L’OWASP aggiorna dopo 4 anni la sua lista delle TOP10 relativa ai rischi più pericolosi per le applicazioni web, aggiungendo due nuove categorie e rivedendo la struttura della classifica.

L’organizzazione ha pubblicato una bozza della versione 2025 che risulta aperta ai commenti fino al 20 novembre. Questo documento è una versione quasi definitiva della Top 10 di OWASP, che riflette le attuali minacce per sviluppatori e amministratori web.

Come nell’edizione precedente, il Broken Access Control è rimasto al primo posto. Questa categoria è stata ampliata per includere anche levulnerabilità SSRF, che in precedenza si classificavano al decimo posto.

La Security Misconfiguration si classifica al secondo posto, in crescita rispetto al quinto della classifica del 2021. I problemi relativi alla supply-chain invece si classificano al terzo posto. Si tratta di una versione ampliata della categoria Componenti vulnerabili e obsoleti, che comprende problemi e compromissioni nell’ecosistema delle dipendenze, nei sistemi di build e nell’infrastruttura di distribuzione. Secondo OWASP, questi rischi erano tra le principali preoccupazioni della comunità professionale durante il sondaggio.

Seguono Cryptographic Failures, Injection (incluse XSS e SQL injection) e Insecure Design: tutte e tre le categorie hanno perso due posizioni, occupando rispettivamente il quarto, quinto e sesto posto. Authentication Failures, Software or Data Integrity Failures e Logging & Alerting Failures hanno mantenuto le posizioni precedenti, dal settimo al nono posto.

Una nuova categoria nella top ten è “Gestione errata di condizioni eccezionali”, che conclude l’elenco. Include errori nella gestione delle eccezioni, risposte errate alle anomalie, gestione impropria degli errori e guasti logici che si verificano in condizioni operative di sistema non standard.

Le 10 principali modifiche OWASP rispetto al 2021 (OWASP)

I rappresentanti dell’OWASP hanno sottolineato che la struttura dell’elenco del 2025 differisce da quella del 2021. L’analisi ora tiene conto del numero di applicazioni testate durante l’anno e del numero di sistemi in cui è stata rilevata almeno un’istanza di una specifica CWE (Common Weakness Enumeration).

Questo approccio consente di monitorare la prevalenza delle vulnerabilità nell’intera gamma di prodotti testati, indipendentemente dal numero di occorrenze dello stesso problema all’interno di una singola applicazione. Per l’analisi sono state utilizzate 589 CWE, rispetto alle sole 30 del 2017 e alle circa 400 del 2021.

Per valutare la sfruttabilità e l’impatto tecnico, OWASP ha utilizzato i dati CVE, raggruppandoli per CWE e calcolando i valori medi in base ai punteggi CVSS. A causa dei limiti dei test automatizzati, sono state selezionate solo otto categorie sulla base di questi dati. Le restanti due sono state ricavate da un sondaggio della comunità in cui gli esperti hanno identificato i rischi che consideravano più critici nella pratica.

La classifica OWASP Top 10 2025 riflette quindi uno spostamento dell’attenzione della comunità dai classici errori di implementazione ai problemi di configurazione, architettura e supply chain che portano sempre più spesso a compromessi nelle moderne applicazioni web.

L'articolo OWASP Top 10 2025: le nuove minacce per le applicazioni web, Supply chain tra le prime tre proviene da Red Hot Cyber.

Fatto spiacevole: quello dei dati personali è un mercato molto appetibile e di particolare valore per i cybercriminali, per motivi tutt’altro che difficili da immaginare. Non parliamo solo di scam o furti d’identità, ma di un complesso di attività illecite che possono trovare impiego nei modi più disparati. Questo riguarda sia i dati esposti online sia quelli reperiti all’interno dei marketplace del dark web, con il comune intento di realizzare dei guadagni diretti o indiretti.

Appreso che un utilizzo indesiderato dei nostri dati personali esiste ed è anzi una buona fetta di mercato per i cybercriminali, a questo punto, potremmo ritenere che tutta la normativa sulla privacy sia totalmente inutile. Insomma: se un cybercriminale vuole commettere una serie di attività illecite, certamente l’essersi procurato i nostri dati personali violando le regole probabilmente non è neanche degno di essere contrassegnato come “ultimo dei suoi problemi”. Ma bisogna ragionare sul perché i nostri dati personali diventano tanto facilmente reperibili, scoprendo così attraverso pochissimi passaggi logici che una maggiore attenzione da parte di chi svolge operazioni sugli stessi a riguardo ne ridurrebbe la disponibilità.

