The Hacker Always Wins

/The Bee's Knees 🐝

The headline picks from this issue. The full issue has more.

1. /01

   Lex interviews ThePrimeagen: Programming, AI, ADHD, Productivity, Addiction, and God

   Watch : Lex interviews ThePrimeagen: Programming, AI, ADHD, Productivity, Addiction, and God
2. /02

   How Tech Created the Online Fact-Checking Industry: Interviews with trust and safety workers at meta, tiktok, snapchat, google, and other tech companies reveal a broken system that collapsed under the weight of its own contradictions.

   Read : pick 2
3. /03

   A vulnerability in Next.js middleware allows bypassing authorization and other security measures by manipulating the x-middleware-subrequest header. This can lead to unauthorized access, CSP bypass, and potential DoS attacks via cache poisoning.

   Read : pick 3
4. /04

   SAML roulette: the hacker always wins

   This attack highlights how combining round-trip attacks with namespace confusion can lead to unauthenticated access to GitLab. The vulnerability stems from inconsistencies in how different XML parsers handle document validation, allowing an attacker to manipulate signature verification.

   Read : SAML roulette: the hacker always wins
5. /05

   CVE-2024-53991: Discourse Backup Disclosure: Rails send_file Quirk

   Rails' send_file method, when used with specific Nginx setups, can expose restricted files.

   Read : CVE-2024-53991: Discourse Backup Disclosure: Rails send_file Quirk