标签：#IDE

Device Code Flow abuse is not a new technique. Security teams have known for some time that this OAuth feature can be leveraged in phishing attacks to obtain tokens without stealing credentials. What is new is how accessible and scalable this attack has become. In April 2026, the FBI warned about a Phishing-as-a-Service (PhaaS) platform called Kali365, which operationalizes this exact technique. It allows even low-skilled attackers to run campaigns that trick users into entering device codes on legitimate Microsoft login pages — ultimately granting attackers OAuth tokens and acess to Microsoft 365 environments without triggering traditional authentication defenses. How Device Code Flow Works Device code flow is an authentication method designed for scenarios where a device has limited input options or lacks a convenient browser interface (such as smart TVs, IoT devices, or command-line tools). Instead of entering credentials directly on the device, the application generates a verification code and displays it. The user then switches to a secondary device (such as a laptop or smartphone), navigates to https://microsoft.com/devicelogin , and enters the provided code. After successfully authenticating, the identity provider securely links the session and grants the original device access to the requested resource. Why Device Code Flow Should Be Restricted In practice, many organizations don’t have a real or current business need for device code flow, yet leave it enabled—unnecessarily expanding their attack surface. Disabling it helps reduce exposure by removing a legacy or rarely used authentication path and reinforces modern controls. Microsoft recommends getting as close as possible to a full block. Start by auditing existing usage, validate whether any legitimate scenarios still require it, and strictly limit access only to well-defined, secured, and documented use cases (e.g., specific legacy tools). In all other cases, device code flow should be disabled by defau

I tested the top sleep wearables for every type of sleeper, including devices from Oura, Whoop, and Eight Sleep.

This isn't a tutorial. It's real experience. Most articles about making money with Python are vague: "Learn Python to make money" (then what?) "Do data analysis freelancing" (how to get clients?) "Write web scrapers" (legal gray area) I'll share my actual path: building an Excel template generator with Python, listing it for sale, and earning my first dollar. Why This Direction My background: Know Python, but not expert Made some automation scripts No product design experience Want products (scalable) not services (time-for-money) The opportunity: Huge Excel template market (many 10k+ sales on Gumroad) Templates are static, hard to customize I can make a "template generator" for customization Technical feasibility: Python's openpyxl generates Excel programmatically JSON config is user-friendly ~300 lines of code The Product Not an Excel file. A Python script that generates Excel files . Users get: generator.py - generator code config.json - configuration README.md - documentation Workflow: Edit config.json → Run python generator.py → Get customized Excel Technical Implementation Core code is simple: from openpyxl import Workbook from openpyxl.styles import Font , PatternFill wb = Workbook () ws = wb . active # Header style header_fill = PatternFill ( start_color = ' 6366F1 ' , fill_type = ' solid ' ) header_font = Font ( bold = True , color = ' FFFFFF ' ) # Write header ws [ ' A1 ' ] = ' Project Name ' ws [ ' A1 ' ]. fill = header_fill ws [ ' A1 ' ]. font = header_font # Add dropdown from openpyxl.worksheet.datavalidation import DataValidation dv = DataValidation ( type = ' list ' , formula1 = '" In Progress,Completed,Paused "' ) ws . add_data_validation ( dv ) dv . add ( ' B2:B100 ' ) wb . save ( ' output.xlsx ' ) Loop to create sheets, set styles, add validation. Productization Process Step 1: MVP One module only (knowledge base) Test generation Use myself for a week Step 2: Expand Add 6 modules Add JavaScript version (using exceljs ) Improve docs Step 3: Package

The Enhanced Games — a singular sporting competition where a majority of the athletes were on performance enhancing drugs — may herald a new business model that the tech industry is ready to embrace.

GitHub - nikhilt101/email-blast-tool: Open source HTML email sender tool using CSV/XLSX + Gmail SMTP · GitHub Open source HTML email sender tool using CSV/XLSX + Gmail SMTP - nikhilt101/email-blast-tool github.com

Forget the pricey, postpaid cell plans and two-year contracts. Save with one of these WIRED-tested options from US Mobile, Boost, and Google Fi.

I sifted through the fine print and figured out how to score the best deal right now on all the major carriers.

