rydonahue

AI industry hype beasts are spreading one of the craziest narratives I've ever seen. It goes a little something like this... "You don't need open source libraries anymore. Large Language Models can generate the code you need on demand. Why carry the risk of third-party dependencies when you can just synthesize the functionality yourself? Why expose your software supply chain to vulnerabilities in projects like XZ Utils or Firefox when a model can write you something bespoke in seconds?" This argument is being floated implicitly and explicitly by the same companies charging you per token to generate that replacement code. Who would've thought? It's also one of the most intellectually dishonest positions in modern software engineering.  However, the argument does resonate with some as software supply chain attacks have genuinely gotten worse. The XZ Utils backdoor discovered in March 2024 (CVE-2024-3094) is the canonical recent example. A likely state sponsore...

Every few years, someone in a conference hallway or a podcast studio declares with great confidence that this is the year of the Linux desktop. It never is, of course, and the phrase has become a kind of inside joke for people who have been around long enough to appreciate the humor in perpetual woulda, coulda, shoulda. IPv6 has had a similar quality to it and I recently joked about it in an interview( Automate or Die Trying ). Those of us who work in this space have been waving our arms about it for the better part of a decade, predicting that organizations would eventually be burned by the protocol they deployed but never fully considered. And every year, the industry nods politely and returns to its regularly scheduled IPv4 firewall tuning. Google has now recorded that IPv6 traffic has reached parity with IPv4, crossing the 50% mark globally( Tom's Hardwar e) , a milestone that has been in slow motion since 1998 when the protocol was first standardized. As of April 2026, countr...

 

Preface This article was inspired by recent investigative reporting of  Brian Krebs , whose December 2025 analysis, Most Parked Domains Now Serving Malicious Content , synthesizes empirical research demonstrating a decisive shift in how parked and typo-derived domains are used in practice. That work, drawing on large-scale measurements by Infoblox researchers, establishes that domain parking is historically a low-risk monetization practice which has become a dominant vector for malware delivery, scams, and traffic laundering. This article extends that finding by placing it within a broader technical, economic, and defensive framework, with the goal of informing both operational security teams and policy-oriented stakeholders. Abstract Typographical squatting (typosquatting) is a long-standing abuse of the Domain Name System (DNS) in which adversaries register domains that are visually or syntactically similar to legitimate ones in order to exploit human error. While traditionall...

If you ask most enterprise technology leaders whether their public website is protected from SQL injection, you will usually get a confident answer. There may be references to penetration tests, annual audits, secure development initiatives, or a recently purchased web application firewall. Public systems attract scrutiny because they are visible. They are tied to brand reputation, customer trust, and executive attention. The same confidence tends to disappear when the conversation shifts to the inventory portal used by operations, the vendor dashboard built five years ago, or the internal reporting tool maintained by whoever inherited it after a reorganization. That is where many organizations misunderstand their actual exposure. The most dangerous vulnerable applications are often not the ones on the homepage. They are the ones nobody remembers to review. SQL injection remains one of the most persistent software flaws because it emerges from habits that feel productive in the momen...

  The Problem with Blind Bastion Hosts Run SSH bastion hosts long enough and you'll start asking uncomfortable questions. Who's connected right now? What certificate are they using? Did someone just attempt a brute force from that sketchy IP range? How many sessions does that contractor have open? Traditional SSH logging wasn't built to answer these questions. You get disconnected log events scattered across auth.log. You grep through files trying to correlate usernames with source IPs. You have no real-time view of what's actually happening on your infrastructure right now. Sure, you can piece together a timeline after an incident, but that's cold comfort when you're trying to detect an ongoing attack. SSHadow changes this by giving you a live feed of SSH connections with full authentication context. This is not a replacement for traditional logging. This is a real-time intelligence layer that makes sense of what's happening as it happens. What SSHadow Does...