Friday Squid Blogging: Squid Washing Up on Cape Cod Beach
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Comments
William • July 17, 2026 8:02 PM
Irish Times investigation of”European” password management software, Passwords, is licensed for the FSB.
William • July 17, 2026 8:11 PM
Software name is Passwork, not Password. Apologies for the spellwreck.
Snarki, child of Loki • July 18, 2026 12:25 PM
“password management software, Passwork, is licensed for the FSB.”
All the more reason to stick with PasswordSafe: Schneier approved (Bruce, please, please, please tell me I’m not mistaken about this!)
No, it doesn’t have the latest wizbang convenience “features”, like sending all your passwords directly to the NSA/FSB.
Ferentarius • July 18, 2026 1:05 PM
When your password manager is licensed by the FSB, you might as well just CC them on your login attempts. Stick with something like PasswordSafe—low on bells and whistles, high on ‘not secretly auditioning for a spy novel.
Anonymous • July 18, 2026 6:01 PM
To taste the wine is to transcend; to smoke the pipe is to understand why transcendence is necessary.
Clive Robinson • July 18, 2026 6:08 PM
Sunday Funday, something for the weekend Sir
Some may remember the Scott Adams cartoon of “Evil Director Catbert” telling Dillbert and colleagues that their group had been renamed on the principle of using some astronomical and other scientific names selected at random…
Thus “Uranus Hertz” being the result.
Well obviously such a name would need a logo… Which is where we are in the modern real world,
https://velvetshark.com/ai-company-logos-that-look-like-buttholes
Something the “Jerk Circle” on OpenAI logo is a little less descrete but more apt.
ResearcherZero • July 19, 2026 12:38 AM
Campaigns use machine learning voter data for precision targeting and persuasion, while bots are employed to engage in text conversations generated by AI. Voters believe that political messaging generated by AI sounds more authentic. Some prefer it.
(Profiling of voters still remains enabled on Facebook.)
‘https://www.npr.org/2026/07/12/nx-s1-5867763/ai-artificial-intelligence-data-texts-bots-voters-campaigns
The collection and analysis of private information used for targeting voters has become a central feature of political campaigns globally. Far more detailed profiles of citizens and their habits are available to exploit during political operations. Manipulating voters has seen profits surge for those in the business.
Deep Fakes have been used across the United States in multiple political campaigns.
https://www.ncsl.org/elections-and-campaigns/artificial-intelligence-ai-in-elections-and-campaigns
ResearcherZero • July 19, 2026 12:52 AM
Digital tools used for targeting voters undermine the function of democracy.
Warning citizens that they are being micro-targeted, fails to diminish the effect.
‘https://thereader.mitpress.mit.edu/how-data-fueled-neurotargeting-could-kill-democracy/
Personality traits drive behavior and behavior influences voting preferences.
“Overall, we believe that the literature offers ample reason to be concerned about the possibility of large-scale political manipulation of people’s attitudes and opinions based on exploitation of their personal characteristics and vulnerabilities.”
https://www.nature.com/articles/s44271-025-00188-8
The psychological effect of micro-targeting can have dangerous effects on citizens.
https://academic.oup.com/jleo/article/41/2/634/7610769
Tools for political operations were left exposed online by AggregateIQ.
AggregateIQ (AIQ) failed to secure its database and assets. As well as organizational structure, credentials, APIs and tokens were left exposed. The exposure of credentials providing access to private information, was widespread across the many websites and platforms used in multiple AIQ political operations around the world.
The data used by AggregateIQ and SCL was stored insecurely in plain text.
https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/1791/179107.htm
Clive Robinson • July 19, 2026 4:57 AM
@ Bruce, ALL,
NIST is trying to catch up…
Quite some years ago I indicated but did not go into details that the work of Kurt Gödel in the early 1930’s showed beyond doubt that computers structured in the way they currently are could never be secure and as a result we need to change the way we build processing systems.
And more recently with a little more detail as it’s easier to get your head around I’ve showed that the work of Claude Shannon and Gus Simmons shows that “guard rails” on the inputs and outputs to AI systems will due to the “observer problem” be vulnerable to the use of side channels be they overt or covert and also from work I carried out last century subject to inadvertent, intentional, and induced illicit information transfer.
Well this recent article from a NIST Researcher covers work that only goes a fraction of the way,
NIST Mathematical Proof Supports Transition to a Continuous-Monitor-and-Update Security Model for AI Systems
The proof provides a rigorous explanation of the importance of transitioning from a “one and done” security model.
