There’s a new form of keyless car theft that works in under 2 minutes

 https://arstechnica.com/information-technology/2023/04/crooks-are-stealing-cars-using-previously-unknown-keyless-can-injection-attacks/

Scary stuff: clearly automotive networks need better security

A Visual Guide to SSH Tunnels (with labs)

 https://iximiuz.com/en/posts/ssh-tunnels/

good explanation of ssh tunnels

Botnet that hid for 18 months boasted some of the coolest tradecraft ever

 https://arstechnica.com/information-technology/2022/05/how-hackers-used-smarts-and-a-novel-iot-botnet-to-plunder-email-for-months/

scary under-the-radar botnet on network applicances

Top 12 Open Source Security Testing Tools

 https://faun.pub/top-12-open-source-security-testing-tools-6e293db4dc2e

most I've seen, a couple of new ones. Some specialized for databases, etc.

Authorization API for your application

 https://authress.io/

Interesting authentication as a service middleware. 

Netflix Open Sources ConsoleMe to Manage Permissions and Access on AWS

 https://www.infoq.com/news/2021/04/netflix-consoleme-aws/

Dealing with IAM is one of the most painful parts of AWS. Maybe this will help. 

Company forced to change name that could be used to hack websites

 https://www.theguardian.com/uk-news/2020/nov/06/companies-house-forces-business-name-change-to-prevent-security-risk

Real-life version of XKCD's "Exploits of a Mom" cartoon. 

Cloud Security Tools

 https://cloudberry.engineering/tool/

Some for every major cloud platform. 

A simple telephony honeypot received 1.5 million robocalls across 11 months

 https://www.zdnet.com/article/a-simple-telephony-honeypot-received-1-5-million-robocalls-across-11-months/

I know the feeling. 

Dark Web Price Index 2020

https://www.privacyaffairs.com/dark-web-price-index-2020/
Human life is cheap

The Regular Expression Denial of Service (ReDoS) cheat-sheet

https://levelup.gitconnected.com/the-regular-expression-denial-of-service-redos-cheat-sheet-a78d0ed7d865
Beware the wild RegEx.

The Impending Doom of Expiring Root CAs and Legacy Clients

https://scotthelme.co.uk/impending-doom-root-ca-expiring-legacy-clients/
We experienced the first wave

Cryptography Pioneer Seeks Secure Elections the Low-Tech Way

https://www.quantamagazine.org/rsa-cryptographer-ronald-rivest-seeks-secure-elections-20200312/
Ron Rivest on better elections through Crypto.

Security Tools! Curated list of security tools for Hackers & Builders!

https://tools.tldr.run/
Nice card layout

How to SSH Properly

https://gravitational.com/blog/how-to-ssh-properly/
How to set up internal CAs and 2fa

CS 253 web security

https://web.stanford.edu/class/cs253/
Stanford web security class

The Beer Drinker’s Guide to SAML

https://duo.com/blog/the-beer-drinkers-guide-to-saml
I don't drink beer, but this is a great illustration.

CertGraph: visualizing the distribution of trusted CA’s

https://michaelhendrickx.com/201911-certgraph-visualizing-the-distribution-of-trusted-cas.html
a family tree of CAs

Towards A Tokenized Data World: A New World Is Being Created

https://medium.com/asecuritysite-when-bob-met-alice/towards-a-tokenized-data-world-a-new-world-is-being-created-68d2d03768c7
Credit card processors have been using tokenization for a while, time for everybody to?

schneier on security

https://www.schneier.com/
one of the better security blogs