new23d

They should publish the precise weight of these things.

If the workload's network interface (ENI in AWS) is in a VPC that you manage, an outbound traffic filtering solution can prevent that. See AWS Network Firewall or the product we develop, DiscrimiNAT (https://chasersystems.com/), for example.

Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.

Three variations on subversive use of DNS by the Agent are documented in Hugging Face's technical writeup of the July 2026 security incident involving OpenAI models. In this article, I discuss what each of these three types of DNS workarounds achieve in practice, the constraints an actor might have faced to attempt a particular one, and additional benefits from choosing each.

Says Not Before: Thu, 09 Jul 2026 01:02:21 GMT ; Not After: Wed, 07 Oct 2026 01:02:20 GMT for me. Works fine, too.

netim.com has been reliable over the years for me

Our report seeks to answer some of our questions for seven of the most popular agentic code editors and plugins. By intercepting and analysing their network flows across a set of standardised tasks, we aim to gain insight into the behaviour, privacy implications, and telemetry patterns of these tools in real-world scenarios. Incidentally, a side-effect was running into OWASP LLM07:2025 System Prompt Leakage for three of the chosen coding agents. You can see the system prompts in the appendix.

Obfuscation via egress firewalls and evasive binary development with an iterative LLM agent.

Use AWS Route53?

Making a dynamic DNS client with aws and jq CLI, with a least-privilege IAM role and a SystemD service.

Exactly the same happened with me. Picking up the phone and responding to email (in weeks, not hours or days) didn't lower my bills. This sort of marketing is perhaps deflection.

We'll be working on that in the coming days. Thought the data at this point was a good start.

Some initial observations:

• Google's CRLs from the same intermediate CA (same public key) have different URLs and different content when pulled from different hosts (google.com, youtube.com).

• DigiCert has sharded according to 'assurance' class, algorithm, year and acquisition's name.

• Sectigo also has sharded according to 'assurance' class [1].

• GlobalSign has sharded by the yearly quarter presumably.

• HTTP Cache-Control maxage (or s-maxage), 'Expires' and 'Next Update' within the CRL file are not in sync.

• Some CAs other than Let's Encrypt also do not publish CRL URLs in the leaf certificates.

[1] https://www.sectigo.com/knowledge-base/detail/Sectigo-Interm...

We collected some data [1] on the viability of only CRLs as the future (phasing out OCSP) - motivated by Let's Encrypt's announcement today [2].

Data is on CRL availability, number of entries, expiry & refresh times, etc. from various x509 leaf server SSL certificates.

[1] https://news.ycombinator.com/item?id=41058138 [2] https://news.ycombinator.com/item?id=41046956

We collected some data on the viability of only CRLs as the future (phasing out OCSP) - motivated by Let's Encrypt's announcement today [1].

Data is on CRL availability, number of entries, expiry & refresh times, etc. from various x509 leaf server SSL certificates.

[1] https://news.ycombinator.com/item?id=41046956

TLS 1.3 and ESNI (now called Encrypted Client Hello - ECH) are separate standards, although you'll see ECH only enabled in bleeding edge stacks. In fact, ECH is still in IETF draft phase [1].

It can be disabled if an organisation wishes to. I wrote about how to do this in Chrome [2,3], and will write about Firefox when I get a chance.

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [2] https://chasersystems.com/blog/disabling-encrypted-clienthel... [3] https://news.ycombinator.com/item?id=37823262

Product appears to be an ID Tent from Evi-Paq. It has inches on the front 'leg' and cms on the rear.

https://forensicssource.com/collections/evidence-markers/pro...

Stay near a transport hub so you can connect with your prospects and customers regularly, by travelling. Working along side other founders in the B2B space would be extremely beneficial too.

Wait till they get to the part where it can be easily bypassed. I spoke about it [1] at the fwd:cloudsec conference [2] in July 2022. Others have raised concerns about discovery of these bypasses too [3].

[1] https://www.youtube.com/watch?v=DKSa32qWiRw [2] https://fwdcloudsec.org/ [3] https://canglad.com/blog/2023/aws-network-firewall-egress-fi...

