That free beer has a brewer
Information is only scarce when somebody makes it so, and the people who refuse to make it scarce are the ones rewarded least. They are carrying a load they can’t bear forever.
#security
7 articles
Forking the JVM to Save JINI
Java stripped out the SecurityManager and offered nothing in its place. Peter Firmstone's answer: fork Apache River and OpenJDK to bring back both JINI and JVM-level authorization. Laudable, even necessary - and a very hard sell, because it runs only on his JDK. It's like a post-mortem for JINI while it's still trying to breathe.
AI Vendors are Silently Installing Things For You.
Alexander Hanff has documented two AI-vendor stealth installs in two weeks: Claude Desktop registering Native Messaging bridges across seven Chromium browsers, and Chrome writing 4GB of Gemini Nano weights to disk on every eligible device.
Securing Claude Code: Guardrails for AI-Assisted Development by Jim Manico
Jim Manico of Manicode Security showed OWASP London a disciplined approach to bootstrapping projects with Claude Code using scripted prompts that generate ARCHITECTURE, SECURITY, and CLAUDE files in sequence, each reviewed and committed before the next. His core rule: Claude never writes code directly - every change becomes a tracked GitHub issue first, giving developers review points and audit trails throughout.
Miasma - a Poison Pill for Scrapers
Miasma is a new project in Rust that creates a maze of twisty passages, all alike, for AI scrapers. It's got documentation to protect "good" scrapers, and creates nonsense for "bad" scrapers, but the problem isn't as simple as "punish AI for existing."
Kotauth: a Self-hosted Authentication Platform
Anderson Fariña tagged a release candidate of Kotauth, a "docker-oriented full authentication service inspired by keycloak." It could fulfill a very real gap: authorization and authentication services tend to be very low-ceiling until they're not. If you've had to wrestle with Keycloak or are dreading the Auth0 renewal quote, this project might be very interesting.
ByteCode.news UI design concerns
I've been trying to think about access control and data access patterns for ByteCode.news. One of the initial designs was based around having pluggable UIs. The actual app is a set of REST endpoints...