Gotta say, I'm pretty chuffed about this favicon for the Mastodon RSS Reader.

Holy shit. If you thought SIM swapping was a problem, you wouldn't believe the gaping security holes in enacting a Power of Attorney.

Power of Attorney documentation comes into play for family members / care givers when somebody dies or has lost mental facilities. It grants you access to somebody's bank accounts, phone accounts, etc., and it's ridiculous. A few forged documents and impersonated phone calls is all it takes.

None of this stuff is authenticated or cross referenced in central databases in any legitimate way. It is absolutely unbelievable.

@kagihq 's "small web" experiment kicked off 3 years ago with about 6,000 vetted human-written non-commercial blogs and is now up to almost 37,000. I would love to know how it's going: https://blog.kagi.com/small-web

Ok, here's the answer to the question that's always on your mind: what treats should you buy when you visit Canada? https://www.leeholmes.com/what-treats-to-buy-in-canada/

I know it was fashionable for a while for infosec to mock people that use VPNs (ala "Hello, it's 2026. Everything worth securing is transmitted over TLS anyways") but I still think it's an immature absolutist take.

TLS doesn't save you when Russia hacks the routers in your hotel to send you to phishing sites rather than actual login pages: https://www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/

Seriously, don't go it alone. Look at these unit tests. SSRF defense is hard!

Sweet! The Microsoft anti-SSRF library is now open source: https://github.com/microsoft/antissrf

This has been a core defense for SSRF at Microsoft for a time now. It's insane how complicated the topic really is.

Every. Single. Time. I see an article about "ex-Microsoft engineer writes scathing tell-all", look them up in internal systems, and it's obvious that they are clearly better at blogging than contributing technically.

THE BLOOMSCROLLING WILL CONTINUE UNTIL MORALE IMPROVES

Interesting collision of security and security:

Security: "All logs should be immutable."
Security: "I just found credentials leaking into logs."

Ok, this is cool. You have 10 things with various features (think: price / quality / speed or CVSS / known exploited / time unpatched) and you want to use a formula to put them in order. You can compare any two and probably make a good call, but you don't want to hand-craft a formula because that introduces bias.

There is something called Bradley-Terry Logistic Regression that is designed exactly for this. Here's an implementation, even letting you compare among multiple evaluators to see where your value systems may differ.

http://leeholmes.com/projects/bt-logistic

Sweet! BlueHat Redmond has kicked off its CFP!

BlueHat brings together security researchers and responders to exchange ideas, experiences, and best practices. We’re looking for talks covering vulnerability research, mitigations, emerging threats and techniques, and more.

Bring your best ideas, because security is a team sport.

Submit your paper by February 28, 2026: https://aka.ms/BH26CFP

I've been working on a calculator project because I'm a nerd and I like calculators :) I've been refraining from adding features for the sake of features (i.e.: I've never used graphing or any matrix functions on any of my real calculators). What things do _you_ actually use calculators for? What things do you wish they did?

Web version here: https://www.leeholmes.com/projects/pyco/

My jaw is just hanging on the ground after the news about McLaren's double DQ in Vegas. The end of this season is going to be insane.

LOL, I haven't been this disappointed by AI in a long time. I made a very pretty image of a "billion dollar butterfly". And it was perfect.

And then I asked it to make a movie of it flapping its wings and flying away, and it got me excited. And then I got the result 🤣🤣🤣

I might regret this.

Call me paranoid, but I don't think robot arms should be able to reach their own control panels.

OK, Mesh hackers @defcon . Don't disappoint.

I'm sure there's something here, but I don't have the patience to find it :)