#Security

VPNs are advertised as a cure-all for online privacy, but the reality is more nuanced. We explain what a VPN actually does, when it genuinely helps, when it does nothing, and how to choose one without falling for the marketing.

TPM 2.0 is the hardware requirement that left many older PCs unable to upgrade to Windows 11. We explain what a Trusted Platform Module actually does, why Microsoft mandates it, how to check whether your PC has one, and how to enable it in your BIOS.

Passkeys are replacing passwords across major apps and sites, but how do they actually work? We explain the FIDO2 cryptography behind them in plain English, why they are phishing-resistant, the difference between synced and device-bound passkeys, and what happens if you lose your phone.

OpenSSH 9.8 was released on July 1, 2024, fixing a critical race condition in sshd (regreSSHion) that could allow unauthenticated remote root code execution, splitting the server into separate binaries, and adding attacker penalties. Here is what changed.

On July 1, 2024, Qualys disclosed CVE-2024-6387, nicknamed regreSSHion, a signal-handler race condition in OpenSSH's sshd server that on glibc-based Linux could allow unauthenticated remote code execution as root. Here are the confirmed technical facts, affected versions, and remediation.

OpenSSH 9.6 was released on December 18, 2023 with security fixes, most notably a 'strict KEX' extension mitigating the Terrapin attack on the SSH transport protocol, and a countermeasure against command injection via shell metacharacters. Here is what changed.

Docker Scout reached general availability on October 4, 2023 at DockerCon, letting developers continuously evaluate container images against out-of-the-box software supply-chain policies with real-time insights and remediation. Here is what changed.

OpenSSH 9.5 was released on October 4, 2023. It added keystroke timing obfuscation to hide inter-keystroke timings, a new transport-level ping facility, and made ssh-keygen generate Ed25519 keys by default. Here is what changed.

On November 1, 2022, the OpenSSL project released OpenSSL 3.0.7 to fix CVE-2022-3602 and CVE-2022-3786, two buffer overflows in X.509 certificate verification. Pre-announced as critical, they were downgraded to high severity after further analysis. Here are the confirmed facts and remediation.

On December 10, 2021, the Apache Log4j vulnerability CVE-2021-44228, nicknamed Log4Shell, was publicly disclosed. The critical, CVSS 10.0 remote-code-execution flaw in Log4j 2's JNDI lookups affected a huge range of Java software. Here are the confirmed facts, affected versions, and remediation.