PC Ekspert Forum - Privatnost i sigurnost podataka i korisnika

Stranica 24 od 26

« Prva

Show 40 post(s) from this thread on one page

PC Ekspert Forum (https://forum.pcekspert.com/index.php)

- Razno (https://forum.pcekspert.com/forumdisplay.php?f=13)

- - Privatnost i sigurnost podataka i korisnika (https://forum.pcekspert.com/showthread.php?t=322402)

blackshtef

21.11.2025. 17:34

Na Redditu sam nedavno baš naletio na ovu raspravu - https://www.reddit.com/r/croautomobi...fland_parking/

Registracijska oznaka auta jest privatan podatak, ali najbitniji dio je ovaj quote sa prvog komentara:

Citiraj:

Dakle, naplatu vrsi tvrtka Tilia, koja prema Kaufland stranici ima sporazum s MUP-om. Sporazum moze imati jedino ako joj je neki grad prepustio obavljanje komunalnih poslova vezanih za javna parkiralista. Takav sporazum se ne moze sklopiti za privatna parkiralista jer to nije u skladu sa Zakonom o sigurnosti prometa na cestama niti sa Zakonom o zastiti osobnih podataka.
Tilia zbilja ima ugovor za određene gradove te su pristup MUP-ovim podacima do nedavno zloupotrebljavali i za privatna parkiralista pokraj trgovina. Za to im je AZOP izrekao kaznu od 80 000€. Nemaju nikakve pravne osnove da nastave takvu praksu.
Ako netko dobije kaznu prvo zatrazite ocitovanje od njih o izvoru osobnih podataka, zatim to provjerite s MUP-om i kao posljednji korak prijavite AZOP-u.

mkey	21.11.2025. 19:24

Privatno javna partnerstva :D

Nikky

21.11.2025. 20:00

Evo još jedan alat iz naslova za W10 / W11:
W10Privacy
https://www.w10privacy.de/english-home/
https://www.neowin.net/software/w10privacy-5300/

Pupo	21.11.2025. 20:49

Citiraj:

Autor Ivo_Strojnica (Post 3831923)

Poštovani,
Nastavno na Vaše obraćanje ovoj Agenciji vezano uz kazne za parkiranje od strane Lidl i Kauflanda navodimo da je Agencija već zaprimila prijave u odnosu na isto te je u tijeku ispitni postupak radi utvrđivanja svih relevantnih činjenica i okolnosti.
S poštovanjem,

Ovo nije sigurnost na cesti, tako da ne vidim kako se taj zakon može iskoristiti u ovu svrhu.
U prijevodu, ja mogu sa svojim parkingom u Dalmaciji o svima vama saznati registracije, samo trebam reći MUP-u broj rege?
How yes no.

Možeš saznati vlasnika vozila, al ne u smislu da nazoveš mup i oni ti izdiktiraju vlasnika vozila.

Meni je lik stajao danima na mom privatnom parkingu, pa sam zvao murju i postoji procedura, može se doći do vlasnika.

vex	21.11.2025. 21:47

Citiraj:

Autor Pupo (Post 3832007)

prvi dan ceduljica na šajbi, drugi dan cigla :D

tomek@vz

22.11.2025. 22:05

Citiraj:

I imagine that most people who take an interest in de-Googling are concerned about privacy. Privacy on the Internet is a somewhat nebulous concept, but one aspect of privacy is surely the prevention of your web browsing behaviour being propagated from one organization to another. I don’t want my medical insurers to know, for example, that I’ve been researching coronary artery disease. And even though my personal safety and liberty probably aren’t at stake, I don’t want to give any support to the global advertising behemoth, by allowing advertisers access to better information about me.
Unfortunately, while distancing yourself from Google and its services might be a necessary first step in protecting your privacy, it’s far from the last. There’s more to do, and it’s getting harder to do it, because of browser fingerprinting.

> The privacy nightmare of browser fingerprinting

tomek@vz

23.11.2025. 06:00

Citiraj:

Gmail users who are concerned about how Google handles their data should look for the toggles for smart features in the settings menu. The fine print states that the AI functionality, which includes many features, is intended mainly for personalizing the user experience. However, some remain suspicious given Google's efforts to insert Gemini into all of its products.
The settings menu states that users who enable smart features agree to let Google use their information and activity to personalize the experience. Malwarebytes and blogger Dave Jones interpreted the wording to mean that the company is training AI with user content, but Google insists this isis inaccurate.