Per quanto non sia possibile avere uno scenario in cui il rischio di vedere i nostri dati personali impiegati in attività illecite viene azzerato, può essere desiderabile quanto meno uno in cui il saccheggio degli stessi sia particolarmente difficoltoso e il bottino meno remunerativo. Insomma: è chiaro che nel momento in cui i costi superano le opportunità, solitamente un cybercriminale desiste. A meno che non sia particolarmente motivato, ovviamente.

Questo però richiede una premessa. Ogni soggetto che raccoglie e impiega i dati personali è chiamato a garantire la protezione dei dati personali per tutta la filiera in cui sono svolte operazioni sugli stessi, andando così ad attenzionare proprio quegli aspetti rilevanti individuati dalla norma. Ovverosia: verificare che i dati siano lecitamente acquisiti, ne siano definite le finalità e vengano raccolti e conservati solo i dati necessari a perseguire le stesse.

Ovviamente, tenendo conto che ogni operazione deve essere svolta in sicurezza.

Non c’è privacy senza sicurezza.

L’aspetto che emerge è indubbiamente quello della sicurezza, per logica e rilevanza. Questo è richiamato non solo dalla norma, ma si pone come premessa: il trattamento in sicurezza dei dati personali garantisce una mitigazione per i rischi che incombono sull’interessato. Senza sicurezza, non può infatti parlarsi di protezione adeguata.

Un generale e più elevato livello di sicurezza contrasta il mercato del cybercrimine, ma questo richiede un effort condiviso da più attori ovverosia tutti i soggetti che svolgono operazioni sui dati. L’orientamento è fornito dalla normativa che obbliga a ragionare su quali dati raccogliere, perché e soprattutto per quanto tempo. Motivare ogni passaggio comporta una maggiore attenzione, e una maggiore attenzione consente di superare tutta una serie di criticità collegate a inconsapevolezza, incuria e disattenzione.

Ecco dunque che il rispetto della privacy – intesa nella sua accezione di protezione dei dati personali – è la premessa affinché i dati siano trattati in modo sicuro. O meglio: più sicuro rispetto allo scenario alternativo in cui non ci sono i presidi imposti dalla norma.

Il fattore culturale.

Un approccio culturale che tiene conto dei rischi per gli interessati richiede che i soggetti che decidono sulle sorti dei dati personali sono responsabilizzati ma anche una maggiore attenzione diffusa al tema. Questo comporta che le garanzie di protezione dei dati personali sono criteri di selezione. Certo, parliamo di garanzie percepite e dunque può essere possibile una strategia di privacywashing, ma un utente o consumatore esprime una domanda di servizi più attenti al rispetto della norma e quindi maggiormente sicuri.

Questo, di fatto, aumenta il costo per il cybercrime in questo ambito.

Meno dati facilmente disponibili comporta infatti costi maggiori.

It’s the market, baby.

L'articolo Non è il dark web a vendere i tuoi dati. Sei tu che li metti in saldo ogni giorno! proviene da Red Hot Cyber.

[Juan] describes himself as a software engineer, a lover of absurd humor, and, among other things, a player of Nethack. We think he should add computer game archaeologist to that list. In the 1990s, he played a game that had first appeared on USENET in 1987. Initially called “Middle-earth multiplayer game,” it was soon rebranded with the catchier moniker, Conquer.

It may not seem like a big thing today, but writing multiplayer software and distributing it widely was pretty rare stuff in the late 1980s or early 1990s. In 2006, [Juan] realized that this game, an intellectual predecessor to so many later games, was in danger of being lost forever. The source code was scattered around different archives, and it wasn’t clear what rights anyone had to the source code.

[Juan] set out to find the original authors [Edward Barlow] and [Adam Bryant]. Of course, their e-mail addresses from USENET were long dead. With persistence, he finally found [Barlow] in 2006. He was amenable to [Juan] porting the code over, but didn’t know how to contact [Bryant].

[Juan] continued to leave posts and follow up leads. He did eventually find [Bryant], who read one of the posts about the project and offered his permission to GPL the code. This was in 2011, nearly five years after the release from [Barlow]. He also discovered there was a third author who was also game. Unfortunately, [Richard Caley] had already passed away, so there was no way to obtain his release.

You can compare the original version with the new updated version from [Juan]. A software accomplishment worthy of Indiana Jones.

