Lobster Roll

All Programming (General) 3774 Systems / Low-Level / OS 2950 Programming Languages / CS Theory 2127 Data / Databases / Infrastructure 1761 AI / Machine Learning 1524 Web Development 1308 Security / Privacy 1009 Culture / Philosophy / History / Reading 962 Productivity / Career / Business 731 Gaming / Retro Computing 538 Maker / DIY / Hardware 516 Design / UX / Visualization 491 Science / Math / Physics 428 Apple / macOS / iOS 355 Internet / Digital Culture 162 Health / Fitness / Lifestyle 14 Crypto / Blockchain 4

Security / Privacy

Screeps: How a game about programming exposed thousands of players to remote code execution (outsidetheasylum.blog)
39C3 - AI Agent, AI Spy (youtu.be)
Achieving a 0-CVE OS for VMs: The End of Traditional Patching (tuananh.net)
The Moral Character of Cryptographic Work (2015) (cs.ucdavis.edu)
Exploit Cursor Agents to create persistent, distributed threats (ike.io)
python_uaf: Use-after-free in Python (github.com)
remotely unlocking an encrypted hard disk with systemd initrd on Arch (jyn.dev)
An adversarial coding test (runjak.codes)
Secure Boot, TPM and Anti-Cheat Engines (andrewmoore.ca)
Anyone scanning published dependencies/packages with AI?
Apple's "Protect Mail Activity" Doesn't Work (grepular.com)
3 Counterproductive Communication Patterns Holding Back Security Researchers (discernibleinc.com)
TPM on Embedded Systems: Pitfalls and Caveats (sigma-star.at)
On the Coming Industrialisation of Exploit Generation with LLMs (sean.heelan.io)
VaultGemma: A differentially private LLM (2025) (arxiv.org)
Malware Peddlers Are Now Hijacking Snap Publisher Domains (blog.popey.com)
The Malloc Maleficarum (2005) (seclists.org)
L for the Price of One: On the Benefits of Using more than t+1 Parties in Threshold Signing (eprint.iacr.org)
6-day and IP Address Certificates are Generally Available (letsencrypt.org)
StackWarp Vulnerability (stackwarpattack.com)
A 0-click exploit chain for the Pixel 9, part 1: Decoding Dolby (projectzero.google)
TWC Security Party - Group education event for tech workers to improve their privacy and make friends - Jan 26, 17:30 ET (dev.techworkerscoalition.org)
Reverse engineering my cloud-connected e-scooter and finding the master key to unlock all scooters (blog.nns.ee)
I’m The Captain Now: Hijacking a global ocean supply chain network (eaton-works.com)
Claude Cowork Exfiltrates Files (promptarmor.com)
Sandboxing coding agents with bubblewrap (patrickmccanna.net)
Mitigating Denial-of-Service Vulnerability from Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users (nodejs.org)
Just the Browser (justthebrowser.com)
VoidLink: The Cloud-Native Malware Framework Weaponizing Linux Infrastructure (blog.checkpoint.com)
Anthropic invests $1.5 million in the Python Software Foundation and open source security (pyfound.blogspot.com)