Soursen

Independent writing on infrastructure, AI, security and crypto.

Security

Security covers vulnerabilities and the software supply chain, checked against the advisory or the incident report that records what failed.

Banner for “Mac vs Windows on Privacy, What the Settings Actually Do, and Where Each One Leaks”

Security

Mac vs Windows on Privacy, What the Settings Actually Do, and Where Each One Leaks

Most people run either Windows 11 or macOS, and both collect data, hand some of it to governments, and run advertising businesses. I went through what each system actually knows about you, what you can switch off, and where the real differences are, using the published numbers rather than brand loyalty. If privacy is your top priority the honest answer is neither of them, and I will get to that.

12 min read

Banner for “The Arch AUR Keeps Getting Hit With Malware, and the Fixes All Cost Something”

Security

The Arch AUR Keeps Getting Hit With Malware, and the Fixes All Cost Something

On 13 October 2026 an account mass uploaded a pile of packages to the Arch User Repository that looked like the popular helper yay and ran code the attacker controlled as root the moment you installed them. It was the fourth malware wave on the AUR in about 15 months. I went through what actually happened, how the trick worked at the file level, and why the obvious fix is the one thing that would stop the AUR from being the AUR.

11 min read

Banner for “eMudhra’s CA Keys Were Compromised Because a Private Key Was the Number 4.”

Security

eMudhra’s CA Keys Were Compromised Because a Private Key Was the Number 4.

In October 2026, Mozilla and Google confirmed that 8 intermediate signing keys from eMudhra, 1 of the few Indian certificate authorities trusted globally, had private keys a laptop can guess in under a second, including 1 that was literally the integer 4. I went through how a secret that should be 116 digits long collapsed to single digits, how browsers shut it down in under 3 hours, why your backend servers may still be exposed, and why, for a certificate authority, the incident is survivable but the response decides everything.

12 min read

Search