# securities (blogs) — RSS Amplifier Recent posts from the 1329 feeds in the RSS Amplifier directory that cover securities. Page: Feed: --- ## [Part XII & Conclusion — What you can price and what you can’t](https://www.securesql.info/2026/09/01/beyond-verifiable-conclusion/) _2026-09-01 · John W8MEJ Menerick · John Menerick | Security Engineer_ Four of this season's tensions are not trade-offs. In each, the beneficial property and the security exposure are one property under two descriptions. You cannot engineer those away. You can only know, for each increment, what it simultaneously grants. ## [Part X — The assurance ledger](https://www.securesql.info/2026/08/29/beyond-verifiable-cryptoquality-goes-down/) _2026-08-29 · John W8MEJ Menerick · John Menerick | Security Engineer_ The practical security of a cryptographic primitive is not a theorem. It is a function of accumulated public expert-years of failed cryptanalysis. That makes it a quantity — and unlike a theorem, a quantity can go down. ## [Part IX — Long dwell](https://www.securesql.info/2026/08/28/beyond-verifiable-long-dwell-time/) _2026-08-28 · John W8MEJ Menerick · John Menerick | Security Engineer_ Your organization can correlate cause and effect over some interval. Past that interval, log rotation, platform migration, and staff turnover destroy the forensic state — and your own operational hygiene finishes the job the adversary started. ## [Part VIII — The explanation layer is the attack surface](https://www.securesql.info/2026/08/27/beyond-verifiable-chain-of-thought-rewritten-summary/) _2026-08-27 · John W8MEJ Menerick · John Menerick | Security Engineer_ Human oversight depends on a reviewer knowing when they do not understand. Fluent explanation produces the feeling of understanding. That control can be disabled silently, and the failure leaves a perfect paper trail indicating success. ## [Part VII — Your four controls are one control](https://www.securesql.info/2026/08/26/beyond-verifiable-four-controls-are-one/) _2026-08-26 · John W8MEJ Menerick · John Menerick | Security Engineer_ Nuclear safety engineering has been quantifying common-cause failure since the 1970s. If your classifier, judge, monitor and reviewer share a base model, that literature already has a number for what you actually have — and it is not four. ## [Part VI — The certificate that means nothing](https://www.securesql.info/2026/08/25/beyond-verifiable-verification-moves-risk/) _2026-08-25 · John W8MEJ Menerick · John Menerick | Security Engineer_ Verification transfers residual risk onto the least-defended artifact in the pipeline: the specification. Hardware verification has had detection for the classic failure mode since the late nineties. Almost nobody runs it, and almost nobody outside that community has heard of it. ## [Part V — Root over the logical namespace](https://www.securesql.info/2026/08/24/beyond-verifiable-root-logical-namespace/) _2026-08-24 · John W8MEJ Menerick · John Menerick | Security Engineer_ An optimizer rewarded on theorem yield has a strategy that makes every subsequent theorem provable, passes every kernel check, and presents as a spectacular productivity improvement. Consistency is undecidable. Axiom-set change is trivially decidable. That gap is the whole defense. ## [Part IV — Your benchmark is a build dependency](https://www.securesql.info/2026/08/23/beyond-verifiable-build-dependency-benchmark/) _2026-08-23 · John W8MEJ Menerick · John Menerick | Security Engineer_ Under verifiable-reward training the evaluation artifact and the training environment are the same object. That makes a benchmark a build dependency — and the artifacts that shape model behaviour have a weaker security posture than the packages that merely run it. ## [★ CodeBurn](https://perrotta.dev/2026/08/codeburn/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ Previously . CodeBurn shows Gen AI / LLM code usage: where did all the money burning tokens ($$) go? CodeBurn is a free, open-source, local-first tool that tracks AI coding token usage and cost across 41 tools and agents (Claude Code, Pi, Codex, Cursor, and more), broken down by model, project, and task. It reads the session files already on disk. No wrapper, proxy, or API key is needed, and… ## [prometheus: a 117GB WAL that could not truncate](https://perrotta.dev/2026/08/prometheus-a-117gb-wal-that-could-not-truncate/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ Previously . With the volume expanded, the next failure surfaced. The pod came up, served for 14 minutes, then hit a different wall: % kubectl -n monitoring get pod prometheus-...