Explore weekly curated summaries and expert analyses highlighting the latest trends in cloud technology.

  • Passkeys are not a trap: the backlash post gets WebAuthn wrong

    A post titled “Passkeys are a trap. Do not use them.” has been making the rounds on Hacker News this week, and Scott Helme’s rebuttal is the best response to it I have read. The short version: the trap argument rests on a misunderstanding of how WebAuthn attestation actually works, and the alternative it recommends,…

  • OpenCode 2.0 turns the open source coding agent into a platform

    OpenCode 2.0 shipped this week, and it is not a version bump. The open source coding agent, which sits at 213,000 stars on GitHub, rebuilt its server API from scratch, made its background service a first-class citizen, and folded almost everything into a plugin system. The upgrade path includes real breaking changes. If you script…

  • Azure Site Recovery now protects Arc-enabled Windows servers

    Hybrid shops just lost one of their more annoying trade-offs. Azure Site Recovery is now generally available for Azure Arc-enabled Windows VMware virtual machines and on-premises physical servers, according to the October announcement on the Azure Updates roadmap. The machines you manage with Arc can now be protected with enterprise-grade disaster recovery without the agent…

  • An 11-year-old Rust borrow checker bug let safe code touch freed memory

    Safe Rust is supposed to make use-after-free impossible. A soundness report filed on October 13 shows one way that promise currently fails, and the twist is that the compiler has been accepting the bad code for over a decade. The bug lives in a GitHub issue against the Rust compiler, rust-lang/rust#164250, and it lets a…

  • Registry hijacks let attackers mint trusted TLS certificates for Google domains

    Attackers did not need to breach Google, or any of the other organizations caught up in this incident. They needed DNS. Last month, someone compromised the third-party operators behind the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level domains, changed authoritative DNS records, and quietly walked through domain control validation to collect…

  • Forged RSA signatures without factoring: the attack nobody thought was possible

    For roughly two decades, one assumption held firm: the only way to forge an RSA signature was to factor the modulus first, and factoring a 1024-bit key was a job for a nation-state budget. A team at UC San Diego and INRIA just knocked that assumption over. They forged a valid 1024-bit RSA signature without…

See All