Notices tagged with security, page 18

In ads: Our apps mind their business. Not yours.

In court: Given Apple’s extensive privacy disclosures, no reasonable user would expect that their actions in Apple’s apps would be private from Apple.

#Privacy #Security #Cybersecurity #Apple #iPhone #InfoSec #dataprivacy

Pixelfed Urges Admins to Update After 9.9/10 CVE Reveal https://wedistribute.org/2024/02/pixelfed-cve/ #CVE, #Security, #Vulnerability

Apple Zero Day Sold To Government #Security #netsec #infosecurity #infosec #computersecurity #CyberSecurity #CyberSecurityAwareness #CybersecurityNews

This statement is from a court document submitted by Apple's lawyers regarding the App Store data privacy class action lawsuit:

"Given Apple’s extensive privacy disclosures, no reasonable user would expect that their actions in Apple’s apps would be private from Apple."

#Privacy #Security #Cybersecurity #Apple #iPhone #InfoSec #dataprivacy

🚨 Pixelfed admins: please update ASAP to v0.11.11

More information will be published on Feb 25 to give admins time to update.

https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf

#pixelfed #security #release

Apple Zero Day Sold To Government - https://podcast.lipanisecurity.com/e/apple-zero-day-sold-to-government/ #Security #netsec #infosecurity #infosec #computersecurity #CyberSecurity #CyberSecurityAwareness #CybersecurityNews

Dear friends of the #BSDCafe and the #Fediverse,
Bytedance is connecting to our server every few seconds. As I don't understand why and, more, I've already had problems with their rude behaviour, I've added this rule to nginx.conf:

# case sensitive matching
if ($http_user_agent ~ (Bytespider)) {
return 444;
}

# case insensitive matching
if ($http_user_agent ~* (bytespider)) {
return 444;
}

They should be out, at least for now.

#Privacy #Security #WebScraping #OnlinePrivacy #FediverseSecurity

BSI: Nationales IT-Lagezentrum soll Cybersicherheit "substanziell erhöhen"

Zehn BSI-Experten sollen die Cybersicherheitslage für Deutschland rund um die Uhr im Blick behalten. Die Polizei mahnt, föderale Doppelarbeit zu vermeiden.

https://www.heise.de/news/BSI-Nationales-IT-Lagezentrum-soll-Cybersicherheit-substanziell-erhoehen-9620799.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege

#BSI #Cybersecurity #Security #news

Still relevant: DWA's publication on the #safety and #security of #journalists.

▶️ What are the most promising strategies to support courageous journalists?
▶️ Where are the gaps in existing support mechanisms?
▶️ Who needs special attention, who has not been sufficiently taken into account so far?

Details and downloads (free PDF):
https://akademie.dw.com/en/safety-and-security-of-journalists-results-of-a-global-analysis/a-66850538

It was a very very long weekend preparing Yubikeys with pgp keys.

#yubikey #pgp #gpg #security #OpenPGP

TL:DR; I published a terraform library today to automatically configure AWS root user usage alarms. Link at the bottom.

Hey, do you have an AWS account? Even a little "lab" account to do some testing? If you do you, I hope you've taken some steps to make sure your root user is secure. Things like using a super difficult password, MFA, and then never actually using it.

I'm guessing you've done all that. Now take the next step and make sure you have alerting set up for any time that root user is used so just in case all your other protections fail, you at least know something is up.

"How does one even do that?" you ask? Well, it's kind of a PITA, you have to set up about 10 different things and make sure they're all connected correctly or it doesn't work.... or you can just use this handy terraform library I just published! Hopefully this can make your AWS experience just a little safer.

https://github.com/BenFromKC/AwsRootUserAlarm

#aws #cloud #security

GPG/PGP tip: When trust-signing company keys, either from another company key or a personal key, sign it so you trust the whole company, not just the individual key. To do this use tsign and select a depth of 2 with a domain restriction that matches the company's domain. This will cause you to automatically trust all employees of the company that are trusted by the company's master key and verified without you needing to set the trust individually or verify individual identities.