> Google denies Gmail reads your emails and attachments to train AI, but here's how to opt-out anyway

Bono	25.11.2025. 00:23

France and are continuing the process of leaving OVH. We'll be rotating our TLS keys and Let's Encrypt account keys pinned via accounturi. DNSSEC keys may also be rotated. Our backups are encrypted and can remain on OVH for now.

Our App Store verifies the app store metadata with a cryptographic signature and downgrade protection along with verification of the packages. Android's package manager also has another layer of signature verification and downgrade protection.

Our System Updater verifies updates with a cryptographic signature and downgrade protection along with another layer of both in update_engine and a third layer of both via verified boot. Signing channel release channel names is planned too.

Our update mirrors are currently hosted on sponsored servers from ReliableSite (Los Angeles, Miami) and Tempest (London). London is a temporary location due to an emergency move from a provider which left the dedicated server business and will move. More sponsored update mirrors are coming.

Our ns1 anycast network is on Vultr and our ns2 anycast network is on BuyVM since both support BGP for announcing our own IP space. We're moving our main website/network servers used for default OS connections to a mix of Vultr+BuyVM locations.

We have 5 servers in Canada with OVH with more than static content and basic network services: email, Matrix, discussion forum, Mastodon and attestation. Our plan is to move these to Netcup root servers or a similar provider short term and then colocated servers in Toronto long term.

France isn't a safe country for open source privacy projects. They expect backdoors in encryption and for device access too. Secure devices and services are not going to be allowed. We don't feel safe using OVH for even a static website with servers in Canada/US via their Canada/US subsidiaries.

We were likely going to be able to release experimental Pixel 10 support very soon and it's getting disrupted. The attacks on our team with ongoing libel and harassment have escalated, raids on our chat rooms have escalated and more. It's rough right now and support is appreciated.

https://x.com/GrapheneOS/status/1993...800584103?s=20

Sent from my SM-S931B using Tapatalk

tomek@vz

25.11.2025. 21:29

Citiraj:

CISA has warned that state-backed snoops and cyber-mercenaries are actively abusing commercial spyware to break into Signal and WhatsApp accounts, hijack devices, and quietly rummage through the phones of what the agency calls "high-value" users.

In an alert published Monday, the US government's cyber agency said it's tracking multiple miscreants that are using a mix of phishing, bogus QR codes, malicious app impersonation, and, in some cases, full-blown zero-click exploits to compromise messaging apps which most people assume are safe.

The agency says the activity it's seeing suggests an increasing focus on "high-value" individuals -- everyone from current and former senior government, military, and political officials to civil society groups across the US, the Middle East, and Europe. In many of the campaigns, attackers delivered spyware first and asked questions later, using the foothold to deploy more payloads and deepen their access.

Neo-ST

27.11.2025. 01:47

https://x.com/VitalikButerin/status/1993803663026860125

tomek@vz

30.11.2025. 07:22

Citiraj:

Cybersecurity researchers have discovered vulnerable code in legacy Python packages that could potentially pave the way for a supply chain compromise on the Python Package Index (PyPI) via a domain takeover attack.
Software supply chain security company ReversingLabs said it found the "vulnerability" in bootstrap files provided by a build and deployment automation tool named "zc.buildout."
"The scripts automate the process of downloading, building, and installing the required libraries and tools," security researcher Vladimir Pezo said. "Specifically, when the bootstrap script is executed, it fetches and executes an installation script for the package Distribute from python-distribute[.]org – a legacy domain that is now available for sale in the premium price range while being managed to drive ad revenue."
The PyPI packages that include a bootstrap script that accesses the domain in question include tornado, pypiserver, slapos.core, roman, xlutils, and testfixtures.a

> Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages

Citiraj:

Cybersecurity researchers have shed light on a cross-tenant blind spot that allows attackers to bypass Microsoft Defender for Office 365 protections via the guest access feature in Teams.
"When users operate as guests in another tenant, their protections are determined entirely by that hosting environment, not by their home organization," Ontinue security researcher Rhys Downing said in a report.
"These advancements increase collaboration opportunities, but they also widen the responsibility for ensuring those external environments are trustworthy and properly secured."
The development comes as Microsoft has begun rolling out a new feature in Teams that allows users to chat with anyone via email, including those who don't use the enterprise communications platform, starting this month. The change is expected to be globally available by January 2026.

> MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants

Citiraj:

Microsoft has announced plans to improve the security of Entra ID authentication by blocking unauthorized script injection attacks starting a year from now.
The update to its Content Security Policy (CSP) aims to enhance the Entra ID sign-in experience at "login.microsoftonline[.]com" by only letting scripts from trusted Microsoft domains run.
"This update strengthens security and adds an extra layer of protection by allowing only scripts from trusted Microsoft domains to run during authentication, blocking unauthorized or injected code from executing during the sign-in experience," the Windows maker said.
Specifically, it only allows script downloads from Microsoft trusted CDN domains and inline script execution from a Microsoft trusted source. The updated policy is limited to browser-based sign-in experiences for URLs beginning with login.microsoftonline.com. Microsoft Entra External ID will not be affected.
The change, which has been described as a proactive measure, is part of Microsoft's Secure Future Initiative (SFI) and is designed to safeguard users against cross-site scripting (XSS) attacks that make it possible to inject malicious code into websites. It's expected to be rolled out globally starting mid-to-late October 2026.

> Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update

tomek@vz

01.12.2025. 08:41

Citiraj:

Earlier this week, the developer of SmartTube, the most popular alternative YouTube app for Android TV and Fire TV devices, announced that his app’s digital signature had been exposed. A new version of the app using a new digital signature has since been released. While everyone is encouraged to switch to the new app, SmartTube’s developer has shared more information with me about what happened that may make you want to take additional precautions if you’ve installed or updated the app recently.
SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware. It’s unclear which version was first affected, but the compromise seems to have first occurred earlier this month. SmartTube versions 30.43 and 30.47 from APKMirror are both being flagged as infected by malware scanners.
It is likely the presence of this malware that caused Google and Amazon to forcibly uninstall SmartTube on some devices, not the exposed digital signature as first suspected. SmartTube’s developer says the compromised machine has been wiped and is confident that both the new SmartTube releases and the machine that created them are malware-free.

> SmartTube’s official APK was compromised with malware — What you should do if you use it

---

I malo smijeha za ponedjeljak :D

Citiraj:

Let me introduce you to my most novel and oldest technique to verify if sites behind CDN are hosted in Inside Iran or not. Works most of the time. I call it the BOOBS CHECK.

Code:

curl -i https://domain/boobs.jpg

If your response is a 403 with 10.10.34.x IP in body, you're landing inside IR. Result of basic censorship filtering applied on traffic.

> x.com

mkey	01.12.2025. 20:24

Nije dobro :D https://forum.pcekspert.com/boobs.jpg

Neo-ST

02.12.2025. 00:36

1 privitaka

Ne pripada ovdje ali ne znam gdje drugo stavit ?

tomek@vz

02.12.2025. 07:58

Citiraj:

Autor Neo-ST (Post 3833883)

Ne pripada ovdje ali ne znam gdje drugo stavit ?

Jos jedan cavao u platformu. Iskreno - vec par mjeseci sam na detoksikaciji od dnevnog konzumiranja Youtube sadrzaja i mogu samo reci kad se hoce - moze se. Google pokusava Youtube monetizirati na svakom milimetru cak i kad to ide naustrb korisnikove komocije. I da shvacam da je Google zapravo danas AI i ADs firma al heboga sta je previse - previse je. 1-2 reklama u pola sata gledanja Youtube sadrzaja bi bile ok al ovo je previse.

Apropos Google:

Citiraj:

Google's latest Android enterprise update adds RCS Archival, a tool that lets organizations intercept, archive, and retain messages sent through Google Messages on work-managed Pixel phones. The feature is designed for compliance and legal discovery, but it also reshapes expectations for privacy in encrypted workplace texting.
Rich Communication Services is Google's modernization of SMS and MMS for Android. It offers read receipts, typing indicators, and end-to-end encryption, positioning it as a secure replacement for the older texting standards.
While that encryption protects messages in transit, it does not secure them once they arrive. Until now, this limitation had little practical impact. Older enterprise tools relied on carriers that could not access the encrypted content, making archiving difficult. Google's RCS update changes that.

