a graph showing the number of computer vulnerabilities by week since 1990, increasing exponentially in the last couple months.

Source: https://xkcd.com/221/

Context: https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

It is the FreeBSD analogue of Linux's Dirty Pipe, CopyFail, Fragnesia, and Dirty Frag — except we gave it a BETTER name, with a BETTER logo, on a BETTER website. The other bug websites? Disasters. Sad. Many people have told us this.

I knew that it was possible to spy on CRT displays due to the signals they radiate, but apparently that is a problem with HDMI too.

Here a very interesting write up on how to extract frames from leaked RF from HDMI cables and using said RF to transmit a webcam stream even: https://www.windytan.com/2023/02/using-hdmi-radio-interference-for-high.html

Here a example of someone using HDMI RF to transmit LoRa signals: https://www.youtube.com/watch?v=HDbdAZd6cLw

This makes for a interesting attack vector for locating a user, if said user clicks on a video (or even a gif) that crafts LoRa frames to radiate from his HDMI and there is for example a Meshtastic receiver near by that relays those frames into a wider network.

There are ways to migrate this issue, for example using the encrypted version of HDMI usually used to enforce content copyright protection, or using a fiber optic HDMI cable (by now they are almost as cheap as the copper ones and are not restricted to a max lenght of 5m).

cross-posted from: https://sh.itjust.works/post/53663224

Sometimes I wonder whether all this "security awareness training" has any effect at all.