Britain to Make Salary Disclosure In Job Ads Mandatory
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
top(1) command on OpenBSD became quite a bit more useful. The commit adds a new -Q flag to show each process' use of the chroot(2), pledge(2) and unveil(2) facilities.
The commit message reads,
List: openbsd-cvs Subject: CVS: cvs.openbsd.org: src From: Klemens Nanni <kn () cvs ! openbsd ! org> Date: 2026-11-05 17:54:16 CVSROOT: /cvs Module name: src Changes by: kn@cvs.openbsd.org 2026/11/05 11:54:16 Modified files: usr.bin/top : display.c machine.c machine.h top.1 top.c Log message: add Q flag/key to show pledge/chroot/unveil usage
djm@) writes,
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability.
If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
This vulnerability does not exist on non-Linux systems, Linux/glibc systems and Linux systems that use PAM for password authentication.
We consider the root cause of this bug to be outside OpenSSH itself, but we're in a good position to deliver a mitigation quickly.
Now Ori has followed up with more evolved code that includes several important steps towards makin the new file system fit for general use. In a message to tech@, Ori writes:
List: openbsd-tech Subject: Re: GEFS on OpenBSD: A very early preview From: ori () eigenstate ! org Date: 2026-10-31 17:08:42 So, it's probably time for a few updates. First off, thanks to Martijn, and everyone else who tried it out and sent patches. Everything is updated and rebased, and the diff has been regenerated with all of the lastest.
ports@ mailing list, Thomas Frohwein (thfr@) leads in,
In what might the most surprising port proposal of the year, I'm proud to present a new port for wine.
talking not about the beverage, but the Windows Emulator that enables running binaries for that operating system on other systems.
Among the editors there is no one with enough recent Windows exposure to comment seriously on this, but we do vaguely remember that a port of this software existed back in the day.
So if this falls within the things you are interested in or actually need, we would encourage you to read the entire emulators/wine thread and the later supplement on new port: emulators/wine-extras: scripts for winetricks and wine-steam to keep up to date on developments.
Then, if you are able, please help the effort by testing the ports and reporting back.
Theo de Raadt (deraadt@) has
committed
to -current
a (WIP) new utility for updating system databases:
CVSROOT: /cvs Module name: src Changes by: deraadt@cvs.openbsd.org 2026/10/20 19:08:58 Added files: usr.sbin/dbupdate: Makefile dbupdate.8 dbupdate.sh Log message: initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. We can't do this nicely with syspatch(8) because it requires patches in sequence so a new tool had to be written. It is intentionally kept very simple so that it can be studied because we intend to run this in root cron, (the non-simple parts figure out quickly when not to update). looked at by sthen beck lucas dgl
The OpenBSD project has announced OpenBSD 8.0, its 61st release.
The new release contains a number of significant improvements, including but certainly not limited to:
OpenBSD/amd64 kernel virtual address space is now 512GB [See earlier report]amd64 and arm64 when available) to increase speed of swap encryption/decryption [See commit]OpenBSD/loongson hardware platform has been retired [See earlier report]getexecpath(3) added [See commit]drm(4) has been updated to Linux 6.18.53vmm(4)/vmd(8) improvements:syslogd(8) privileged and non-privileged parts now separate binaries [See earlier report]qwz(4) driver for Qualcomm Technologies WCN7850 wireless network devices added [See commit]httpd(8) and smtpd(8) are now randomly relinked at boot [See earlier report]httpd(8) has seen many improvements:relayd(8) has received several improvements:patterns(7) [See earlier report]rtrd(8), a RTR-To-Router protocol daemon, and its control program, rtrctl(8), were imported [See earlier report]acme-client(1) gained support for external account binding [See commit]rpki-client(8) [See earlier reports]tmux(1) gained support for floating panes [See commit]llvm/clang(1)/lld(1) updated to version 22.1.6 [See earlier report]In addition, this release offers a number of bug fixes and as well as numerous improvements in hardware support.
See the full changelog for more details of the changes made over this latest six month development cycle.
The
Installation Guide
details how to get the system up and running with a fresh install,
while those who already run earlier releases should follow the
Upgrade Guide,
in most cases using
sysupgrade(8).
Readers are encouraged to celebrate the new release by donating to the project to support further development of our favourite OS!
Version 0.130 of Game of Trees has been released (and the port updated).
Complete release notes are as follows:
This is fascinating:
The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.
It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one another.
[…]
It’s sound that’s relevant here, though, and specifically the sound of aeroplanes. Early in his video, Colsto brings up a map of the flights that were in the air at the time the video he’s tracing was recorded. Much of this information is publicly available. Aircraft equipped with Automatic Dependent Surveillance–Broadcast (ADS-B) transmit data about their position, velocity, and altitude, which flight-tracking services collect and make available to the public. While not every plane is tracked, the system provides an enormous amount of information about aircraft movements.
In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.
Here’s some demonstrations of this from Germany:
Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.
In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs. To our knowledge, none of these have been previously recorded. We share a selection of vulnerabilities below, and present potential exploits for each. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.
We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems. In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves.
Still in its early stages, but definitely something that’s coming.
A comment:
3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
Yes. It is a new world out there.
Neat video:
The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
This story is interesting:
One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.
Among the pre-installed bloatware—or spyware, if you’re being less charitable—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.
It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.
Researchers set up a fake start-up company to study fraudulent North Korean IT workers.
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”
Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
Interesting research:
TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.
- One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
- Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
- Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
- Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.
I would like more details on how the bias was removed.