diwangs
@diwangs.is
An overeducated keyboard presser CS PhD @ JHU • https://diwangs.is/
Just migrated my site to IPFS, and it turns out Cloudflare's restricted gateway has some undocumented caching gotchas. This short article is my attempt at documenting them and describes a janky workaround to bypass them entirely. Check it out! diwangs.is/blogging/about-cf-ipfs-cache/
The Hidden Cache in Cloudflare IPFS Gateway - Brainfarts
And how to make it play nice with its CDN edge cache
diwangs.is
Remote attestation is a heavily underdiscussed threat to computing freedom. People often mistakenly dismiss it with "I will run my own fork (of the OS or browser) / Magisk", not understanding that with hardware attestation, you're literally unable to 1/
GrapheneOS@grapheneos.org · 3mo agoApple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.
THE PEOPLE DO NOT YEARN FOR AUTOMATION
BEWARE SOFTWARE BRAIN
Software brain is changing the world, but most people still aren’t buying.
buff.ly
In which me and the gang found a prompt injection vulnerability in Gemini's GitHub Action. If you and your team used an LLM-based PR review tool, be careful!
The Register@theregister.com · 4mo agoAgents hooked into GitHub can steal creds – but Anthropic, Google, and Microsoft haven't warned users
The Sanitizer API landed in Firefox 148, along with element.setHTML(). This lets you fully configure how HTML strings are cleaned as they're parsed. hacks.mozilla.org/2026/02/good...
Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…
hacks.mozilla.org
New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html
Scientists, academics, researchers: We’re excited to share that @altmetric.com is now tracking mentions of your research on Bluesky! 🧪
Altmetric@altmetric.com · 2y agoThere are already many articles for which there is more attention on Bluesky than on other comparable micro-blogging sites, meaning the academic community and the general public have clearly adopted Bluesky as one of its core places to disseminate and discuss new research. A Place of Joy.
AI does what we teach it to do. Once you accept that, it becomes substantially easier to avoid doomsday scenarios.
The Tech Apocalypse Panic is Driven by AI Boosters, Military
There has been a tremendous amount of hand wringing and nervousness about how so-called artificial intelligence might end up destroying the world. The fretting has only gotten worse as a result of a
eff.org
Some things you can't do with cryptography alone. Encrypting securely to a low-entropy secret, like a PIN, is one. That's where secure elements or HSMs come in, enabling otherwise impossible user experiences. You're probably using one such system already. words.filippo.io/dispatches/s...
PINs for Cryptography with Hardware Secure Elements
Hardware secure elements make it possible to use low-entropy secrets like PINs for encryption.
words.filippo.io
