carine Dengler