The biggest target takes the most hits

from here and here

Apparently Chrome has more than twice as many vulns this year as the next leading browser. I know more vulnerabilities doesn't necessarily mean Chrome is less secure than it's competitors. It has the most market share so it gets the most attention from people trying to find vulnerabilities. However, while that doesn't make it less secure, it does make it less safe. More attention from attackers (successful attention at that it appears) means that users of the software face more attacks than users of the alternative browser - and that has been the rationale behind using alternative software for a long time. If you're using something that has a smaller target on it's back, you're less likely to fall victim.

A Facebook Challenger Appears

from here and here

It's hard to believe anyone could give Facebook a run for their money, but it sounds like Oracle is doing just that. Not in the context of social networking, however, but rather in the context of global surveillance.

It's difficult to imagine why Oracle would be interested in my political views and physical location, but I suppose those are details an authoritarian regime could use about it's citizens. 

Tick Tock, Microsoft

from here and here

While I realize it can be tough when all supported versions of Windows are affected, I would still expect Microsoft to move a little faster to deal with a zero-day that's actively being exploited.

Like a clown car of spies

from here

Honestly, I thought there were too many when I only knew about two of them. Then I got curious and found four more. That's a lot of spying for such a small place.

When "it just works" backfires

from here

Some things aren't supposed to just work. Some things aren't supposed to work at all, like web pages reading content from a different origin. Now, as a software developer, I know bugs happen to everyone, but 4 months and counting for a vulnerability that your users can't mitigate is beyond the pale.

Cream got creamed

from here

How Cream Finance manages to remain in business after so many loses is beyond me, but it certainly calls into question the judgement of their users.

Privacy should be worth more than pocket change

from here

I used Google+. In fact, I kind of liked the way it did certain things. I definitely don't like them paying out a mere $2.15 per person for miserably failing to protect user's privacy, and opting instead to protect themselves by keeping it all secret. 

Bro, do you even take the protection of your customers seriously?

from here

If T-Mobile has really had 6 breaches in recent years, then their claims that they take the protection of their customers very seriously are nothing more than sweet, sweet words that turn to bitter orange wax in my ears.

So much for "private"

from here

Sometimes I wonder if big tech companies even know the meaning of the word "private". It certainly doesn't seem like Amazon does. With that number of people it's basically impossible to enforce limits on how the data is used (or misused) which in turn means there's no accountability.

$50,000,000 per lead

from here

I'm pretty sure if you show Trump the cost benefit analysis of $100 million for 2 leads he'd kill that program in a heartbeat. He may not be the sharpest knife in the drawer, but he knows the value of not paying for things.

Who needs the news when you can read privacy policies?

from here

577 companies is a ludicrous number of companies to share data with, and basically impossible for end users to manage. It's basically DDoSing their ability to formulate informed consent. Did the framers of the GDPR consider their goals could be subverted through brute force?

But hopefully not for much longer

from here

Imagine an online scam involving 80 people. It's huge!

ZIP files and BAT files and DLLs - Oh my!

from here

I understand that technical jargon can be tough sometimes because it doesn't mean anything unless you're steeped in the technical minutia of the field in question - but fileless malware is just bad jargon.

A layperson looks at the word and then looks at what the word is being used to describe, and you know what they'll think? They'll think "No. This can't be the right word. There must be some mistake. That's not what this word means." This isn't a problem of the word being abstract, it's a problem of the word being too basic and too well defined outside of the field, and that definition contradicting how it's used inside the field.

Somebody came up with this term (turd), and they did a bad job. I understand that there may be a need for a word to encode the concept, but this is not that word, you need to go back to the drawing board.

Who wants to be a millionaire?

from here

The second payout in a week and the total is already over $1,000,000. This might be an opportune time for people with backup solutions to start talking to cities in Florida - they're all probably being targeted now, and it would be better to pay a legitimate backup provider than to pay criminals.

The government must love them

from here

While this article suggests that Cisco's patching of it's 7th back door in a year is a good thing, I can't help but suspect there are still more. Normally you think of backdoors as being a rare occurrence, but Cisco has clearly deviated from that norm and it makes me think that their backdoors are like rats - if you see 1, there are 20 more you don't know about.

Vesselin Bontchev comically observed that if your house had 7 backdoors there wouldn't be room for walls.

Someone better be patching my ISP

from here

Listen, I know mistakes happen sometimes, but 5 backdoors in 5 months? That stretches the limits of credulity just a bit.

It seems like such a miner thing

from here

Just one of the unintended consequences of the crypto-currency craze that's been going on for the past few years. I feel sorry for the gamers who have to pay higher prices for graphics cards because of the high demand from crypto-currency miners who want to repurpose the cards for mining.

So much for isolation

from here

Whether it's an application sandboxing tool or a virtual machine or some other box meant to contain the crud a system collects while in use, if you're running too many things in the same sandbox then the isolation a sandbox provides will do you no good because everything of interest will on the inside where the nasties are instead of on the outside.

The strength and weakness of password managers

from here

Password managers can help alleviate this problem, except where the password manager's own password is concerned.

Right Store, Right Price, But Wrong Password Policy

from here

Thanks to Tim V for drawing attention to Kroger's ridiculous password policy. Hopefully we can draw some more until they fix their shit.