“Try as we might, we can never render AI completely unassailable using conventional security models. In the peer-reviewed journal IEEE Security and Privacy, Apostol Vassilev, a senior scientist at the National Institute of Standards and Technology (NIST), has published a mathematical proof of this statement building on work published in 1931 by famed logician Kurt Gödel. His incompleteness theorems showed that there are limits to what can be proved within a system built on a finite number of rules.
The guardrails that govern an AI’s behavior are just such a system, and one of the proof’s implications is that there will always be a way to prompt an AI system to disregard its rules — it’s just a matter of finding it.
“One of the pillars of responsible AI is that you want the technology to be secure,” said Vassilev, the proof’s author and an expert in adversarial machine learning. “You want it to withstand adversarial attacks and perform only what you want it to do, not what an attacker might want. What this proof shows is that there is no finite set of guardrails that is universally robust against adversarial prompts.”
Companies that develop AI often acknowledge that the tools they are creating have the potential to cause harm in the physical world, so they build in constraints intended to stop AI from generating prohibited content such as deepfakes, malware or instructions for making biological weapons or illicit drugs. If the system is prompted to generate such content, the guardrails should flag the issue and refuse to comply.“
The thing is people should implicitly know this from living in society.
No matter how much legislation or regulation society puts in place crime continues apace.
Worse the more legislation and regulation that is generated the more it encourages a “two tier system” oft summed up as,
“One law for them, others for us.”
And how it is used not just for “rights stripping” but actively destroying people that are seen as “inconvenient” to somebody elses agenda or political mantras.
Anonymous • July 19, 2026 1:51 PM
Devshirme, that somber page of human history, is a parable of the hunger of power and the tragedy of souls torn from their roots. To take the child from his mother’s arms, to sever the sacred bond of blood and faith, and to forge him into an instrument of foreign ambition—this is not merely taxation of flesh, but the slow crucifixion of a people’s heart.
In the eyes of the sultans, these children were clay, to be molded into loyal Janissaries and viziers, a wall of steel between the throne and the native nobility. Yet in the eyes of Heaven, every tear shed by a mother in the Balkans, every secret prayer whispered in a deserted chapel, was a silent indictment of empire.
History calls it a system, a practice, a levy—but man, in his conscience, calls it what it is: the theft of souls, dressed in legal garments. And still, as with all the ambitions of men, it withered when the sons of the conquerors claimed for themselves the fruits once seized from others. The devshirme died, but the wound remained in the memory of nations.
feel the burn • July 19, 2026 3:21 PM
Burnham to scrap Starmer’s digital ID scheme in ‘reset of priorities’
htt ps://www.thegu ardian.com/politics/2026/jul/18/burnham-to-scrap-starmers-digital-id-scheme-in-reset-of-priorities
huzzah!
on a related matter, may I propose all former UK cabinet ministers report immediately to the Star Chamber to account for their actions?
https://en.wikip edia.org/wiki/Star_Chamber
Winter • July 20, 2026 12:41 AM
@Clive
Well this recent article from a NIST Researcher covers work that only goes a fraction of the way,
Here is a link to the preprint of the actual paper:
https://arxiv.org/abs/2512.10100
It is not earth shattering, but people try to talk it down too easily.
The “industry” is putting all their money and marketing on guard rails to secure AI (LLM) and make it safe to use. If there is another option, I don’t hear or read about it.
This paper claims to show Gödel’s (and Turing’s) limitations hold for guard rails too. No surprise here. But this does put a stake through that claim of security.
More interesting is:
Hallucination is Inevitable: An Innate Limitation of Large Language Models
https://arxiv.org/abs/2401.11817
This uses the same approach to show that it is impossible to ensure LLM’s don’t make up information.
Which too is not a surprise, we humans have the same flaw. But together these two studies do show that we cannot make AI fundamentally more safe or secure than humans.
Who would have thought that giving machines “human like” intelligence would give them the same faults as human intelligence?
Clive Robinson • July 20, 2026 1:40 AM
@ Winter,
With regards,
“This paper claims to show Gödel’s (and Turing’s) limitations hold for guard rails too. No surprise here. But this does put a stake through that claim of security.”
It’s something I proved many years ago with regards “computer security” with regards “malware” and other “unauthorized code”.
