• Goldman Sachs updated internal guidance in October 2026 to restrict third-party AI coding agents, specifically Anthropic's Claude Code and Microsoft's GitHub Copilot, strictly to software engineers.
• Most bankers and traders have been stripped of access, though quantitative "Strats" who bridge trading, research, and engineering retain permissions.
• The sudden restriction follows high-profile internal praise in July 2026, when CIO Marco Argenti lauded non-technical employees using "vibe coding" to prototype trading tools without waiting for engineering backlogs.
• The shift addresses critical operational, compliance, and security risks:
  • Running autonomous agents directly on finance workstations that store sensitive client records, trading flows, and internal data exposes the firm to data leaks and unvetted code execution.
  • Code generated by non-engineers bypassed standard peer review, rigorous testing, deployment pipelines, and regulatory information barriers (Chinese walls).
  • Unaudited logic errors in models could trigger catastrophic financial losses, compounded by soaring per-token API costs.
• The policy comes at an awkward juncture: Goldman Sachs and Morgan Stanley are lead underwriters on Anthropic's upcoming IPO, marketing shares for a company whose coding agent Goldman largely barred from its own core business users.

Hacker News Discussion

• Commenters attribute Goldman's reversal to Simon Willison's "Lethal Trifecta" security model: granting semi-autonomous agents co-located access to private data, internet connectivity, and execution permissions creates severe risk of prompt-injection exfiltration.
• Several users suspect an unpublicized blunder or near-miss occurred internally, arguing that tier-one financial institutions typically act this aggressively only after an incident threatens regulatory scrutiny or substantial financial loss.
• The community debated architectural isolation and sandboxing:
  • Many argued agents should never run directly on host machines and must instead be segregated inside ephemeral, memory-less virtual machines or isolated cloud sandboxes.
  • Others countered that excessive isolation degrades the seamless user experience and productivity gains that make agentic tools attractive in the first place.
• Multiple participants highlighted the inherent unreliability of LLM instruction-following, noting that models still fail to reliably separate instructions from untrusted data, making "auto-mode" security safeguards insufficient for high-stakes trading floors.

• Overview of the Incident: A major cyberattack targeted supermarket chains across Europe (notably in France, Belgium, and the Netherlands), disrupting refrigeration control systems, deliveries, and in-store pricing.
• Refrigeration Sabotage:
  • Hackers compromised Danfoss-made refrigeration controllers used by major French supermarkets, including Intermarché, Leclerc, and Coopérative U.
  • The attackers hijacked the automatic defrosting function—which normally runs for just two hours a day—and locked the units into a continuous, forced defrosting cycle set to 50 degrees Celsius.
  • Store sources reported waves of heat escaping from fridges and freezers, leading to spoiled perishables and early estimated losses of €300,000 that could scale into several million euros nationwide.
• Broader Retail Disruptions:
  • In the Netherlands and Belgium, retail chains including Albert Heijn, Etos, Gall & Gall, and Delhaize experienced concurrent cybersecurity malfunctions.
  • Websites were taken down, halting online orders and deliveries, while preventive system shutdowns were enacted to protect IT environments.
  • Electronic shelf labels were compromised, causing widespread in-store pricing issues and forcing the suspension of customer loyalty programs.
  • It remains unclear whether the French refrigeration attacks and the Dutch/Belgian retail disruptions are directly connected.

Hacker News Discussion

• Trivial Authentication Bypass & Firmware Flaws:
  • Commenters highlighted security research (by Claroty) detailing extreme vulnerabilities in the Danfoss controllers, including a documented authentication bypass triggered simply by sending a POST request to /xml.cgi.
  • The firmware also contained a backdoor recovery mechanism alongside standard authentication that generated a daily admin password using a weak, reverse-engineerable algorithm seeded solely with the current date.
• Criticism of Security Certifications:
  • Users mocked the fact that the manufacturer holds an ISO 27001 certification despite shipping such critical vulnerabilities.
  • Industry veterans noted that certifications like ISO 27001 and SOC2 merely prove a company has documented policies and does the "audit dance," rather than guaranteeing actual technical security.
• IoT Exposure vs. Network Isolation:
  • A debate emerged over why critical food-safety infrastructure is exposed to the public internet.
  • While many argued industrial appliances should never be online, others pointed out that remote temperature monitoring is vital for preventing mass spoilage—though it should be strictly read-only, isolated behind a VPN, or rely on one-way alert systems rather than full remote control.
• Regulatory Impact:
  • Embedded security professionals pointed out that the EU's upcoming Cyber Resilience Act (CRA), taking effect in late 2027, will make shipping hardware with such negligent security practices illegal and subject to heavy fines.
• Links to Previous Attacks & Geopolitics:
  • Commenters connected this incident to a remarkably similar August 2026 event where freezers at US military commissaries mysteriously failed, suspecting the same Danfoss vulnerability was exploited.
  • Speculation on motives ranged from state-sponsored grey-zone warfare (such as Russia sowing general chaos and exhausting organizational response capacity) to opportunistic attackers exploiting a known vulnerability before it gets patched.

