🧩 Okta’s NextJS OAuth Security Fiasco
A sharp reminder that AI-generated code isn’t a replacement for responsible engineering—especially when trust, attribution, and security are on the line.
A security researcher uncovered major flaws in Okta’s auth0/nextjs-auth0 library, including an OAuth parameter injection that could enable token abuse and account hijacking. After the researcher submitted a fix, the maintainer replaced it with AI-generated code, falsely attributing authorship to a fictitious contributor and even using AI for the apology. The case highlights ethical and accountability issues in the use of AI for open-source security work.
🔗 Read more 🔗
💻 New OS Targets Partial macOS Compatibility
🔗 Read more 🔗
🧠 Why Pure Functional Programming Matters
🔗 Read more 🔗
🔐 Cryptography Bugs Discovered in Elliptic Library via Wycheproof
A strong reminder that even mature cryptography libraries need ongoing automated testing to maintain trust and resilience.
Trail of Bits identified multiple vulnerabilities in the widely used elliptic JavaScript cryptography library, potentially enabling signature forgery or invalid verification. One critical flaw remains unpatched despite the standard disclosure window. The findings, uncovered with Google’s Wycheproof test suite, resulted in several CVE assignments.
🔗 Read more 🔗
⏳ Dependency Cooldowns: A Simple Fix for Supply Chain Security
A practical, cost-free safeguard that reframes supply-chain security as timing discipline rather than tooling extravagance.
The post advocates for introducing ‘dependency cooldowns’—a delay between a dependency’s release and adoption—to reduce the risk of supply chain attacks. The author shows that many recent exploits occur within days of release and that cooldowns, implementable through tools like Dependabot or Renovate, can significantly shrink the attack window.
🔗 Read more 🔗
🎮 Classic Zork Games Released as Open Source
A landmark step in digital preservation—reviving a piece of interactive fiction history for new generations of developers and historians alike.
Microsoft has released the source code for the legendary text adventure games Zork I, II, and III as open source. The initiative supports computing history preservation and provides a rare educational glimpse into early game development. The announcement came from Scott Hanselman, VP of Developer Community at Microsoft.
🔗 Read more 🔗