The update applies only to work-managed devices and does not affect personal phones. Still, it highlights a growing source of confusion among users regarding the limits of end-to-end encryption.

> Android's latest enterprise update shows encrypted work texts aren't as private as they look

tomek@vz

02.12.2025. 11:50

Citiraj:

The European Parliament and Council have agreed on a set of significant changes to how online payments and payment services must operate. The new measures aim to strengthen user protection against both fraud and hidden fees associated with online transactions – and that's only the beginning.
European authorities have completed the negotiation phase for the Payment Services Regulation and the Third Payment Services Directive, two new regulatory frameworks designed to improve user protection and transparency in online payments. The rules aim to harmonize and modernize how payment service providers operate across the European Union, covering payment services offered by banks, post-office giro systems, and other financial institutions.

> EU strikes deal on new payment rules that force providers to refund fraud losses and reveal hidden fees

Ovo je OK.

nepalac

02.12.2025. 13:33

Citiraj:

Autor tomek@vz (Post 3833895)

1-2 reklama u pola sata gledanja Youtube sadrzaja bi bile ok al ovo je previse.

Nisi čuo za ublock ili revanced?
Ne znam zašto bi pogledao i jednu reklamu...

Btw, uskoro i kod nas:
https://www.index.hr/mobile/vijesti/...jesti_ostalo_m

tomek@vz

02.12.2025. 15:14

Citiraj:

Autor nepalac (Post 3833980)

Nisi čuo za ublock ili revanced?
Ne znam zašto bi pogledao i jednu reklamu...

Btw, uskoro i kod nas:
https://www.index.hr/mobile/vijesti/...jesti_ostalo_m

Lako za smartphone i dekstop (firefox+ublock origin) ali svim tim revanced/smarttube aplikacijama vjerujem ko gladnom lavu kad kaze da me nece pojest:

https://forum.pcekspert.com/showpost...&postcount=932

Jednog dana se svi oni usmrde.A s druge strane trebaju se i nekako financirati jel? E pa - da se financiraju kroz 1-2 reklame na pol sata onda bih osobno iskljucio adblocker na youtube jer sam svjestan da se ne zivi od zraka.

Neo-ST

02.12.2025. 15:49

Revanced koristim godinama, nikad problema. Open source je, imaš ga na githubu pa baci oko.

Neo-ST

02.12.2025. 20:11

Announcing Session Protocol v2.

Re-implementing Perfect Forward Secrecy (PFS), adopting Post-Quantum Cryptography (PQC), and more secure device management.

tomek@vz

03.12.2025. 05:44

Citiraj:

Autor Neo-ST (Post 3834018)

Revanced koristim godinama, nikad problema. Open source je, imaš ga na githubu pa baci oko.

Koristio sam jedno vrijeme ali mi je FF+Ublock dovoljan i dugorocno vidim kao sigurniju opciju. Problem sa svim tim "sa strane" alatima je da nikad neznas kad se bas ovakvo sranje moze dogoditi. Smarttube sam imao na jednom od Android boxeva par puta instaliran, zadnji puta pred cca mjesec dana i imao sam dojam da se zadnji puta cijeli uredaj nekako usporio - deinstalacija nije pomogla. Factory reset > opet sve normalno radi, nisam vise smarttube instalrao. A gore imam samo Zattoo, Wiim i VLC. Tak da pretpostavljam da sam sa smarttube usro motku. Zato sam nepovjerljiv prema takvim alatima.

mkey	03.12.2025. 09:27

Ako želiš biti siguran, instaliraš smarttube. Ako se problem s performansama ponovi, onda znaš šta je. Ako se ne ponovi, onda ne znaš šta je.

tomek@vz

03.12.2025. 17:23

Citiraj:

The rise of remote work introduced a degree of ambiguity to employees' locations during conference calls on apps such as Zoom and Microsoft Teams. An upcoming update for Teams threatens to eliminate any doubt by automatically informing employers when workers connect to office Wi-Fi.
A Microsoft Teams update planned for January 2026 will automatically update users' locations to indicate which building they are located in. Although the feature will likely facilitate office coordination, it could also help bosses enforce stricter surveillance.
According to Microsoft 365 Roadmap ID 488800, the update will be generally available on the Windows and macOS versions of Teams next month. Automatic location updates will be turned off by default, with Tenant administrators deciding whether to enable it and require other users to participate. The feature informs administrators as soon as an employee connects to Wi-Fi in one of the company's buildings.