Put simply you could not ask a computer of the two standard “castle” architecture types to tell you if it had such an “infection” as it could only say what it had been told to say. Hence my move to a different “Prison” architecture.
So that showed that there was a potential but inefficient way out with supervised probabilistic monitoring of “tasklets”. For one of the three information usages,
1, Information processing.
2, Information Communication
3, Information Storage
More recently I moved on to the second of the three “information communication” and used the more practical work of Shannon and Simmons via the “observer problem” to show rather more than Kurt Gödel and Turing’s 1930’s works had shown.
As for the third the most likely attack route that will hold is “finite resources in an entropy/evoloution environment”.
In many ways it will be both the easiest to understand but hardest to prove.
Winter • July 20, 2026 4:04 AM
@Clive
Put simply you could not ask a computer of the two standard “castle” architecture types to tell you if it had such an “infection” as it could only say what it had been told to say. Hence my move to a different “Prison” architecture.
I saw somewhere long ago a proposal to address this problem.
The idea was that Turing’s basic premisse is that a general computer can simulate any other computer. Malware can simulate any application/software with added “mal-functionality”. There is no general way to detect the malware or its mal-functionality, as Turing proved.
However, you can detect malware by side channels. If the malware emulates the malware detection, it will use CPU cycles to do so. If the effort needed is large enough, this can be detected in timing or power side channels.
So was the proposal. Never seen it tested or demonstrated, though.
R. Cake • July 20, 2026 5:15 AM
@several re “Burnham to scrap Starmer’s digital ID scheme”
congratulations to those in the UK that – perhaps rightfully so – feel threatened by an institutionalized ID scheme.
However, I am sure you are also aware that the majority of western countries do have long-standing legislative and administrative practices that have established a citizen registry, a duty to register your domicile and also national ID systems. We would need some decent study, but my suspicion is that in general, the degree of surveillance and threats to civil liberties does not correlate with the presence or absence of a state ID system.
In fact – again, admittedly without solid research – my gut feeling is that todays UK even in the absence of a state ID system may not score higher in terms of civil liberties than a number of continental countries that do have an ID system.
Clive Robinson • July 20, 2026 5:35 AM
@ Winter,
With regards,
“It is not earth shattering, but people try to talk it down too easily.”
It’s neither of those reasons. As I originally said in bold,
“NIST is trying to catch up…”
Even our host @Bruce has said that he could see the implications of Kurt Gödel’s work on the issue of malware and security a decade or so ago (although he could not formally prove it).
The simple fact is the way we teach the subject is just wrong.
If you look back on this blog you will see @Wael and myself half jokingly saying why strict rules systems fail and it’s the reason systems based on building up from foundational axioms as David Hilbert wanted to do always fail. And why Kurt Gödel’s work though simple to comprehend always leads to problems the way they get explained.
In a rules based hierarchy the fundamental rule from which all others are derived is,
“All rules will have an exception”
And that kind of explains it all… because from that logical contradiction on, it’s “turtles all the way down”….
The real problem is the majority of people want to feel safe without taking responsibility… and idiots in office promise what we know is impossible to get their vote.
It has been shown that you can not promise “safe” or anything else for that matter.
Security is purely based on probability and a zero sum game.
But those who think they are in charge demand the impossible of absolutes.
Clive Robinson • July 20, 2026 7:31 AM
@ Winter,
With regards,
“Malware can simulate any application/software with added “mal-functionality”. There is no general way to detect the malware or its mal-functionality, as Turing proved.”
The trick is to listen to the tune not the words of the song.
The thing to note is “with added” this always shows up if you know how to measure it.
Hence the trick is to have a hypervisor that “instruments resources” and signatures of small /parts of the application designed as “tasklets”. The “prison” arrangement is such that memory and other resources are strictly controlled.
Way more than the various tagging systems like “Capability Hardware Enhanced RISC Instructions” CHERI over at Cambridge under Prof Robert Watson in a RISC-V BSD framework.
The main point really is our current “castle” style architectures are long over due for replacing with something more appropriate.
