Lawfare has a good article by Jim Baker (former legal council for the FBI) on a new way to think about encryption. You'll agree with some, disagree with some, but it will make you think.
https://www.lawfareblog.com/rethinking-encryption
From the Standard Vulnerability List: "When a session ends, first select the session ID from the client, then delete the session information from the server, then finally return the user to the login page." Session management matters, people.
https://arstechnica.com/information-technology/2019/10/five-months-after-returning-rental-car-man-still-has-remote-control/
Google is doing its "we are the Web so we will decide how it works" thing again, and threatening to enable samesite by default in Chrome. Here's some analysis of that.
https://www.jardinesoftware.net/2019/10/28/samesite-by-default-in-2020/
Speaking of Chrome nad running the web, here's El Reg's take on DNS over HTTPS:
https://www.theregister.co.uk/2019/10/29/chrome_dns_https/
Oh, and still speaking of Google and glass houses and stone throwing, there's an 0-day in Chrome.
https://www.bleepingcomputer.com/news/security/chrome-zero-day-bug-with-exploit-in-the-wild-gets-a-patch/
You know that stupid goose game your kid is playing? There is an insecure deserialization flaw in it.
https://pulsesecurity.co.nz/advisories/untitled-goose-game-deserialization
And finally, a good talk out of BSides Belfast about supply-chain attacks. Code review your open source libraries, folks!
https://www.infosecurity-magazine.com/news/bsidesbelfast-supply-chain/
Busy week! But that's the news.
Subscribe