Having a server at home opens up a huge range of possibilities. I'd been thinking about setting one up for a while, and when I finally got started, I realised that half the process was simply deciding what to buy and what to install. So what is a home server actually good for? There are obvious advantages like cutting SaaS costs or gaining privacy, but there's one that matters more to me than all the others: learning . In this post I'll walk through the process, the options I considered and why I ended up building my server around a Beelink S12 Pro running Proxmox VE . Why a mini PC? The first decision is form factor. The most common options are: An old PC or laptop from the cupboard. It works, but it's usually noisy, consumes a lot of power and takes up too much space. A Raspberry Pi. Small and incredibly power-efficient, but limited in RAM and processing power for running several services at once. A NAS. A solid choice if storage is the main priority, but the price climbs quickly. A mini PC. Small, silent, low power consumption, reasonable price. Clear winner. The mini PCs I considered In 2025, there are three families that make sense for a home lab: Intel N95 / N100 is probably the most popular choice right now for this kind of use. Very good energy efficiency, full virtualisation support and highly competitive prices. The N100 is more efficient than the N95; the N95 wins slightly on raw performance but at the cost of a bit more power draw. There are countless manufacturers building models around these chips, and the difference between them is usually minimal: what varies is the connectivity, the stock RAM and the after-sales support. Mac Mini deserves a mention because it's one of the most well-known options on the market. Performance is excellent and power consumption is surprisingly low, but for me the problem is the price — clearly higher than a Chinese mini PC — and I don't need something like that to get started. Fanless mini PCs (no fan). Fully passive mod

Criei um gerenciador de downloads desktop em Python e quero feedback da comunidade! O PyFlowDownloader é um app desktop feito com Python + PySide6 que usa yt-dlp para baixar vídeos e áudios de forma assíncrona do youtube. Algumas coisas que ele já faz: Fila de downloads com progresso em tempo real Cancelamento de downloads ativos ou pendentes Suporte a MP4 e MP3, de 144p até 1080p Histórico com exportação para CSV Interface desktop com tema visual via QSS Build para Windows via PyInstaller + pipeline de release no GitHub Actions Está na versão v0.3.0 e ainda tem muito espaço pra crescer. Repositório: https://github.com/Vinny00101/PyFlowDownloader Se você puder **testar e deixar sua opinião nos comentários, ficaria muito grato! Quer saber: O que achou da experiência de uso? Algum bug que encontrou? O que você adicionaria ou melhoraria no projeto? Todo feedback é bem-vindo!

I'm a builder. I taught myself to run servers because freelancers kept burning my money. West London, 2021. I was standing on a site holding a cup of tea that had gone cold an hour earlier, watching a crew argue about where a wall should go. That's my actual job. Schedules, suppliers, the kind of problems that only exist at 7am when half the crew hasn't shown up and the client is already phoning. But my head was somewhere else. I'd been chewing on an idea for a classifieds platform for months. Not a grand vision, nothing with a business plan and projections. Just a gap I could see — a way to connect buyers and sellers that felt easier and more global than what was out there. The problem was that I knew nothing about programming. And I mean nothing. I didn't know what a database was. I'd never written a line of code. My entire technical CV was "reasonably good at not breaking my own phone." So I did what most people in my position do. I tried to buy my way in. The expensive year I found a ready-made classifieds script online. Looked professional, had features, didn't cost the earth. The smart shortcut, I told myself. Then I hired a freelancer to customise it. Then another one, when the first disappeared mid-project. Then another, when the second delivered something that worked on a good day and fell over on a bad one. Here's the thing nobody warns you about hiring freelancers when you can't read code: you can't judge the work. You can't tell the difference between someone who wrote something clean and someone who duct-taped it together to last until the invoice clears. Both show you the same thing — a screen where the button does what the button's meant to do. So you pay, you say thanks, you move on. And three months later the button stops working and the freelancer's gone. Meanwhile the bots had found me. Within weeks of going live, automated scripts were hammering the contact form, then the registration page, then the login. "It's normal," a freelancer told me. "Ha

The Enhanced Games — a singular sporting competition where a majority of the athletes were on performance enhancing drugs — may herald a new business model that the tech industry is ready to embrace.

Dads are traditionally tough to shop for—let me help with these handpicked gift ideas for fathers with great taste.

The botnet was reportedly tied to a Russia-based residential proxy network.