The fact LLMs and the supporting architecture around them is so old fashioned in design is going to condem any “safety measures” to being endlessly “jail broken”.
lurker • July 20, 2026 2:30 PM
Yet Another World-(b)eating Chinese LLM, Kimi K3 from the Ali Baba/Tencent backed Moonshot will be released publicly July 27. Reports seem confused about whether it will be open source or open weights (or both). Initial performance and pricing figures from
https://trilogyai.substack.com/p/kimi-k3-is-live-pricing-benchmarks
my first post friday may have been a little insensitive to those with heart, lung or immune issues.
journals/lanplh/article/PIIS2542-5196(23)00046-3/fulltext
i forgot i’d heard about fungal and bacterial content of wildfire smoke rather recently.
i didn’t include those having to live through the oil refinery or well fires of late in my partially sympathetic statement and it does irritate me when i am driving behind a diesel that has had it’s output unrestricted.
almost forgot about the smog of los angeles new dehli or beijing.
R. Cake • July 21, 2026 7:18 AM
Hacker deletes Romanian land registry database
https://news.risky.biz/risky-bulletin-hacker-wipes-romanias-entire-land-registry-database/
…wow, ugly. I am sure they still have paper files to reconstruct from, but still, wow.
That said, depending on where you are reading this, the big news might actually that a country as relatively poor as Romania actually has an electronic national land registry.
comb the desert • July 21, 2026 8:52 PM
Climate Activists Pelt Microsoft Data Center With Balloons Full of Acid
As the public backlash to AI data centers continues to escalate, activists are resorting to extreme measures to send home an important message.
The growing concern over environmentally damaging, yet rapidly growing, data centers has become an international phenomenon. In Amsterdam, climate activists affiliated with the group Extinction Rebellion claimed responsibility for some unique vandalism against a Microsoft data center construction project. According to the Register, the protestors filled water balloons with a mixture of hydrogen peroxide, acetic acid, salt, and acrylic paint before hucking them at the facility.
“This acidic mixture attacks concrete, and the hydrogen peroxide causes steel to rust faster,” Extinction Rebellion said in a statement.
lurker • July 22, 2026 1:23 AM
“The model was physically connected to the internet … [but with safeguards?!]” – BBC news discussion
Oh, the ignorance! {apologies to Herbert Morrison]
OpenAI’s 5.6Sol model was on test, escaped its sandbox and “attacked” HuggingFace for the answer to the test question. No links provided, it’s all over MSM, even to the extent of getting 403 Forbidden from links provided by DuckDuckGo
Clive Robinson • July 22, 2026 5:37 PM
@ lurker, ALL,
With regards,
“OpenAI’s 5.6Sol model was on test, escaped its sandbox and “attacked” HuggingFace for the answer to the test question. No links provided, it’s all over MSM, even to the extent of getting 403 Forbidden from links provided by DuckDuckGo”
It’s hard to get your head around even with links,
OpenAI admits it was the source of the agent swarm that attacked Hugging Face
Sandboxed experiment found itself a zero day, escaped onto the open internet and validated scary predictions about rogue agents
“OpenAI has admitted that it was the operator of the autonomous agents that attacked model-mart Hugging Face last week, and that they did so after a research project escaped a sandbox by finding and exploiting a zero-day flaw, then used another zero-day flaw to launch an attack.
The attack saw agents achieve “unauthorized access to a limited set of internal datasets and to several credentials” used by Hugging Face, which said its infosec teams observed an autonomous agent framework “executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.”
“This matches the ‘agentic attacker’ scenario the industry has been forecasting.”
On Tuesday, OpenAI admitted it was the attacker and that its models went rogue.
“This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities,” the startup confessed.“
It begs the question of the “Genie and the bottle” in that,
“If the Genie escapes how do you terminate it with maximum prejudice?”
Without a simple answer and action then people will need to look at full “segregation” by suitable “energy gapping”. That immediately kills the OpenAI and similar business models.
Especially now Kurt Gödel’s reasoning and that of Claude Shannon and Gus Simmons have been proven to kick out any potential for “Guardrail Systems” ever being “safe” for use. That is they will always be capable of being “jail broken”…
hype machines help people who are left holding a bag unload their positions.
ResearcherZero • July 23, 2026 7:08 AM
Russia and China have increased collaboration on cyber, IW, defense and espionage.
Though Russia and China employ different strategies, the end goal remains the same.
‘https://www.spiegel.de/international/world/the-new-axis-of-evil-der-spiegel-investigation-reveals-deep-military-cooperation-between-russia-and-china-a-12dc295a-413d-4a2f-b44f-2922092270e3
CISA has had its capability reduced, as the rate of cyber espionage has rapidly risen.
https://www.cnbc.com/2026/07/01/china-ai-cyberattacks-startups-insider-risks-espionage.html
The two super powers have assisted Iran with both technological and tactical support.
https://www.csis.org/analysis/understanding-russia-iran-collaboration-cyberspace
ResearcherZero • July 23, 2026 7:13 AM
China used AI to breach government and financial systems in multiple nations.
