SBOMs are more an attempt to solve some of the problems introduced by software reuse. https://archive.fosdem.org/2025/schedule/track/sbom/ has some interesting talks about the successes and failures of them.

Try this https://theconversation.com/the-reinhart-rogoff-error-or-how...

Here's an example I made a while ago of how easy it is to use LD_PRELOAD to hook things and change file contents etc. https://github.com/richmoore/reciprocity

Nice! Looks cool!

If that same tool is unable to spot LD_PRELOAD in use then I'd suggest getting a new one. :-)

Time for me to dust off CVE-2010-3170 again? :-)

I guess a bunch of "roll your own X.509 validation"-logic will have that bug, but to exploit it you need a misbehaving CA to issue you such a cert (i.e. low likelihood)

As the article explains, that's not been implemented on Mac yet.

That's not correct and also not what the article says. They are only talking about Excel and PowerPoint.

"We're working on adding the Enable Copilot checkbox to Excel, OneNote, and PowerPoint on Windows devices and to Excel and PowerPoint on Mac devices."

I am using Word on my Mac (version 16.93) and do have a checkbox that disables Copilot.

Odd - I also have 16.93 on Mac and I don't get the checkbox (unless I just can't find it I guess).

Well, I'm on a Mac and it 100% has been implemented for me -- I tried to figure out how to turn it off as soon as I first saw it, went to preferences, found the checkbox. I didn't realize that hasn't been rolled out to everybody.

Updating story and a rolling update. It'll probably be there within a few days. But it is legitimate that some don't have the option yet.

Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).

1. A SYN will receive a SYN-ACK or a RST 2. A host from my machine is the same as from your machine 3. An IP from my machine is the same as from your machine

1. A SYN may receive a SYN-ACK, RST or nothing at all.

It was also possible in earlier browsers by using hidden frames. User interaction or a timer would trigger, then you load the frame (which contained dynamically generated js) and then call the javascript you'd just loaded.

You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.