In a rare combined cybersecurity/squid post, a twenty-nine-year-old squid proxy bug can leak HTTP requests.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
ResearcherZero • July 11, 2026 1:19 AM
What does Total Information Awareness look like?
As AI becomes more prevalent, sensitive and personal information can be extrapolated.
The Predicted Person
https://telegraph.com/ai-privacy-nothing-to-hide/
Guardrails and regulations to protect privacy are needed now(!) more than ever.
https://www.theguardian.com/commentisfree/2026/jul/06/ai-surveillance-policy
ResearcherZero • July 11, 2026 4:18 AM
De-funding public access to government records and data.
The National Archives and Records Administration is closing its facilities in Chicago, San Francisco and Seattle. Staffing was additionally cut by more than 500 employees. Funding has been in dire circumstances for many years and the administration is operating with a reduced budget which hampers its ability to properly function.
In 2024 a major report on the status of the National Archives and Records Administration (NARA) warned that NARA desperately needed more funding in order to continue reviewing and declassifying records and meet Freedom of Information requests requirements. As electronic records add to the problem of paper records already overwhelming NARA, the lack of staffing, adequate equipment and infrastructure has seen the backlog of requests grow to the point where requests can become stuck in queues of 12 years waiting to be processed.
Many records will now no longer make it to the National Archives. That information will become lost to the public. As public record and federal data access is reduced for the public, or becomes entirely unavailable in many cases, the Trump administration is amassing data for itself to further its own interests and amass even greater power and control. Abrupt changes to how data is collected, have altered once comparable datasets and how information can be looked at over time, obscuring and distorting how different data might be interpreted.
Now the Trump administration has begun closing public records facilities containing historical records, gutting the National Archives and deleting or removing access to federal data. Important programs that collect vital statistics and information are being de-funded, wound back and ended. Scientific and historical data is also being deleted as the Trump administration makes changes to government websites, agencies and services.
The cost of filing FOI requests has become out of reach for many. Only corporations and the wealthy will have the time and money necessary. Changes to how census and economic data are collected will add to the reduction in data that is available to the public. Removal of scientific and historical information worsens the problem. As facts disappear and access to historical records is lost, fabrications, misinformation and lies will fill the gaps.
Without the paper trail, the public cannot hold government accountable for its actions. This is taking place while the government consolidates data for itself and massively expands its surveillance capabilities.
When history is rewritten, citizens can find themselves written out of it without warning, as the foundations of society shift around them and administrative errors alter reality.
For members of the public to protect their rights, property and liberty, access to public records can be essential. Without that access, the ability of citizens to defend themselves from unreasonable or criminal actions becomes far more difficult. Proving ownership, ancestry or events – perhaps might become impossible – if the documentation required to ascertain certain facts, is no longer accessible or perhaps no longer exists.
Cith • July 11, 2026 4:39 AM
AP News: Greek police arrest 2 people over 2010 fatal arson attack on Athens bank
https://apnews.com/article/greece-marfin-bank-deaths-firebomb-arrests-257bbbbe0a2598872278c87d801d06fd
A highly concerning development out of Greece this week regarding the intersection of digital forensics, generative AI, and political policing.
Greek police have just arrested two suspects for the infamous 2010 Marfin Bank arson attack, 16 years after the fact. While the English-language wire reports (like the AP link above) merely mention that the cold case was reopened due to an “anonymous tip” and the “cross-referencing” of old photographs, local Greek media is heavily pushing the narrative that these arrests were made possible by “new technologies,” specifically AI image enhancement and body-type/gait identification from the original footage.
This is a textbook example of the “CSI Enhance” fantasy being weaponized in the real world.
As anyone with a background in information theory knows, the Data Processing Inequality dictates that you cannot recover lost information from a degraded signal. The CCTV and protest footage from 2010 is heavily compressed, low-resolution, and chaotic. Applying modern generative AI to a 15-pixel blur doesn’t “clean up” the image to reveal the true face of the perpetrator. it simply instructs the neural network to hallucinate a statistically plausible face based on its training distribution.
Furthermore, attempting to establish identity matches based on clothing or body silhouette from 16-year-old footage of a riot completely ignores both base-rate fallacies and intra-class variability.
Using algorithmic interpolations and statistical guesses to secure arrest warrants a decade and a half later—especially against the backdrop of an upcoming election cycle—is a dangerous biometric overreach. It sets a terrible precedent where the synthetic “hallucinations” of a machine learning model are presented to courts and juries as hard, indisputable forensic evidence.
Clive Robinson • July 11, 2026 5:38 AM
@ lurker, ALL,
With regards,
“If you sup with the devil …”
I would not believe very much of it.
I suspect the real reason Apple is doing what it is doing is trying to keep a competitor out of the market by lengthy litigation (an up and coming practice).
I’ve seen it before and an employer in the past tried it on with me.
Because of a lack of trust I used to “Blind Carbon Copy”(BCC) everything to my home server that I had back then.
Also I would Email to and from home things I was “working on”.
Engineers as such tend to work best in short bursts of serious “mind work” an hour here or an hour there all through the day.
I also had a food issue… Eating wheat based products acted like a slow “micky finn” not fast like chloral hydrate but slow like taking some types of sleeping tablet. Taking about a couple of hours to KO me so I was not much use as anything other than a zombie post lunch. I was tested repeatedly for celiacs but it always came up inconclusive. So I felt guilty about not being able to work in the afternoon so worked in the evening / night.
