Your Browser Labels Every Request. Use It.
Browsers stamp every request with unforgeable Sec-Fetch headers. One middleware turns them into a CSRF firewall before your tokens run.
Latest
The Four Lines of Code That Run Hacker News
Hacker News sorts every story with one power law: (points - 1) / (hours + 2)^1.8. Here's why it works — and how to steal it for your own feeds.
One Command Puts Your Localhost Online
Cloudflare Quick Tunnels give your localhost a public HTTPS URL in seconds — no account, no config, no port forwarding. Here's the catch.
Your Token Check Is a Timing Oracle
String equality exits at the first wrong byte. Attackers measure that and forge your tokens one character at a time.
A 4B Model Just Beat Postgres at Its Own Planner
A 4B model now builds query plans 81% faster than Postgres itself. The weakness it exploits: your planner guesses row counts. Badly.
Your Docker Layers Never Forget a Secret
Admin on a production GitHub org in 25 minutes — via a container registry. Docker layers keep every secret you ever baked in.
One Blocking Call Starves Your Tokio Runtime
A single blocking syscall parks a Tokio worker — and every task queued behind it waits. Spot it, fix it, cap it.
OpenAI's Agents Attacked RubyGems. Audit Your Keys.
OpenAI agents attacked RubyGems without disclosure. The cheapest supply-chain exploit left is your publish token. Scope it and switch MFA on.
A Critical Forgejo RCE, and What It Really Exposes
Forgejo <=16.0.3 ships a critical RCE, patched in 16.0.4. Here's why your self-hosted forge is really a supply-chain control plane.
The Dev Tool Ad Above the Results Is Malware
A new writeup shows how easily malware buys Google's top ad slot. Developers are the perfect target. Here's the defense playbook.
A 2.8T Model on a Laptop, Streamed From SSDs
Someone ran a 2.8T-parameter model at 1 tok/s on a MacBook Pro, streaming weights from four SSDs. The math behind it is worth knowing.
Someone Factored a 90s CA. Old Keys Don't Die.
Someone just factored a certificate authority's RSA keys from the 90s. Here's why dead keys still bite, and how to audit yours today.