We love digging through old code. Especially for software that was especially influential.

hackaday.com/2025/11/11/resurr…

Ahoy Pirates,

Our next PPI board meeting will take place on 18.11.2025, 14:00 UTC / 15:00 CET.

All official PPI proceedings, Board meetings included, are open to the public. Feel free to stop by. We’ll be happy to have you.

Where:jitsi.pirati.cz/PPI-Board

Agenda: Pad: https://etherpad.pp-international.net/p/ppi-board-meeting-2025-08-05-vnly0cj

All of our meetings are posted to our calendar: pp-international.net/calendar/

We look forward to seeing visitors.

Thank you for your support,

The Board of PPI

pp-international.net/2025/11/p…

PPI’s main delegate at the United Nations Office of Geneva, Mr. Carlos Polo, attended events of the Environmental Programme (UNEP) this August. We attach some pictures of his visit, and we offer some comments about the efforts of our organization in helping to shape environmental policy.

The UNEP oordinates environmental work across the UN, but it is not the only organization. The UN has now created the UN Convention to Combat Desertification (UNCCD), the Convention on Biological Diversity (CBD), and the United Nations Framework Convention on Climate Change (UNFCCC). Each organization deals with separate environmenal issues and hosts its own conferences that include negotiations between nations and sometimes ask for statements and opinions of NGOs like our own. Currently the UNFCCC is hosting the COP conference in Brazil.

Carlos was able to observe the UNEP negotiations, but as we are not a nation (aka Party) we do not have a voice. Furthermore, we are not yet members of any of these conventions. PPI needs to establish more direct activities that promote environmental protection so that we can be accepted as members of these organizations, in addition to the Economic and Social Affairs Committee (ECOSOC) where we are already members.

We are hoping to make a bigger impact on international environmental governance. As an NGO, our abilities are limited. NGOs often watch from the back of the room. Our speaking time is scarce. The actual negotiation where the decisions are made take place behind closed doors, and we are simply able to only provide statements at the conference or as a published policy statement. One additional opportunity is that we can host side events. We have discussed cohosting a side even with other NGOs. If anyone is interested in collaborating, please contact us.

board@pp-international.net

Donations

pp-international.net/donations…

pp-international.net/2025/11/g…

There are many applications out there that use more than one window, with every modern-day platform and GUI toolkit offering the means for said application to position each of its windows exactly where it wants, and to restore these exactly in the configuration and location where the user saved it for that particular session. All toolkits but one, that is, for the Wayland project keeps shooting down proposals. Most recently merge request #264 for the ext-zones protocol by [Matthias Klumpp] as it descended into a 600+ comments spree.

This follows on an attempt two years prior with MR#247, which was rejected despite laying out sound reasons why the session protocol of Wayland does not cover many situations. In the breakdown video of the new ext-zones protocol discussion by [Brodie Robertson] the sheer absurdity of this whole situation becomes apparent, especially since KDE and others are already working around the Wayland project with their own extensions such as via KWin, which is being used commercially in e.g. the automotive world.

In a January 2024 blog post [Matthias] lays out many of his reasonings and views regarding the topic, with a focus on Linux desktop application usage from a scientific application perspective. When porting a Windows-, X11- or MacOS application to Wayland runs into compatibility issues that may necessitate a complete rewrite or dropping of features, the developer is more likely to stick to X11, to not port to Linux at all, or to use what eventually will amount to Wayland forks that patch around these missing API features.

Meanwhile X11 is definitely getting very long in the tooth, yet without it being a clean drop-in replacement it leaves many developers and end-users less than impressed. Perhaps the Wayland project should focus more on the needs of developers and end-users, and less about what it deems to be the One True Way?

youtube.com/embed/_MS8pSj-DLo?…

hackaday.com/2025/11/11/waylan…

Over on the [Behind The Code with Gerry] YouTube channel our hacker [Gerry] shows us how to emulate a 74LS48 BCD-to-7-segment decoder/driver using an Altera CPLD Logic Chip From 1998.

This is very much a das blinkenlights kind of project. The goal is to get a 7-segment display to count from 0 to 9, and that’s it. [Gerry] has a 74LS193 Up/Down Binary Counter, a 74LS42 BCD to Decimal Decoder, and some 74LS00 NAND gates, but he “doesn’t have” an 74LS48 to drive the 7-segment display so he emulates one with an old Altera CPLD model EPM7064SLC44 which dates back to the late nineties. A CPLD is a Complex Programmable Logic Device which is a kind of precursor to FPGA technology.