• The Discovery: While attending the Colorado School of Mines, the author discovered that local DNS servers assign a unique subdomain to every device connecting to the campus Wi-Fi network.
• Subdomain Enumeration:
  • Initial Attempts: The author first used Python and brute-force permutations to guess subdomains, but the asynchronous script was too slow.
  • Rust Optimization: Moving to Rust and optimizing the code (incrementing an integer and converting it to base 36) dramatically improved speed. They bypass the standard library by interacting directly with the UDP port and utilizing Bash scripting to distribute offsets across multiple processes.
  • The Crash: The optimized Rust script generated queries so quickly (hitting peak rates up to 4.04 Gbps) that it crashed the campus DNS server, causing a 15-minute network outage. School IT tracked them down because they had spent two weeks talking openly about the project.
• PTR Records: Realizing brute forcing became unrealistic for longer subdomains, the author pivoted to utilizing DNS Reverse Lookup (PTR records), which allowed them to map known active IP addresses back to domain names.
• Port Scanning and AF_XDP:
  • The author created a custom, lightweight network scanner called convoy utilizing Linux's AF_XDP to bypass the core network stack.
  • By horizontally scanning (one port across all machines before moving to the next), they safely achieved scan speeds of 300,000 ports per second on a single core.
• Campus Exploitation:
  • Due to loose network restrictions surrounding wireless casting, certain subnets were accessible.
  • The scanner revealed 36 campus security cameras running on default passwords. Although deep packet inspection rules blocked live video streaming, the author reverse-engineered the web interface's API to synchronously manipulate camera positions.
  • They also found unprotected controls for almost every projector screen and input switch across the campus classrooms.
• Reporting: The vulnerabilities were responsibly disclosed to campus IT, who stated the issues would be patched over the summer. The author received no financial compensation.

Hacker News Discussion

• Network Segmentation Failures: Users expressed shock that a modern university in 2026 would still run a completely flat network architecture, allowing unvetted student devices onto the same subnets as critical infrastructure, surveillance cameras, and IoT equipment without basic VLAN segmentation.
• Lenient Academic Consequences: Commenters heavily debated the IT department's mild reaction to a network crash. Some argued that causing campus-wide outages warrants severe disciplinary action to prevent dangerous professional habits, while others recalled their own college days—noting that universities traditionally serve as a safe environment to learn boundaries, and harsh punishments only incentivize hackers to hide their findings.
• Alternative Enumeration Techniques: Network professionals chimed in with alternative scanning methods, noting that hotel and public networks often share a single central DNS server across guest and internal networks, allowing easy reverse PTR record profiling. Others recommended utilizing broadcast mDNS/Bonjour for local device footprinting.
• Industry Perspectives: Former project managers for AV hardware companies noted that modern firmware explicitly mandates changing default passwords upon setup, placing the blame squarely on poor campus IT implementation.

German gov assessment of password managers: only 1Password, Keepass2 Android, KeePassXC get full marks.

open source dependencies as supply chain risk and attack surface, vs how, here Obsidian mitigates against them: - reimplement small functions directly in your own code - fork modules and maintain as own code base - large libraries include version locked files - strongly limit the 3rd party packages that ship in your code to others

For those lockfiled dependencies have a process for updates (and for onboarding a new one), and don't quickly update what already works. Use time as a buffer: issues with 3rd party stuff will surface over time.

opsec / infosec tips around mobiles. Vgl re:publica [[Berlin 2014]]

overview of European alternatives for digital products. Not in all relevant categories (payments e.g.) but some novel providers in there.

Explore wrt [[Infosec ladder van techniek en gedrag 20190530190335]] in context TGL.

https://web.archive.org/web/20240422104417/https://www.ncsc.nl/actueel/nieuws/2024/april/18/cybercheck-ook-jij-hebt-supply-chain-risicos

NSCC over supply chain risico's mbt digitale diensten/producten. Kijk de check eens door op dingen voor [[Infosec ladder van techniek en gedrag 20190530190335]] TGL.

This SME focused cybersecurity company called Huntress in their position offer mention an 'enterprise poverty line' for cybersecurity. In the Mastodon message announcing it they call it 'the cybersecurity poverty line'. Meaning a Coasean floor [[Vloer en plafond van organiseren 20080307115436]] I assume?

Collection of real-word vulnerabilities, from this presentation.

How chromium's file: scheme security decisions came to be?

OTR base.

[A request to] Make DKIM-signed emails deniable by regularly publishing the secret keys.

Compare Android (full-disk) vs Apple (file-based) encryption strategies.

Cross-domain vulnerability