#GPG #PGP #Security

U.S. Senators release $118 billion #border security-foreign aid bill. $12 billion more than #Biden requested 4 months ago.

$60 billion in #military aid to #Ukraine, $14 billion to #Israel, and $20 billion for "border #security."

appropriations.senate.gov/imo/…

#Gaza #Genocide @palestine

#Sharkey's recent vulnerability and their handling of it is still miles better than #Lemmy's #XSS exploit which actually took down a big instance and is something even more elementary than what Sharkey experienced.

Like seriously, the first thing you do when #Markdown parsing is involved is to sanitize the hell out of it, both in the Markdown input and the HTML output. And you put up a strict #CSP for good measure. Lemmy spectacularly failed on both counts, despite existing as a project for years and a lot more instances (and therefore users, which rivals #Mastodon) using their software!

I can cut some slack for the Sharkey devs here because:

- they're relatively new (only months since the project started)
- it only affected note imports from #Twitter which is already niche enough
- it was easy to mitigate (just disable note import)
- it didn't affect single-user instances IIUC
- I haven't seen any Sharkey instance get actually exploited by this
- they're taking steps to make sure this shit doesn't happen again (haven't seen this from Lemmy yet, and last I checked their CSP is still shit)

So this is not worth blowing over in the #fediverse. Your assessment is exaggerated, this energy could've been spent somewhere else, and you owe the Sharkey devs an apology.

#fediversemeta #security

RE: https://meowcity.club/fedi/tetra/p/1706812792.496325

Canada a 'high-priority' target for Chinese interference, CSIS doc tells Hogue inquiry
⚠️
In its first phase, the inquiry is trying to define the limits of official secrecy

#News #Politics #Security #Canada
https://www.cbc.ca/news/politics/foreign-interference-inquiry-vigneault-cse-pco-1.7100577

"Mastodon: Diebstahl beliebiger Identitäten im föderierten Kurznachrichtendienst" 😬

Die Versionen 3.5.17, 4.0.13, 4.1.13 und 4.2.5 beheben die Sicherheitslücke. 👇

https://www.heise.de/news/Mastodon-Diebstahl-beliebiger-Identitaeten-im-foederierten-Kurznachrichtendienst-9615961.html

#mastodon #security #vulnerability #schwachstelle #sicherheit

I hope @SDF can update soon since it's a major security fix. https://mastodon.social/@MastodonEngineering/111856895554844910

#SDF #security

Es ist wieder soweit und wie jedes Jahr am 1. Februar wird von vielen Seiten dazu aufgerufen, die Passwörter zu ändern. Ich sage: Lasst es. Dieses ständige Passwortändern bringt keinen messbaren Sicherheitsgewinn. Das Problem liegt ganz woanders. 👇

https://www.kuketz-blog.de/passwort-wechseltag-lasst-es-einfach/

#passwort #sicherheit #security #passwortmanager #passwordmanager #keepass #keepassxc #keepassdx #password

I feel @lauren is spot on when parties from BOTH sides of the aisle are trying for the same goals: Censorship, police state, the end of anonymity, etc. https://mastodon.laurenweinstein.org/@lauren/111851647475164095

#KoSA #EARNITAct #censorship #surveillance #privacy #security

Verwirrend: Internet-Domain fritz.box zeigt NFT-Galerie statt Router-Verwaltung

Bereits vor einer Woche haben Unbekannte die Domain "fritz.box" für sich registriert. Ihr Vorhaben ist unklar, Fritz-Besitzer sollten sich vorsehen.

https://www.heise.de/news/Verwirrend-Internet-Domain-fritz-box-zeigt-NFT-Galerie-statt-Router-Verwaltung-9610149.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege

#AVM #Fritzbox #Security #news