-prometheus-0 -o json | \\ jq '.status.containerStatuses\[\] | select(.name=="prometheus") | .lastState.terminated' { "reason": "OOMKilled", "exitCode": 137, "startedAt": "2026-08-22T20:35:12Z", "finishedAt":… ## [AI QA That Opens Fix PRs (Sponsored)](https://crawlproof.com/a/q5N7BmCdX1hK) _2026-08-22 · **Sponsored**_ Runs browser QA, files issues with repro evidence, and opens fix PRs. ## [Quoting Linus Torvalds](https://simonwillison.net/2026/Aug/22/linus-torvalds/) _2026-08-22 · Simon Willison's Weblog_ And this was a debug session from hell, enormously helped by an AI doing much of the grunt-work. I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it. I suspect those things have been trained by people who may not be quite as stubborn as I am. But while the AI was ready to give up… ## [azure disk: resize needs the PVC patch too](https://perrotta.dev/2026/08/azure-disk-resize-needs-the-pvc-patch-too/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ Problem statement : a Prometheus pod crash-looped on a full 128GiB volume. I resized the Azure-managed disk to 256Gi in the Azure Portal (ClickOps) to no avail. The disk really was bigger: % az disk show -g my-cluster-k8s-nodes \\ -n pvc-86ac2c66-fb67-43c3-84b0-7209f3a23bd3 -o json | \\ jq '{diskSizeGB, diskState, provisioningState}' { "diskSizeGB": 256, "diskState": "Attached",… ## [llm 0.33](https://simonwillison.net/2026/Aug/22/llm/) _2026-08-22 · Simon Willison's Weblog_ Release: llm 0.33 My highlights from this release: Upgraded to the OpenAI Python library 3.x and switched the HTTP client dependency from httpx to httpx2 . #1608 , #1631 I shipped a quick 0.32.1 fix for this yesterday, but this is the more comprehensive fix. llm embed and llm embed-multi now accept --key . The Python EmbeddingModel.embed() , EmbeddingModel.embed\_multi() , Collection.embed() and… ## [ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries](https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html) _2026-08-22 · Pierluigi Paganini · Security Affairs_ ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions \[…\] ## [More than just code review](https://simonwillison.net/2026/Aug/22/more-than-just-code-review/) _2026-08-22 · Simon Willison's Weblog_ The key skill required to make productive use of coding agents is being able to confidently instruct them on how to make changes and then confidently verify that those changes have been applied in the correct way. Sometimes this involves reviewing every line of code they have written, but there are other ways to achieve that goal. Eyeballing every line of code has never been the most effective way… ## [If you're not using AI to attack your own systems, your adversaries will](https://www.theregister.com/security/2026/08/22/if-youre-not-using-ai-to-attack-your-own-systems-your-adversaries-will/5291346) _2026-08-22 · www.theregister.com - Articles_ Agents are also the new attack surface - cue defenders' existential angst ## [AI slop is good for business if you know what you're doing](https://www.theregister.com/ai-and-ml/2026/08/22/ai-slop-is-good-for-business-if-you-know-what-youre-doing/5291382) _2026-08-22 · www.theregister.com - Articles_ Your irresponsibility is someone else's opportunity ## [Starlink Stories: How 7 Extreme Users Are Bringing the Internet to the Ends of the Earth](https://uk.pcmag.com/networking/166858/starlink-stories-how-7-extreme-users-are-bringing-the-internet-to-the-ends-of-the-earth) _2026-08-22 · Brian Westover · PCMag UK networking_ From the eye of a 190-mph tornado to the middle of the Indian Ocean, these innovators are using SpaceX's satellite broadband to make the impossible a reality. On June 20, 2025, near Enderlin, North Dakota, veteran storm chaser Reed Timmer was tracking a severe supercell, streaming real-time video via Starlink from Dominator 3 , a Ford F-350 that he and his team have converted into a six-ton,… ## [anki: migrate English notes to TTS note types](https://perrotta.dev/2026/08/anki-migrate-english-notes-to-tts-note-types/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ Previously . Problem statement : migrate my English 🇬🇧 deck to dedicated note types with British English text-to-speech, without adding reverse cards. I created English Language Card 🇬🇧 with four fields ( Front , Front Example , Back , and Striked ) and only one card template: {{Front}} {{tts en\_GB:Front}} {{#Front Example}} \ \{{Front Example}}\ {{tts en\_GB:Front