Way back then they concluded it was probably something to do with “sleep apnea” and Migraine issues… which has in later life become like a “Cluster ‘suicide’ headache” of indescribable head crushing like pain). Effecting the side of the face near the ear spreading up into the temples and causing significant visual issues. I’ve recently been informed that the wheat issues and headaches are likely to be related…
So no bacon and egg sarnies any longer or Singapore Noodles either 🙁
oh haha. i wanted to thank gchq for doing a “once over” with qatar-1.
MUCH appreciated.
lurker • July 11, 2026 2:50 PM
@ResearcherZero
Elsewhere on this blog it has been shown that guardrails are mathematically impossible; and regulations become unenforceable when they meet jurisprudence.
Rontea • July 11, 2026 3:37 PM
@ResearcherZero
In a world where the paper trail withers, the soul of a nation begins to vanish. What is a civilization if not the memory of its deeds, written and preserved for the judgment of posterity? The destruction of archives is the amputation of memory; it is the state’s triumph over the citizen, as the individual wanders through shadows without proof of his own existence.
When a government hoards knowledge for itself while closing the doors of its libraries, it declares that truth has become a private property of power. In such times, the man of faith and conscience must ask: what is freedom without the means to defend it? A society without archives is like a man without a spine—easily bent, easily broken. The silence of lost documents will echo longer than the voice of any tyrant.
lurker • July 12, 2026 1:37 AM
European digital ID wallets are a gift to Google and Apple
“European governments are rolling out digital identity wallets, which are to be used by citizens to access services, and to verify their age online. … there is a serious problem with this: these wallets rely on safety services of Google and Apple. These are known as Google Play Integrity API, and Apple’s Managed Device Attestation”
https://waag.org/en/article/european-digital-id-wallets-are-gift-google-and-apple/
lurker • July 12, 2026 1:47 AM
Google’s New Remote Attestation Scheme is As Bad As Its Old One
“Long before “agentic AI,” we had the idea that software would act as your agent on the internet. That’s why the old-fashioned technical term for a browser is a “user agent.” Your browser acts on your behalf to retrieve information and then show it to you, in the format you choose. It’s your agent.
…
“For years, Google thrived on the open web, and built open technologies. Android—the mobile operating system that Google bought in 2005 —was presented as an “open” alternative to existing mobile offerings, and as the mobile market collapsed into two companies—Google and Apple—Google always presented Android as the open alternative to Apple’s “walled garden.” But there were always ways in which Google’s “open” Android wasn’t exactly open. The company engaged in illegal “tying” arrangements that forced hardware vendors and carriers to lock out versions of Android that were created by Google’s competitors.
by Cory Doctorow”
Clive Robinson • July 15, 2026 2:20 AM
@ Bruce, ALL,
A couple of news items from the UK’s “The Register”,
Australia demands AI companies must produce more energy than they consume, stop ‘theft’ of content
PM frames sweeping new regulations as the equivalent of labour movement touchstones like winning a minimum wage
“Australian Prime Minister Anthony Albanese has delivered a landmark speech outlining the nation’s AI policy, which will require datacenter builders to contribute more energy than they consume and mean AI companies must reach agreements with local artists and media before using their content.
“Let me make this crystal clear – not everything produced in Australia is up for grabs,” Albanese said, a reference to both content and the nation’s energy and water resources.
The PM said Australia will therefore legislate to require builders of large new datacenters to become net generators of energy, rather than consumers, by funding electricity generation projects to meet their needs and pay for associated work to bolster energy grids.
The policy also requires datacenter operators to pay for water infrastructure and make minimal environmental impacts.
“
It sounds not just good but sensible, however it’s not of sufficient legal clout… Lets see how far it gets before it gets shredded by UKAUS or trade talks.
Patchpocalypse Now: Microsoft tops last month’s record with 622 Patch Tuesday CVEs
Remember when last month’s 206 CVEs seemed eye-watering? Yeah, those were the days
“
securityPatchpocalypse Now: Microsoft tops last month’s record with 622 Patch Tuesday CVEs
Remember when last month’s 206 CVEs seemed eye-watering? Yeah, those were the daysBrandon Vigliarolo
GOVERNMENT AND IT NEWS REPORTER
4
Tue 14 Jul 2026 // 20:49 UTC
Remember last month when we were awed by Microsoft’s record-setting Patch Tuesday that addressed 206 CVEs? That was a quaint era compared to this month: Redmond just rolled out patches for 622 CVEs specific to its products, slightly more than tripling last month’s all-time high.Redmond’s Patch Tuesday release is once again one for the record books, with everything under the sun getting some security fixes – including 428 non-Microsoft Chromium CVEs affecting Edge that aren’t included in that 622 count. Fifty-eight of those are critical, two are under active exploit, and one has already been publicly disclosed, meaning it could join those other two in short order.“
I remember a time when Microsoft did not have “patches” at all… Oh how the dog has been dragged through the mire since. And justifiably got a very very bad reputation.
Looks like you can not teach an old dawg new ways to behave.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
lurker • July 11, 2026 12:18 AM
If you sup with the devil …
It seems Apple didn’t have a long enough spoon
https://www.bbc.com/news/articles/cy8w379e091o