| Quote of the day | Everything going on is PAR for the course |
| Quote of the week | I had a rough month last week |
| Chewie | The cat’s name is Chewie |
We can’t recycle our way out of the plastic crisis.
As long as companies keep ramping up plastic production, recycling will always be too little, too late.
🎨: Famous paintings reimagined by artist Juha Hansen in collaboration with Greenpeace, no AI used ✌️
Apple has open-sourced corecrypto, the foundational cryptographic library in Apple operating systems
https://security.apple.com/blog/formal-verification-corecrypto/
With the latest release of corecrypto, we’re publishing our implementations of quantum-secure ML-KEM and ML-DSA algorithms, along with the mathematical proofs we built to assure they are faithful to the FIPS 203 and FIPS 204 specifications. To advance the state of the art for assuring critical software, we're also publishing the formal verification libraries and tools that we created to achieve the strongest known correctness results for any widely-deployed production implementation of the relevant algorithms.
🚨 Emergency DevSec Station Drop
There's an active npm supply chain attack happening right now. Compromised packages are stealing SSH keys, AWS credentials, GitHub tokens, browser passwords, and crypto wallets on install. Then using your publish token to infect every package you maintain.
One command can protect you immediately: npm config set ignore-scripts true
1/2
📡 𝗡𝗼𝗼𝗲𝗹𝗲𝗰: 𝗳𝗼𝘂𝗿𝗻𝗶𝘀𝘀𝗲𝘂𝗿 𝗺𝗮𝘁é𝗿𝗶𝗲𝗹 𝗱𝗲 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 • 𝗵𝗮𝗿𝗱𝘄𝗮𝗿𝗲 𝘀𝗽𝗼𝗻𝘀𝗼𝗿 𝗼𝗳 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲
Merci à Nooelec Inc. de nous appuyer cette année, particulièrement pour le village RF. Ils fournissent des SDR à prêter aux participant(e)s sur place, dont des HackRF Pro, ainsi que des SDR à tirer au sort.
Le village RF, c'est aussi l'endroit où passer ton examen de radio amateur de base vendredi à 17h. Un billet conférence est requis pour participer.
Les profits de l'examen sont reversés au fonds du Jamboree Pologne 2027 (jamboree2027.org), un projet auquel participe le 7e Groupe Scouts de Terrebonne (scoutsterrebonne.com).
Entre le village RF, l'examen de radio amateur, les SDR Nooelec et la formation 5G de 📡 Sebastien Dudek et Pentherz, NorthSec 2026 va être une bonne année pour les ondes!
Thanks to Nooelec for supporting us this year, with a special focus on the RF village. They're providing SDRs to lend to participants on site, including HackRF Pros, plus SDRs to give away in a draw.
The RF village is also where you can sit your Basic Amateur Radio Exam on Friday at 5PM. A conference ticket is required to participate.
All proceeds go to the Jamboree Poland 2027 project fund (jamboree2027.org), a project the 7e Groupe Scouts de Terrebonne (scoutsterrebonne.com) will be part of.
Between the RF village, the amateur radio exam, Nooelec SDRs, and the 5G training by 📡 Sebastien Dudek and Pentherz, NorthSec 2026 is shaping up to be a great year for waves.
Do you remember the surprise announcement of a new social network in Davos this past January? Something that promised to be the "first" European social network?
Its name is #WSocial and it's a fork of #Bluesky. Its founders have ties with European politicians - but there is no official involvement by the EU.
You wouldn't know any of this from media reports because they all rehashed their talking points. So I wrote a post about it, dispelling some myths:
https://blog.elenarossini.com/w-social-uncovered-the-reality-behind-the-hype/
Holy shit, Microsoft. Whoever made this decision should be fired. Into the Sun.
Hacker News [https://news.ycombinator.com/item?id=48012735]. > When you save passwords in Edge, the browser decrypts every credential at startup and keeps them resident in process memory. This happens even if you never visit a site that uses those credentials. > > At the same time, Edge requires you to re‑authenticate before showing those same passwords in the Password Manager UI — yet the browser process already has them all in plaintext. > > Edge is the only Chromium‑based browser I’ve tested that behaves this way. By contrast, Chrome uses a design that makes it far harder for attackers to extract saved passwords by simply reading process memory. > > It decrypts credentials only when needed, instead of keeping all passwords in memory at all times. App‑Bound Encryption (ABE) adds another layer by binding decryption to an authenticated Chrome process, preventing other processes from reusing Chrome’s encryption keys. > > Because of these controls, plaintext passwords appear only briefly during autofill or when the user views them, making broad memory scraping far less effective. The risk of keeping the passwords in cleartext in memory becomes evident in shared environments. > > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. In the video the attacker has compromised a user account with administrative rights and is able to view stored credentials for two other logged on > > (or even disconnected) users with Edge running. I reported this to Microsoft, and the official response was that the behavior is “by design”. They have been informed that I would be sharing this as a responsible disclosure so users and organizations can make informed decisions > > about how they manage credentials. Last wednesday (April 29th) I disclosed this on BigBiteOfTech by Norway Simple, educational proof of concept [https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper], to show that the passwords are stored in cleartext in memory. Source [https://farside.link/nitter/L1v1ng0ffTh3L4N/status/2051308329880719730].
A COMPUTER CANNOT FIND OUT
THEREFORE A COMPUTER MUST NEVER BE ALLOWED TO FUCK AROUND
35 years ago, when I came here, there was no electricity on site so I saved up the equivalent of a month's wages to buy a tiny 45W solar panel. Now after years of relying on the grid, I have finally managed to install a decent PV system. 4KW of panels. a 6KW inverter, and 10KWh of storage - and all for a cost comparable to what I spent all those years ago for that single 45W panel.
Very happy to be finally self sufficient in electricity.
Did a Time Traveling Superintelligent AI Try to Warn About White House Correspondents Dinner Shooting? An Investigation
Exploring the origins of an incredibly dumb, Magic Eye-themed WHCD conspiracy theory.
Greenpeace International
Gilgwath
Catalin Cimpanu
Tanya Janca | SheHacksPurple 
NorthSec
Elena Rossini ⁂
Morgan
Mark Dominus
Stanholp
404 Media