Example}} {{/Front… ## [Paintings of the English Channel coast 1](https://eclecticlight.co/2026/08/22/paintings-of-the-english-channel-coast-1/) _2026-08-22 · hoakley · The Eclectic Light Company_ A journey along the Channel coast from Land's End in the far west, reaching the Isle of Wight, with Clarkson Stanfield, Thomas Girtin, John Brett, Paul Nash, JMW Turner and others. ## [Trade Bitcoin & Ethereum (Sponsored)](https://crawlproof.com/a/qZ0u5pvex2dv) _2026-08-22 · **Sponsored**_ Buy, sell and margin trade BTC & ETH with fiat currencies ## [hugo: tag-based post connections](https://perrotta.dev/2026/08/hugo-tag-based-post-connections/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ Previously . Problem statement : post connections showed only direct links, while posts with the same tags remained disconnected in the graph of this blog. I added a second kind of edge. The pre-computation picks up to two posts with the most shared tags , breaks ties by date, and excludes direct links: def compute\_tag\_related\_posts( post: dict, all\_posts: list\[dict\], outlinks\_set: set\[str\],… ## [LLM: Devise a plan](https://perrotta.dev/2026/08/llm-devise-a-plan/) _2026-08-22 · serendipity@perrotta.dev (Thiago Perrotta) · ¬ just serendipity 🍀_ ♠ There's no need for plan mode . Sandboxing + prompt engineering is enough. End your prompt with Devise a plan …and let the 2026 Gen AI models flow by themselves. Here'a a sample session: User : some of my blog posts e.g. https://perrotta.dev/2026/07/anki-archive-a-deck/ have "connections" this is great, but it includes \_only\_ direct links I wanted to expand connections to include a couple of… ## [4 Crucial Steps To Evaluating Risk In Your Post-Military Career](https://rosecoveredglasses.wordpress.com/2026/08/22/4-crucial-steps-to-evaluating-risk-in-your-post-military-career/) _2026-08-22 · rosecoveredglasses · ROSE COVERED GLASSES_ “MILITARY.COM” –By Lida Citroen “Growing your career in the private sector is all about weighing the pros and cons of every opportunity you’ll encounter. There are some ways to anticipate and understand risk and how it can serve you.” \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ “You raised your hand. You served your country. You made the… ## [Buy the plumbing, vibe the rest](https://timbenniks.dev/writing/buy-the-plumbing-vibe-the-rest) _2026-08-22 · Tim Benniks · Tim Benniks_ AI makes it tempting to cancel SaaS tools and prompt your own internal platforms into existence, but that often creates brittle systems that are “a mile wide and an inch deep.” Performance, security, and edge cases quickly become serious problems, and suddenly your team is doing database administration and security engineering instead of solving business problems. A better pattern is to buy… ## [Skylab completists, clear some shelf space for 26 DVDs](https://www.theregister.com/offbeat/2026/08/22/skylab-completists-clear-some-shelf-space-for-26-dvds/5290531) _2026-08-22 · www.theregister.com - Articles_ Decades of archive hunting recover downlinks, silent reels, and footage once thought lost ## [Malware Hijacks Android Car Head Units](https://securityaffairs.com/197700/hacking/malware-hijacks-android-car-head-units.html) _2026-08-22 · Pierluigi Paganini · Security Affairs_ Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as \[…\] ## [Casio decides it's about time the simple digital watch got a little smarter](https://www.theregister.com/personal-tech/2026/08/22/casio-decides-its-about-time-the-simple-digital-watch-got-a-little-smarter/5291223) _2026-08-22 · www.theregister.com - Articles_ F-B100W adds Bluetooth and step tracking while keeping a two-year battery ## [Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution](https://securityaffairs.com/197689/hacking/critical-flaw-in-nasa-jpl-open-source-spacecraft-command-software.html) _2026-08-22 · Pierluigi Paganini · Security Affairs_ A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s \[…\] ## [Why AIoT devices are learning to choose their own network connections](https://www.iotinsider.com/iot-insights/why-aiot-devices-are-learning-to-choose-their-own-network-connections/) _2026-08-22 · April Miller · IOT Insider_ The Internet of Things (IoT) has traditionally depended on a simple model — devices connect to an available network, transmit data and wait for instructions or analysis. The artificial intelligence of things (AIoT) is changing that model. By combining AI with IoT infrastructure, AIoT devices can analyse data, recognise patterns and make decisions with less… ## [Saturday Mac riddles 374](https://eclecticlight.co/2026/08/22/saturday-mac-riddles-374/) _2026-08-22 · hoakley · The Eclectic Light Company_ Here are this weekend’s Mac riddles to entertain you through family time, shopping and recreation. 