This fun video runs for nearly one hour and there are all sorts of twists and turns. The clock is made from a 555 timer. The Altera USB Blaster is used to program the CPLD via JTAG. But before he can do that he has to re-enable JTAG on his CPLD because JTAG LOCKOUT has been used on his secondhand chip. JTAG LOCKOUT is something you can do so that you can use the various JTAG pins for other purposes in your design, at the cost of no longer being about to access via JTAG! Fortunately [Gerry] has the right equipment to do a full reset of his chip and thus reinstate JTAG support.

Just as he’s nearly finished his project he manages to short out and destroy his CPLD by dropping a wire into the wall power socket! Talk about unlucky! He has to go back to the drawing board with a similar model. And in the end he realizes he used the the 7447 (common anode) but actually needed the 7448 (common cathode), so he has to fix that up too. All in all it’s fun to see what was state-of-the-art back in 1998. If you’re interested in such things you might like to read Not Ready For FPGAs? Try A CPLD.

youtube.com/embed/0WAaH37rmEk?…

hackaday.com/2025/11/11/emulat…

Riportiamo la traduzione del post pubblicato da Patrick Breyer sul suo blog Poco prima di un incontro decisivo a Bruxelles, l’esperto di diritti digitali ed ex membro del Parlamento europeo, il Dott. Patrick Breyer, lancia l’allarme. Con un “ingannevole gioco di prestigio”, un controllo obbligatorio e ampliato della messaggistica privata viene imposto dalla porta sul retro…

Source

Do you know your neighbors?

How familiar are you with the person who lives next door to or above you? Down the street or down the hall? Across the street and kitty-corner from where you live?

Did they grew up in the town or city you both live in? Did you? Did they serve? Did you? Are they a U.S. citizen? Are you?

Are you sure?

Is the qualification “I was born here”? What if your parents weren’t? Did you come here legally? Are you white enough? Are you the right kind of Christian?

What if you’re not Christian? What if you’re something non-Abrahamic at all? Let’s pretend you’re a Sikh.

In fact, let’s pretend you are Bhagat Singh Thind.

So who are you? You’re Bhagat Singh Thind, born October 3rd, 1892 near Amritsar, Punjab in what is today modern day India. You come to the United States around just 20 years old and, just five years later, you’re recruited by the U.S. Army to fight in the Great War, the War to End All Wars, or as it has sadly become known, World War I.

Recruited in July, honorably discharged by December. Thank you for serving your country.

A week before your discharge, you receive your certificate of U.S. citizenship while wearing your U.S. Army uniform. Except, three days before your discharge, the federal government catches wind of the news and revokes it. After all, you’re a “Hindoo” (you’re not; you’re a Sikh) and not a “white man”, so no citizenship for you.

Thanks for nothing.

So you try again. You move from Washington to Oregon and you apply for citizenship around five months later. The federal official that revoked your citizenship the first time goes to the Oregon judge and tries to sabotage your chances.

The judge, taking into account your arguments for citizenship and your military record, grants you citizenship for the second time. Thank you for serving your country.

Not satisfied, the Bureau of Naturalization, who this whole time has been seemingly out to get you and refusing to let this be a precedent, appealed to the higher courts until landing before the Supreme Court.

Their task was to answer these two questions:

“Is a high caste Hindu of full Indian blood, born at Amritsar, Punjab, India, a white person within the meaning of Section 2169, Revised Statutes?”

(Again, you are Sikh.)

&

“Does the act of February 5, 1917 (39 Stat. L. 875, Section 3) disqualify from naturalization as citizens those Hindus, now barred by that act, who had lawfully entered the United States prior to the passage of said act?”

They find the answer to the first question is “No”, making the second question moot. You’re not white, so you cannot be naturalized. The Bureau of Nationalization strips you for a second time in 1926.

Thanks for nothing.

It wouldn’t be until the mid 1930s when Congress passed into law that all WWI veterans would be granted citizenship, regardless of race. For a third time, you seek citizenship.

This time, you finally get it. It’s the real thing, the Bureau of Nationalization isn’t breathing down your neck, and you are finally a U.S. citizen. Thank you for serving your country.

This all happened roughly 100 years ago, but the question of “what is a citizen” remains at large and, as was before, at the whim of the State. Bhagat Singh Thind was finally granted citizenship not because of a reversal of the Supreme Court’s decision, but because of a law by Congress that honored WWI veterans. Not goodwill, but a just reward for military service.