This is the FlightRadar24 playback of the flight: https://www.flightradar24.com/data/flights/la800#34506b53

At time ~02:27, a dip in the altitude can be seen in the flight data chart.

No.

+1 for 14"

My interest in Framework is the DIY repairability. Not interested in modular upgrades but hot swappable ports on the side and should something need replacing, can be done in a relatively shorter and more predictable timespan than with ThinkPads and EliteBooks these days. Have had terrible experience with those in the last few years.

Sorry for the plug but DiscrimiNAT Firewall actively prevents ECH [1] from flowing through and cannot be bypassed with SNI forging either [2]. Also has a great 'discovery' mode and CLI tooling to figure out that allowlist on an on-going basis.

[1] https://chasersystems.com/blog/disabling-encrypted-clienthel... [2] https://chasersystems.com/discriminat/comparison/aws-network...

Google Chrome v117 turned on TLS Encrypted ClientHello by default (on 27 Sep?) This will impact the effectiveness and accuracy of outbound traffic filtering* - for those who've implemented it (regardless of vendor.) We've written a short blog post on disabling it with PowerShell, Windows Registry and Google Chrome UI for those who may need to roll this out ASAP and regain visibility. (Disclosure: we are a vendor of an outbound filtering solution and this has impacted our customers already.)

*for many websites, the domain name visibility during an HTTPS handshake will no longer be available to firewalls/proxies (unless they were terminating.)

Your comments are a reflection of life in Tower Hamlets, where PanP etc. are. London otherwise in the N, NE and SW parts has clean air with plenty of green spaces for kids.

As an end-user, not competing with HashiCorp, this change doesn't worry me. According to their FAQ [1]:

  10. What are the usage limitations for HashiCorp’s products under BSL?
  All non-production uses are permitted. All production uses are allowed other than hosting or embedding the software in an offering competitive with HashiCorp commercial products, hosted or self-managed.

  24. Can I host the HashiCorp products as a service internal to my organization?
  Yes. The terms of the BSL allow for all non-production and production usage, except for providing competitive offerings to third parties that embed or host our software. Hosting the products for your internal use of your organization is permitted.

[1] https://www.hashicorp.com/license-faq

Yep. But the replies are all about users wanting credits.

log4j 2.16.0 was released at 13 Dec 22:28 GMT with the following note [1]:

  Removed Message Lookups. This is a hardening related to changes made to prevent CVE-2021-44228. While this change is recommended, it is NOT required to fix CVE-2021-44228.

[1] https://lists.apache.org/thread/d6v4r6nosxysyq9rvnr779336yf0...

A relevant and a fascinating read is this recent paper by Barry M. O’Reilly titled The Machine in the Ghost: Autonomy, Hyperconnectivity, and Residual Causality [1].

> This article will examine the unnamed and potentially devastating constraining effect of software on human autonomy. I call this concept residual causality, where software design decisions made long ago in different circumstances for different reasons constrain human action in an unknown future. The less aware the designers of software systems are of complexity in social systems, the more likely they are to introduce residual causality."

[1] https://www.mdpi.com/2409-9287/6/4/81/htm

Key features in this release include:

1. TLS inspection: Azure Firewall Premium terminates outbound and east-west transport layer security (TLS) connections. Inbound TLS inspection is supported in conjunction with Azure Application Gateway allowing end-to-end encryption. Azure Firewall performs the required value-added security functions and re-encrypts the traffic which is sent to the original destination.

2. IDPS: Azure Firewall Premium provides signature-based intrusion detection and prevention system (IDPS) to allow rapid detection of attacks by looking for specific patterns, such as byte sequences in network traffic or known malicious instruction sequences used by malware.

3. Web categories: Allows administrators to filter outbound user access to the internet based on categories (for example, social networking, search engines, gambling, and so on), reducing the time spent on managing individual fully qualified domain names (FQDNs) and URLs. This capability is also available for Azure Firewall Standard based on FQDNs only.

4. URL filtering: Allow administrators to filter outbound access to specific URLs, not just FQDNs. This capability works for both plain text and encrypted traffic if TLS inspection is enabled.