1: Five flavours, \[…\] ## [Real SIMs for AI Agents (Sponsored)](https://crawlproof.com/a/QwHHF5rUd1By) _2026-08-22 · **Sponsored**_ Pass 2FA and verifications with real carrier numbers via our API. ## [Part III — The reward that points at the wall](https://www.securesql.info/2026/08/22/beyond-verifiable-gradient-field-bending-at-wall/) _2026-08-22 · John W8MEJ Menerick · John Menerick | Security Engineer_ Reward faster solutions. Penalize memory use. Both are standard, both are reasonable, and both create a gradient that points at the isolation boundary. Escape-adjacency is a static property of a reward specification, and it is checkable in an afternoon. ## [U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/197693/security/u-s-cisa-adds-zimbra-collaboration-suite-zcs-flaw-to-its-known-exploited-vulnerabilities-catalog.html) _2026-08-22 · Pierluigi Paganini · Security Affairs_ U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog. CERT Polska, Poland’s national computer emergency response team,… ## [Can DeltaFree help size your backup storage?](https://eclecticlight.co/2026/08/22/can-deltafree-help-size-your-backup-storage/) _2026-08-22 · hoakley · The Eclectic Light Company_ Nine days of measurements of used space on a Time Machine backup storage drive. What does DeltaFree predict for its lifetime? How does used space change in containers in the internal SSD? ## [Six trade secrets from the pros: The seat map that lies, the $15 fee you can kill and the $12 part that “fixes” a dead dryer.](https://www.komando.com/tips/money/six-trade-secrets-from-the-pros-the-seat-map-that-lies-the-15-fee-you-can-kill-and-the-12-part-that-fixes-a-dead-dryer/) _2026-08-22 · Kim Komando · Komando.com_ Round 2 of our most-loved format. The airline seat map is a sales floor, not an inventory list. The hotel’s 800 number can't help you, but the front desk can. Plus, the $15 modem rental fix, the $12 dryer trick, the help desk’s sacred order and the photographer's one-second habit. The post Six trade secrets from the pros: The seat map that lies, the $15 fee you can kill and the $12 part that… ## [📸 Developing patience](https://www.komando.com/news/devices/developing-patience/) _2026-08-22 · Katie Knauf · Komando.com_ The Godox C100 is a $45 camera with no screen and no instant playback, so you shoot, move on and find out later what you actually captured. It's basically a digital camera with the philosophy of a disposable one, and honestly it might be the cure for the 47-take family photo spiral. The post 📸 Developing patience appeared first on Komando.com . ## [Qwen-MM-Plugins core in Claude Code and Codex, PDF/video/STL with no API key](https://lilting.ch/en/articles/qwen-mm-plugins-core-claude-code-codex/) _2026-08-22 · lilting channel (English)_ 16GB M4 Mac mini test of QwenLM's Qwen-MM-Plugins core. Claude Code adds a plugin\_ prefix that breaks --allowedTools, codex exec rejects MCP calls by default. PDF, STL and video read with no API key. ## [How Z3 found the leap-year magic number 1073750999](https://lilting.ch/en/articles/leap-year-magic-number-z3/) _2026-08-22 · lilting channel (English)_ A three-instruction leap-year test hides the constants 1073750999, 3221352463, and 126976. I rebuilt an 18-bit version with Z3, then traced how the multiply, mask, and threshold encode divisibility by 4, 100, and 400. ## [Renumbered keys bring Anima-Base LoRAs back on 40-layer Anima-2.9B, 0/3 to 3/3](https://lilting.ch/en/articles/anima-2-9b-layer-expansion-lora-compat/) _2026-08-22 · lilting channel (English)_ Tested on M1 Max 64GB, ComfyUI v0.33.3. Anima-2.9B inserts 12 DiT blocks, so Anima-Base LoRA keys hit the wrong layers with zero warnings, 0/3. Renumbering the keys gives 3/3. ## [Blessed Are The Young](https://blog.trvth.org/2026/08/blessed-are-young.html) _2026-08-22 · Don Appleman · TRVTH_ Blessed are the young, for they shall inherit the national debt. -- Herbert Hoover (1874 - 1964), 31st president of the United States, address to the Nebraska Republican Conference, Lincoln, Nebraska (16 January 1936) ## [Slack puts coding agents in the shared room](https://self.md/signals/2026-08-22-shared-agent-rooms-owned-harnesses/) _2026-08-22 · Ray Svitla · Personal AI OS guides and tools on self.md_ self.md radar — 2026-08-22 Slack wants the agent work to happen where the argument is still alive. Two open-source projects are trying to make the harness, rather than the model brand, the thing you keep. And one builder of small personal apps left the important embarrassment in: the code worked, but ownership was still not settled. 