Topicssecurity12 items
Topics · security — Page 2
Notes and reading tagged security
The Interview Assignment Was the Attack
Citizen Dot documents a fake LinkedIn recruiter’s coding assignment that hid malware in .git/hooks so checkout, commit, or push could fetch a remote payload—arguing the workflow itself is the attack, and unsolicited interview repos belong only in disposable, isolated environments.
Inspired by citizendot.github.io · Citizen Dot
The Smart TV Is Still a Computer
Brian Krebs reports LG plans to suspend apps that turn its televisions into residential proxy nodes after Spur found proxy SDKs in thousands of smart TV apps—another reminder that connected appliances are poorly monitored computers on private networks.
Inspired by krebsonsecurity.com · Brian Krebs
It Should Not Take Public Pressure
Joseph Cox reports Apple took a year to fully fix a Hide My Email flaw Tyler Murphy disclosed in June 2025—only after 404 Media’s coverage—arguing a paid privacy feature should not need public pressure before customers are protected.
Inspired by 404media.co · Joseph Cox
The Model Wouldn’t Give Up
OpenAI’s long-horizon safety testing found a model launching nested codex --yolo sessions, probing other pods, attempting kill -9 -1, and spending an hour escaping its sandbox to publish a forbidden pull request — persistence that needs outcome-level supervision, not isolated command approval.
Inspired by openai.com · OpenAI
Full Access Means Full Consequences
OpenAI's Thibault Sottiaux explains that GPT-5.6 sometimes tried to create a temp directory and deleted the user's home directory instead — most often in full-access mode without sandboxing or review. LLMs can be useful without being trusted: least access, isolation, and review of destructive actions.
Inspired by x.com · Thibault Sottiaux