> Microsoft Teams may soon tell your boss when you enter or leave the office. New location detection feature is sparking worries about employee surveillance

domy_os

03.12.2025. 18:29

Već dugo oni to planiraju čim aplikacija uporno traži location permission iako sam isključio location sharing.

tomek@vz

04.12.2025. 22:41

Citiraj:

Microsoft has silently "mitigated" a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in zero-day attacks. Tracked as CVE-2025-9491, this security flaw allows attackers to hide malicious commands within Windows LNK files, which can be used to deploy malware and gain persistence on compromised devices. However, the attacks require user interaction to succeed, as they involve tricking potential victims into opening malicious Windows Shell Link (.lnk) files. Thus some element of social engineering, and user technically naive and gullibility such as thinking Windows is secure is required. [...]

As Trend Micro threat analysts discovered in March 2025, the CVE-2025-9491 was already being widely exploited by 11 state-sponsored groups and cybercrime gangs, including Evil Corp, Bitter, APT37, APT43 (also known as Kimsuky), Mustang Panda, SideWinder, RedHotel, Konni, and others. Microsoft told BleepingComputer in March that it would "consider addressing" this zero-day flaw, even though it didn't "meet the bar for immediate servicing." ACROS Security CEO and 0patch co-founder Mitja Kolsek found, Microsoft has silently changed LNK files in the November updates in an apparent effort to mitigate the CVE-2025-9491 flaw. After installing last month's updates, users can now see all characters in the Target field when opening the Properties of LNK files, not just the first 260. As the movie the Ninth Gate stated: "silentium est aurum"

Citiraj:

Cybersecurity researchers have uncovered a sophisticated malware campaign that infected millions of computers via browser extensions on the Chrome Web Store and Microsoft Edge add-ons website. The extensions used to be legitimate apps but were updated with malicious code last year.
According to researchers at cybersecurity firm Koi, a China-based hacking syndicate known as ShadyPanda is actively conducting at least two malware campaigns by weaponizing browser extensions with malicious code.

tomek@vz

05.12.2025. 08:39

Citiraj:

The Irish Council for Civil Liberties (ICCL) has announced it filed a complaint against Microsoft, accusing the global tech giant of unlawfully processing data on behalf of the Israeli military and facilitating the killings of Palestinian civilians in Gaza. In the complaint, the council asked the Data Protection Commission -- the European Union's lead data regulator for the company -- to "urgently investigate" Microsoft Ireland's processing.

"Microsoft's technology has put millions of Palestinians in danger. These are not abstract data-protection failures -- they are violations that have enabled real-world violence," Joe O'Brien, ICCL's executive director, said in a statement. "When EU infrastructure is used to enable surveillance and targeting, the Irish Data Protection Commission must step in -- and it must use its full powers to hold Microsoft to account."

After months of complaints from rights groups and Microsoft whistleblowers, the company said in September it cancelled some services to the Israeli military over concerns that it was violating Microsoft's terms of service by using cloud computing software to spy on millions of Palestinians.

mkey	05.12.2025. 09:43

Prokleti kineski hakeri. A ovo Evil Corp, da li je to google? :D

Bono	05.12.2025. 10:38

Zeznuti su ti SMS-ovi, ChatGPT korisnici uzivajte...

Citiraj:

We were notified by Mixpanel, an external data analytics service provider, that there had been a breach of part of their systems following an SMS-based phishing attack against their employees. Mixpanel has confirmed that during this incident, datasets were exported from some customer projects, including ours.

Citiraj:

The incident occurred within Mixpanel’s systems and involved limited analytics data related to some users of the API. Users of ChatGPT and other products were not impacted.

This was not a breach of OpenAI’s systems. No chat, API requests, API usage data, passwords, credentials, API keys, payment details, or government IDs were compromised or exposed.

What happened

On November 9, 2025, Mixpanel became aware of an attacker that gained unauthorized access to part of their systems and exported a dataset containing limited customer identifiable information and analytics information. Mixpanel notified OpenAI that they were investigating, and on November 25, 2025, they shared the affected dataset with us.