Send the pool guy packing. Let one of these robotic buddies maintain your water quality instead.

High school graduation is a time of change that might be felt more deeply by family members than by the grads themselves. While some grads may immediately embark on a career path, many continue their education and delve deeper into their studies at college. Either way, they'll be taking on more responsibility, meaning it's up […]

A lot of Linux incident response starts with a login question, not a malware sample. Someone sees a spike of failed SSH attempts. A root login appears in the wrong time window. A service account logs in from an address nobody recognizes. A helpdesk ticket says "the server looks weird" and the only concrete clue is a username or IP address. At that point, the useful question is not "is this host compromised?" It is more boring and more important: Did anyone actually authenticate? Which account was involved? Was it password, key, sudo, su, or a scheduled task? Was the same IP seen in web logs, current sockets, process context, or command history? Did persistence, services, packages, or recent files change near the same time? Can another responder review exactly what evidence was collected? That last point matters. If you let an AI assistant freely run shell commands during the first pass, you can get speed, but you also create a new risk: the model may over-collect, mutate the host, or produce a confident answer that nobody can audit later. For a login anomaly, I prefer a read-only evidence loop. A practical first pass Start with the narrow clue if you have one. If the alert names a user: oi login --user root -s 7d If the alert names an IP address: oi login --ip 203.0.113.44 -s 7d If the alert is vague, start wider: oi login -s 7d oi scan -s 7d The goal of the first pass is not to prove every detail. The goal is to build a timeline that a human responder can challenge. For a suspicious SSH login, I want the initial report to answer five things. 1. Authentication pattern Look for the difference between noise and access. A server can receive thousands of failed SSH attempts from the internet. That is useful background, but it is not the same as a successful session. The first split should be: failed attempts only successful login after many failures accepted key from an unusual source login by an account that normally should not be interactive root login where root SSH

Stop fumbling for cables in the dark. These WIRED-tested stands and pads will take the hassle out of refueling your phone, wireless earbuds, and watch.

Consoles with disc drives are the easiest way to enjoy all kinds of physical media, but that could end with the next-gen PlayStation 6 and Microsoft's Project Helix.

Someone asked us a sharp question on X this week. Tokenized stocks will drop dividends straight on-chain, so do we see any downsides? It's a fair question, and the honest answer is yes, one big one. The downside isn't the dividend itself. Instant, programmatic, no broker statement to wait for: that part is genuinely good. The downside is that you can't see it. On-chain dividends for tokenized equities are silent. They arrive without a transaction, without a notification, without anything landing in your wallet history. And a payment you never see is a payment you never declare. That's not a tracking annoyance. It's a tax problem, and it gets expensive. The dividend that never sent a transaction Backed Finance's xStocks (the Xs-prefixed mints like AAPLx, TSLAx, NVDAx) and Ondo Global Markets equities (the ondo-suffixed mints) both use the SPL Token-2022 ScaledUiAmount extension. It's an elegant piece of engineering. When the underlying stock pays a dividend, the issuer doesn't airdrop tokens to thousands of wallets. It updates a single number, a multiplier, on the mint account itself. The instant that multiplier changes, every wallet holding the token shows a larger balance. Your 10 shares are now worth the equivalent of 10 shares plus the reinvested dividend. No transfer hit your wallet. No transaction was signed. Nothing appeared in your activity feed. The number simply went up. Compare that with a traditional brokerage. When Apple pays a dividend, you get a line on a statement, an email, a figure on a 1099 or an annual tax summary. The paperwork chases you. On-chain, nothing chases you. The dividend is real, it's yours, and the only evidence it happened is a multiplier value buried in an on-chain mint account that almost nobody thinks to read. Why a number going up is a taxable event Here's the part that catches people. Dividend income is ordinary income. It's taxable in the year you receive it, at your marginal rate, in every jurisdiction we serve: Australia, the

I recently launched LuaPlay, a free browser-based Lua editor. No setup, no install — just open the site and write Lua. Why I built it: Every time I wanted to test a quick Lua snippet, I had to either open a local environment or use tools that weren't built for Lua specifically. So I built my own. What it does: Run Lua scripts directly in the browser Clean, minimal editor interface Free to use Would love feedback from the dev community. What features would make you actually use it day-to-day? 👉 https://luaplay.online