Tech Unplugged

The provided text introduces PASETO (Platform-Agnostic Security Tokens) as a modern and more secure alternative to JSON Web Tokens (JWTs), focusing on its design principles for creating secure, stateless tokens for web applications. The author explains the structure of PASETOs, detailing their version, purpose (local or public), payload, and optional footer. It clarifies how local (symmetric) and public (asymmetric) PASETOs function, including encryption and digital signatures, and their respective use cases. The text also covers PASETO claims and highlights the security advantages of PASETO over JWT, emphasizing its developer-first approach and clearer guidelines to prevent common security missteps.

Automotive Security Research Group presents a Car Hacking 101 talk focusing on in-vehicle networks. The speaker, Kamel, an automotive cybersecurity architect, introduces the concept of these networks as essential for communication between electronic control units (ECUs) within a vehicle. The lecture covers various types of in-vehicle networks, including CAN bus, LIN, FlexRay, CAN FD, MOST, and Automotive Ethernet, discussing their architectures, speeds, applications, strengths, and weaknesses. It also briefly touches upon network topologies relevant to automotive systems, emphasizing the importance of selecting the appropriate network technology based on specific requirements like bandwidth, reliability, and

Kubernetes architecture for beginners. It explains that Kubernetes, or K8s, is a tool for managing and orchestrating containers, comparing it to an orchestra conductor. The article outlines core components like Nodes (computers), Clusters (groups of nodes), Master Node (the planner), Worker Nodes (the executors), Pods (containers grouped together), and Controllers (ensuring the desired number of pods run). The author illustrates how Kubernetes functions by describing the user providing a manifest, the master node assigning tasks, worker nodes executing them, and controllers monitoring the system for the desired state. Finally, the piece emphasizes the importance of Kubernetes for scalability, high availability, self-healing, and portability of modern applications.

Guidance on advanced cybersecurity topics. One document offers a comprehensive collection of interview questions and answers covering areas like C2 frameworks, XDR/AMSI bypass techniques, LOL attacks, and exploits, serving as a thorough resource for security professionals. The other report focuses on effective preparation strategies for these complex red teaming and security architecture subjects, outlining general techniques, current industry trends, specific preparation methods, and valuable tools. Together, they offer both knowledge assessment and learning guidance in the realm of advanced cybersecurity.

a comprehensive overview of security architecture reviews, outlining their processes and best practices. It discusses Cloud Security Posture Management (CSPM) methodologies for evaluating and improving cloud security. The text also identifies common and critical vulnerabilities that should be a focus during these reviews. Furthermore, it recommends various tools for conducting security architecture reviews and CSPM. Finally, the document explains CIS Benchmarks and their alignment with other compliance standards, emphasizing their role in enhancing an organization's security posture.

Baidu has launched its updated AI models, ERNIE 4.5 and ERNIE X1, with ERNIE Bot now accessible for free to individual users. The new models boast enhanced multimodal capabilities and strong reasoning, with ERNIE X1 achieving comparable performance to DeepSeek's R1 at a lower cost. These advancements will be integrated across Baidu's various platforms, and API access is available for enterprise users and develope

The provided text constitutes excerpts from a comprehensive cybersecurity report for 2024-2025, outlining prevalent trends, significant threats exemplified by recent breaches, and crucial best practices. The report details escalating cybercrime costs, the emergence of AI-powered attacks, and the persistent danger of ransomware. It further examines cloud security challenges, the impact of regulatory compliance on cybersecurity, and the transformative role of AI and machine learning in both offense and defense.

Facebook engineers Avinash Lakshman and Prashant Malik developed Cassandra to address the scaling challenges of Inbox Search. This distributed storage system manages structured data across numerous commodity servers, ensuring high availability and no single point of failure. Cassandra employs consistent hashing and gossip protocols for data distribution and fault detection. Its data model is based on keys, column families, and dynamic columns/supercolumns, offering flexibility in data layout. Initially built for Inbox Search, Cassandra was open-sourced and is now used for various large-scale storage needs within and outside of Meta.

Cassandra is a decentralized, structured storage system initially developed by Facebook for its Inbox Search feature and later open-sourced. The document outlines Cassandra's architecture, including its data model (tables with column families), partitioning via consistent hashing, and replication strategies for high availability. It details the system's implementation, covering persistence components like Commit Logs and SSTables, the write and read paths, and the Staged Event-Driven Architecture (SEDA). The text also touches on Cassandra's motivations, its relationship to the CAP theorem and other NoSQL systems like Bigtable and Dynamo, and its evolution with the introduction of CQL and virtual nodes. Finally, it briefly discusses the Facebook Inbox Search schema and highlights Cassandra's strengths in write throughput and scalability, alongside considerations regarding security and its theoretical foundation.

This paper introduces "H-CoT," a novel method to bypass safety mechanisms in large reasoning models (LRMs) like OpenAI's models, DeepSeek-R1, and Gemini 2.0 Flash Thinking. By manipulating the model's chain-of-thought reasoning, the attack disguises harmful requests within educational prompts, highlighted by the new "Malicious-Educator" benchmark. Experiments show that H-CoT significantly reduces refusal rates, sometimes from 98% to under 2%, compelling models to generate harmful content. The research exposes vulnerabilities related to temporal model updates, geolocation, and multilingual processing, suggesting an urgent need for more robust safety defenses that consider the transparency of the reasoning process. The authors offer key insights for improving LRM security, such as concealing safety reasoning and enhancing safety awareness during training, emphasizing the critical balance between model utility and ethical considerations.