What this means for impacted users

User profile information associated with the use of platform.openai.com⁠(opens in a new window) may have been included in data exported from Mixpanel. The information that may have been affected was limited to:

Name that was provided to us on the API account
Email address associated with the API account
Approximate coarse location based on API user browser (city, state, country)
Operating system and browser used to access the API account
Referring websites
Organization or User IDs associated with the API account

https://openai.com/index/mixpanel-incident/

tomek@vz

05.12.2025. 18:15

Citiraj:

Two Virginia brothers Muneeb and Sohaib Akhter, previously convicted of hacking the U.S. State Department, were rehired as federal contractors and are now charged with conspiring to steal sensitive data and destroy government databases after being fired. "Following the termination of their employment, the brothers allegedly sought to harm the company and its U.S. government customers by accessing computers without authorization, issuing commands to prevent others from modifying the databases before deletion, deleting databases, stealing information, and destroying evidence of their unlawful activities," the Justice Department said in a Wednesday press release. BleepingComputer reports:

Citiraj:

According to court documents, Muneeb Akhter deleted roughly 96 databases containing U.S. government information in February 2025, including Freedom of Information Act records and sensitive investigative documents from multiple federal agencies. One minute after deleting a Department of Homeland Security database, Muneeb Akhter also allegedly asked an artificial intelligence tool for instructions on clearing system logs after deleting a database.

The two defendants also allegedly ran commands to prevent others from modifying the targeted databases before deletion, and destroyed evidence of their activities. The prosecutors added that both men wiped company laptops before returning them to the contractor and discussed cleaning out their house in anticipation of a law enforcement search. The complaint also claims that Muneeb Akhter stole IRS information from a virtual machine, including federal tax data and identifying information for at least 450 individuals, and stole Equal Employment Opportunity Commission information after being fired by the government contractor.

Muneeb Akhter has been charged with conspiracy to commit computer fraud and destroy records, two counts of computer fraud, theft of U.S. government records, and two counts of aggravated identity theft. If found guilty, he faces a minimum of two years in prison for each aggravated identity theft count, with a maximum of 45 years on other charges. His brother, Sohaib, is charged with conspiracy to commit computer fraud and password trafficking, facing a maximum penalty of six years if convicted.

tomek@vz

06.12.2025. 18:30

Citiraj:

NanoKVM is a hardware KVM switch developed by the Chinese company Sipeed. Released last year, it enables remote control of a computer or server using a virtual keyboard, mouse, and monitor. Thanks to its compact size and low price, it quickly gained attention online, especially when the company promised to release its code as open-source. However, as we’ll see, the device has some serious security issues. But first, let’s start with the basics.

> How I discovered a hidden microphone on a Chinese NanoKVM

mkey	06.12.2025. 20:33

Trojanski KVM.

tomek@vz

08.12.2025. 17:27

Citiraj:

The United Kingdom's House of Commons will hold a debate on the introduction of a national digital ID card on Monday, December 8, following a UK parliament petition which has gathered almost 3 million signatures. As a bit of background, the UK does not yet have a national ID card, with people relying on passports and driver's licenses.
The closest the country previously got to introducing ID cards was in the 2000s under Tony Blair, but opposition overwhelmed that drive. Now, the government is attempting to bring in a digital ID, but as the petition shows, it is still not a popular idea.
In anticipation of the debate, the Open Rights Group has warned that the government is implementing a digital surveillance infrastructure. It is key to mention that ORG often defaults to the privacy position; there are good arguments on both sides of the debate to introduce or not introduce a digital ID.

> Digital ID debate: Privacy group warns of 'unprecedented tracking' and 'surveillance'

Night

10.12.2025. 17:10

Citiraj:

Autor tomek@vz (Post 3834837)

> How I discovered a hidden microphone on a Chinese NanoKVM

Ovo navodno nije namjerno ugrađen mikrofon nego je netko uzeo general-purpose development board i od njega napravio KVM, a taj devboard je već imao mikrofon kao jednu od periferija.