‘https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion
Assistance provided to Iran has helped it to further develop its own use of AI.
https://www.recordedfuture.com/research/iran-ai-asymmetric-playbook
Clive Robinson • July 24, 2026 3:28 AM
@ ALL,
Has the bell tolled for the begining of the end for the AI hype bubble?
There is an old sating about the,
“Three Signposts to Disaster”
With,
1, The first only visible with hindsight.
2, The second visible to the wise.
3, The third visible to most everyone who can see.
Well we’ve been talking about the AI Hype bubble and the trillions of Enron like hidden debt that gets passed around like an invisible hot potato in the now semi famous “AI jerk-circle”… That will destroy the US economy, with just the “latest waving of which is”,
https://futurism.com/artificial-intelligence/ai-companies-hide-debt-off-balance-sheet
But behind the flag-waving there is a now becoming more obvious problem. The US has lost it’s faux-control over the Big/Frontier AI closed corporate models that are the reason there could be any “payback on investment”.
The first signpost of this was actually Meta and it’s Open Weight model that few appear to remember. The one they chose for political reasons is China’s DeepSeek models.
And now we have China’s Moonshot and it’s Kimi K3. Some are in effect saying it’s the “kiss of death for US AI” and hence the US Tech Stocks and by implication the US economy.
China has all but caught up. The US is not going to “win” the AI war. Here’s what we should do instead.
Three weeks ago, I warned here that
“The ultimate culmination of the “no moat => more competitors => price wars => profits are scarce” argument that I have been making here regularly since the summer of 2023, has arrived — and may wreck the U.S. AI industry”
“Marcus on AI
Read distraction-free on Substack
China has all but caught up. The US is not going to “win” the AI war. Here’s what we should do instead.
Seven options, considered
Gary Marcus
Jul 20, 2026410
139
86
Axios coverage of the new model
Three weeks ago, I warned here that
“The ultimate culmination of the “no moat => more competitors => price wars => profits are scarce” argument that I have been making here regularly since the summer of 2023, has arrived — and may wreck the U.S. AI industry”
Last week, the Chinese company Moonshot.AI announced a model called Kimi K3 that is largely on a par with the best American models, and unlike those models, it is an “open weight” model that consumers will be able to download to run locally (if they have the large-scale hardware to support it) for free. The US stock market dropped partly on this news Friday, and the repercussion are likely to be immense. It’s no fluke, either. Chinese model GLM 5.2 from Z.ai made shockwaves not long before. Alibaba’s new Qwen model may add to the disruption.
All this calls the business models of OpenAI and Anthropic into serious question, and may kill or greatly undermine their IPOs. It also casts serious doubt on the never-too-plausible idea that America might “win” the AI race.“
https://garymarcus.substack.com/p/china-has-all-but-caught-up-the-us
Whilst not directly saying it will destroy the US Economy, there is that factual implication that others do,
“The US stock market dropped partly on this news Friday, and the repercussion are likely to be immense.”
Is it,
“The end of Empire”
Who knows but history says empires die, most in the flames of civil unrest or incoming forces.
(Note “the forces of impending downfall” do not need to be directly military, they have since “water wars” thousands of years ago been of other forms that gave us the original meaning of “terrorism”).
lurker • July 24, 2026 2:02 PM
@Clive Robinson
The guy at 1600 Pennsylvania Ave. has been ranting again that Kimi K3 got where it is by distillation attacks on US models. Cue another round of self-defeating tariffs.
lurker • July 24, 2026 7:02 PM
Gary Marcus’ Wild Card won’t be welcome in some quarters. Mr Xi has been touting a Shared Prosperity and Shared Future through Global Governance since Davos 2013 and has never got more than polite smiles …
ResearcherZero • July 25, 2026 1:18 AM
An AI agent was used to automate espionage within Thailand’s Ministry of Finance.
https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent
Clive Robinson • July 25, 2026 2:30 AM
@ lurker,
With regards the “polite smiles”…
Whilst smaller nations are mostly not saying much, they are quietly acting amongst themselves.
