How `Shamir Secret Sharing` Works

// related

• #0001

  #0001OtherSimon Willison7 hours ago

  AI-assisted security reports are overwhelming `curl` maintainers

  40radar

  AI is raising both the volume and quality of security reports. The bottleneck shifts from finding bugs to triaging them, a real maintenance cost for any public project.

  • —Incoming curl security reports are 4-5x higher than 2024 and now average more than one per day.
  • —Report quality is higher: detailed, credible submissions reduce noise but raise review workload sharply.
  • —Recent curl vulnerabilities are still LOW or MEDIUM; better discovery does not automatically mean severe risk.
  • —Public libraries and APIs need a triage path before opening the floodgate to AI-generated reports.

  Source: simonwillison.net/2026/May/26/the-pressure/#atom-everythRead original →
• #0002

  #0002OtherSimon Willison16 hours ago

  `Microsoft Copilot Cowork` File Exfiltration via Prompt Injection

  50radar

  Copilot CoworkMicrosoft 365 agent tool — automates workplace tasks

  Agent-written email became a data leak path. External images plus OneDrive pre-auth links make approval gates non-optional for file-capable agents.

  • —Copilot Cowork could email the user's own inbox without approval, creating an indirect outbound channel for compromised agents.
  • —Rendered external images can trigger attacker-controlled network requests. That turns normal email viewing into data exfiltration.
  • —OneDrive pre-authenticated download links raise the blast radius: leaking a link can expose the file without another login step.
  • —Any agent with file access, messaging, and web-rendered content needs explicit approvals and blocked remote fetches by default.

  Source: simonwillison.net/2026/May/26/copilot-cowork-exfiltratesRead original →
• #0003

  #0003OtherGeekNews2 days ago

  `gokrazy/rsync` Uses Go Memory Safety to Avoid Recent `rsync` CVEs

  40radar

  gokrazy/rsyncGo rsync implementation — minimal scope with memory safety focus

  Memory-safe defaults turn several bug classes into panics or zero values. Useful as a security design reference, but panics still mean DoS risk.

  • —Reviewed against 12 `rsync` vulnerabilities disclosed in January 2025 and May 2026; the value is in concrete bug-class mapping.
  • —Go bounds checks convert heap overflows into panic, reducing memory corruption risk but not eliminating availability failures.
  • —Zero initialization can neutralize stack information leaks by returning harmless values instead of stale memory.
  • —gokrazy/rsync is a minimal implementation, so it is more relevant as a design reference than a drop-in full rsync replacement.

  Source: news.hada.io/topic?id=29863Read original →