Što ne znači da neki firmware update neće staviti taj mikrofon u pogon ili da možda već nije upotrijebljen.

https://www.youtube.com/watch?v=RSUqyyAs5TE

The Exiled

10.12.2025. 17:20

Zanimljivo da nitko od tih YouTubera koji su "recenzirali", odnosno reklamirali taj i slične čang-šlang KVM-ove nisu skužili ništa od ovih problema koje sad odjednom analiziraju.

https://i.postimg.cc/YCB2mvrc/KVM.png

Night

10.12.2025. 17:51

Citiraj:

Autor The Exiled (Post 3835446)

Zanimljivo da nitko od tih YouTubera koji su "recenzirali", odnosno reklamirali taj i slične čang-šlang KVM-ove nisu skužili ništa od ovih problema koje sad odjednom analiziraju.

Yep, kineski black box koji ima pristup mreži, tipkovnici i mišu, kako bi to uopće moglo loše završiti :D

tomek@vz

10.12.2025. 21:41

Zato ja bjezim od tih sranja ko vrag od tamjana.

Citiraj:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation to succeed, it requires a prospective target to visit a malicious page or open a malicious file.

> Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups

Citiraj:

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild.

Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity. Two other defects are listed as publicly known at the time of the release. These include 29 privilege escalation, 18 remote code execution, four information disclosure, three denial-of-service, and two spoofing vulnerabilities.

In total, Microsoft has addressed a total of 1,275 CVEs in 2025, according to data compiled by Fortra. Tenable's Satnam Narang said 2025 also marks the second consecutive year where the Windows maker has patched over 1,000 CVEs. It's the third time it has done so since Patch Tuesday's inception.

> Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days

tomek@vz

11.12.2025. 16:52

Citiraj:

Tourists from dozens of countries including the UK could be asked to provide a five-year social media history as a condition of entry to the United States, under a new proposal unveiled by American officials. From a report:

Citiraj:

The new condition would affect people from dozens of countries who are eligible to visit the US for 90 days without a visa, as long as they have filled out an Electronic System for Travel Authorization (ESTA) form. Since returning to the White House in January, President Donald Trump has moved to toughen US borders more generally - citing national security as a reason.

Analysts say the new plan could pose an obstacle to potential visitors, or harm their digital rights. Asked whether the proposal could lead to a steep drop-off in tourism to the US, Trump said he was not concerned. "No. We're doing so well," the president said on Wednesday. "We just want people to come over here, and safe. We want safety. We want security. We want to make sure we're not letting the wrong people come enter our country."

tomek@vz

12.12.2025. 07:33

Citiraj:

More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys. After scanning container images uploaded to Docker Hub in November, security researchers at threat intelligence company Flare found that 10,456 of them exposed one or more keys. The most frequent secrets were access tokens for various AI models (OpenAI, HuggingFace, Anthropic, Gemini, Groq). In total, the researchers found 4,000 such keys. "These multi-secret exposures represent critical risks, as they often provide full access to cloud environments, Git repositories, CI/CD systems, payment integrations, and other core infrastructure components," Flare notes. [...]

Additionally, they found hardcoded API tokens for AI services being hardcoded in Python application files, config.json files, YAML configs, GitHub tokens, and credentials for multiple internal environments. Some of the sensitive data was present in the manifest of Docker images, a file that provides details about the image.Flare notes that roughly 25% of developers who accidentally exposed secrets on Docker Hub realized the mistake and removed the leaked secret from the container or manifest file within 48 hours. However, in 75% of these cases, the leaked key was not revoked, meaning that anyone who stole it during the exposure period could still use it later to mount attacks.

Flare suggests that developers avoid storing secrets in container images, stop using static, long-lived credentials, and centralize their secrets management using a dedicated vault or secrets manager. Organizations should implement active scanning across the entire software development life cycle and revoke exposed secrets and invalidate old sessions immediately.

Nick7

12.12.2025. 11:05

Citiraj:

Autor Night (Post 3835450)

Yep, kineski black box koji ima pristup mreži, tipkovnici i mišu, kako bi to uopće moglo loše završiti :D

Ne losije nego americki black box koji ima pristup mrezi, tipkovnici i misu.

Ivo_Strojnica

12.12.2025. 15:20

Ovo sam vidija, bome zabrinjavajuća statistika.

Sva vremena su GMT +2. Sada je 18:51.

Stranica 24 od 26

« Prva

Show 40 post(s) from this thread on one page