1. Slack gives coding agents their own room Slack Code creates a… ## [Fabrik 4.7.2 for Joomla: A Long List of Security Fixes](https://mysites.guru/blog/fabrik-4-7-2-security-release/) _2026-08-22 · phil@mysites.guru (Phil Taylor) · mySites.guru Blog_ Fabrik 4.7.2 for Joomla closes a long list of unauthenticated vulnerabilities, most of them found and reported by mySites.guru. Here is the full list and what to do. ## [Five Security Issues in JEM (Joomla Event Manager), and No Stable Fix Yet](https://mysites.guru/blog/jem-joomla-event-manager-disclosure/) _2026-08-22 · phil@mysites.guru (Phil Taylor) · mySites.guru Blog_ mySites.guru found and reported multiple security issues in JEM (Joomla Event Manager), including an unauthenticated article overwrite. Five CVEs are assigned. There is no stable fix yet, so here is what to do. ## [AWS Security makes an inscrutable choice](https://www.theregister.com/security/2026/08/22/aws-security-makes-an-inscrutable-choice-corey-quinn/5291446) _2026-08-21 · www.theregister.com - Articles_ Quarantining leaked credentials is not good enough ## [Cloverleaf deal is latest example of Nvidia using its war chest to patch cracks in the AI bubble](https://www.theregister.com/systems/2026/08/22/cloverleaf-deal-is-latest-example-of-nvidia-using-its-war-chest-to-patch-cracks-in-the-ai-bubble/5291369) _2026-08-21 · www.theregister.com - Articles_ Nv's new chips need new datacenters, but you can't have bit barns without power ## [Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report says](https://www.theregister.com/saas/2026/08/21/salesforce-partners-not-seeing-meaningful-revenue-from-agentforce-ai-platform-report-says/5291167) _2026-08-21 · www.theregister.com - Articles_ Show us the money ## [Cop surveillance drones are going great](https://www.jwz.org/blog/2026/08/cop-surveillance-drones-are-going-great/) _2026-08-21 · jwz · jwz_ Handshake, not a drug deal: SFPD drone case falls apart: DA officials did not say whether they agreed with Helvestine's argument that the footage showed only a handshake. But the DA's office subsequently motioned to dismiss the case ahead of its preliminary hearing, records ## [AI companies are burning books, advocates complain to FTC](https://www.theregister.com/ai-and-ml/2026/08/21/ai-companies-are-burning-books-advocates-complain-to-ftc/5291299) _2026-08-21 · www.theregister.com - Articles_ Fahrenheit 203, the temperature GPUs stop gorging on literature ## [MacVoices #26238: Live! – Vision Pro Surgery, CarPlay on Boats, and Apple Intelligence in China](https://macvoices.com/macvoices-26238-live-vision-pro-surgery-carplay-on-boats-and-apple-intelligence-in-china/) _2026-08-21 · Chuck · MacVoices_ Apple Vision Pro’s measurable impact in surgery leads a discussion of spatial computing in medicine, including shorter procedures, surgeon ergonomics, patient benefits, and equipment costs. The panel also explores CarPlay on pontoon boats, Apple Maps versus Waze, another delay in Apple’s legal fight with Jon Prosser, and the difficult privacy compromises surrounding Siri and Apple Intelligence in… [Listen](http://traffic.libsyn.com/maclevelten/MV26238.mp3) ## [Turning a single work session into a reusable Skill with Microsoft's Skill Recorder](https://bartwullems.blogspot.com/2026/08/turning-single-work-session-into.html) _2026-08-21 · Bart Wullems · The art of simplicity_ In my effort to adopt an 'AI first' philosophy, I spend a lot of time automating my day-to-day activities and transforming them to skills. It's not the most exciting activity: I know exactly how to do a task, I've done it a dozen times by hand, but writing it down as a clean SKILL.md for an agent takes almost as long as just doing the task again. Microsoft created an open-source a tool that skips… ## [Huge RTCReporting Logs and Dropbox](https://mjtsai.com/blog/2026/08/21/huge-rtcreporting-logs-and-dropbox/) _2026-08-21 · Michael Tsai · Michael Tsai_ One of our Macs kept filling up its SSD even though there isn’t supposed to be anything more stored on it. Photos is set to optimize its storage, and Messages is set to only keep messages for a year. It should be pretty much in a steady state, but we kept getting alerts from Mail \[…\]