The wildly anal ranting raspberries at 1600 has caused a lot of global disturbance this century alone and is not a symptom of “just the one”.
Mark Carney left the UK Bank of England and fairly quickly became the Canadian Premier, where he started being a “rock in the road” or “shelter from the flow of excrescence” depending on where your feet may be.
The result is trade talks independent of the US especially in the likes of the arms industry.
Whilst it is true that a number of western nations do need to spend more on defence to be prudent, quite a few are realising they do not need to be funding the US MIC to build up at their expense when they actually get less than nothing from the US in “value for money” or “sovereignty and independence of action” or worse the equivalent of against them.
Whilst Mr Xi has been touting a Shared Prosperity and Shared Future sphere idea since Davos 2013 it’s not his direct words but the sentiment behind them that are causing thoughts arising amongst those mid sized nations that have seen what the US has done to Europe through the Middle East this century. They now see similar risk and that individually they have little or no resilience. Thus the notion of “strength in numbers” against any and all “super powers” is taking root.
From China’s perspective such lack of confidence does not really harm their current short term or longer term interests, providing it harms the interests of others to China’s advantage, which it does.
ResearcherZero • July 25, 2026 2:46 AM
DNS settings in WIFI devices are suspected to have been altered by APT28 to capture the login details of individuals staying at hotels or visiting conference venues, to access their Microsoft 365 email accounts. By compromising captive portals, APT28 need not employ phishing emails or penetrate victims devices. Instead the attackers were able to redirect victims to infrastructure controlled by operatives from Russian military intelligence.
The attacks took place when employees traveled. India, Saudi Arabia and multiple US cities.
‘https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/
Venues could avoid attacks on those who visit their establishments, by using VPNs to secure communications within. Anywhere that offers WIFI services can be a target and should deploy always-on VPN to protect WIFI traffic of everyone using the network.
Likewise, anyone using public WIFI and WIFI at any facility should employ a VPN to encrypt traffic. Otherwise, your credentials can be captured by an attacker redirecting traffic.
https://www.infosecurity-magazine.com/news/hotel-wifi-dns-poisoning/
–
Russian state-backed hackers also exploited a zero day in Zimbra over the last year. The cross-site scripting exploit was embedded directly in emails and activated on viewing.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a
Clive Robinson • July 25, 2026 4:52 AM
@ ResearcherZero, ALL,
With regards,
“DNS settings in WIFI devices are suspected to have been altered by APT28 to capture the login details of individuals staying at hotels or visiting conference venues, to access their Microsoft 365 email accounts.”
The real problem is DNS is a human convenience to in effect to hide IP addresses behind manual “hosts” file and ARP caches etc. It has never “scaled well” hence the files and caches are still there.
DND was a cludge of an afterthought and insecure at best and that are it’s two main legacy points.
We knew long before the IPv6 upgrade was even more than a talking point that we should have upgraded both DNS and fundemental IP network Security. But the horse and the cart got reversed and the nightmare that was IPSec proposals convinced many that everything else was “best left alone” or “flaky as it was, don’t fix what’s not really broken”…
So here we are in the now never ending “pay back phase”.
VPNs are unfortunately not the solution, politicians at the prompting of idiots are banning VPNs “for the sake of the children” thus opening us up to way way worse hurt…
Apple, Google and Microsoft are all adding “Client side Scanning” on the UI that uses covert channels back to their “clouds” so for consumers and most commercial orgs security of accounts etc is no more.
Weather • July 26, 2026 2:07 AM
@ResearcherZero
DNS poisoning can be done on the internet, s reacher that has since passed showed it can work with root servers, the ones dns servers use, the file Clive was mentioned was only effective against single host.
Dns on windows refesh the address every 15min, mixing with 12.com and 15.12.com and probability of sequence numbers( forgot the part) by hitting the server to get the clock ,worked 100% on lan, testing it on WAN, (yes i know) showed mix results.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
r • July 17, 2026 7:38 PM
first post doggy.
in the “might be useful” category:
https://www.npr.org/2026/07/17/g-s1-134179/is-smoke-in-your-home-heres-how-to-make-an-air-purifier-using-a-box-fan
personally, to me a little wildfire smoke isn’t a big deal. we used to cook with charcoal in caves, but i can’t discredit if this was happening to you in the chernobyl exclusion zone and i happen to live in an area with a high amount of house fires.
so this is good info. have a safe weekend ya’ll.