So what is a citizen? Is it someone who shows they are willing to die and kill for their country? Is it someone who won the “born under the right circumstances” lottery that did nothing otherwise to “earn” their citizenship? Is a citizen someone who pays taxes and nothing else? Is it who the State decides is worthy? Are you always going to just agree with what the State says?

If you take a step back, you might realize “Does any of that really matter?”. Someone like Bhagat Singh Thind, who served in the U.S. Army, had to jump through countless hoops to received that illustrious seal of approval from Uncle Sam. But if he was living next door to you, and he served your country, and he was shopping in the same stores and sent his kids to the same school. Would you care about his legal status? Or would you see him as your neighbor?

Bhagat Singh Thind was finally granted that citizenship as a thank you for serving in the Army during WWI. Not every immigrant in this country can or will put their life on the line for the whims of the U.S. government. Hell, there are people born in this country that won’t do that. Your commitment to the state apparatus nationwide shouldn’t matter in a local setting.

How committed are you to your neighbors? To me, that is the truest sense of community and belonging. The local stuff, the stuff that impacts you, matters far more than national narratives.

The United States Pirate Party preaches to anyone seeking office to “run locally” because “it is where the impact will be felt the most”. Service to your neighbors and community, where you rest your head at night, is a cause we champion. Our ideals are applied nationwide, but felt most locally.

The USPP also believes in the free movement of all Americans, from Greenland to Patagonia. We don’t believe the imaginary lines drawn on a map should be inhibiting of the people who share this great American continent.

So when people speak of “illegal immigrants” living in communities across the United States, it strikes me as ridiculous. Uncle Sam said my neighbor is illegal? Why? Didn’t come here the right way? Didn’t get your permission to cross an imaginary line and enter society as essentially a lower caste laborer?

If you are upset by the state narratives of “illegal immigration”, I ask you: what about them coming here bothers you? It doesn’t flatter you that they left everything behind to start a new life where you call home? Is it the taxes? You feel like your hard earned money is being taken and they somehow have it easy?

First of all, these migrants are all almost certainly renting. So the landlord would be paying taxes… with their money.

Second, if they aren’t paying income tax, is that because they aren’t receiving a check, since tax is automatically deducted? If they’re being paid income cash, who is to blame? Are they to blame for taking it, or do you point the figure at the business owner who gave a job to them and decided to pay them under the table.

That job wasn’t stolen, and certainly not by the immigrant. Can the so-called “job creator” really ever allow the jobs they create and give out to be “stolen”? Or did they willingly pay someone cheaper instead of someone in a position to demand more.

Do not let the State turn you against your neighbors when they are trying to live like you. Do not allow Uncle Sam to cause you to fail to see the humanity of your neighbors.

Don’t be terrorized and made fearful. They are human; they bleed like you.

As of writing, the United States of America has decided to unleash masked terrorists onto the streets of cities across the U.S. in order to corral and correct what it calls an “illegal immigrant problem”. This organization is named “ICE”.

Before continuing, I must affirm something to you, dear reader. Merriam-Webster defines “terrorism” as “the systematic use of terror, especially as a means of coercion”. Further, they define “terror” as “violence or the threat of violence used as a weapon of intimidation or coercion”.

Now, dear reader, consider what ICE is doing. Simply ask: is ICE using violence or the threat of violence as a weapon of intimidation or coercion?

It was recently Halloween, and kids were unable to peacefully Trick-or-Treat in certain Chicagoland locations due to ICE harassment, including tear-gassing.

ICE, in their raids and targeting, has arrested “legal” citizens. They have arrested parents in front of their children. They have made arrests in South Shore, Chicago, in the middle of the night via a warrant-less raid and informed the residents they’d “only be released if they had no outstanding warrants”.

The State decides whether or not you’re upstanding and “worthy”. It doesn’t matter if you go through all the proper rigmarole or serve the country. It doesn’t matter if you think you’re white enough. The State is the final authority in the matter.

But you know better. You know your neighbors are good people just trying to make an honest living. You know the crime of “falsifying” is a common one. You’ve seen kids use fake addresses to get into better school districts. You’ve had friends of friends not change their ID, despite not living in a specific state full time and instead continuing to pay to that state. You know the system isn’t followed to a T by everybody.

You know, deep down, this entire thing is bullshit.

Uncle Sam is a fickle dude with some skeletons in his closet. These skeletons are, unfortunately, in the front yard. He can decide you’re unworthy of citizenship if he so chooses.

When Washington D.C. tells you from thousands of miles away to turn on your back on your neighbor because they’re “not a citizen”, I want you to remember that they are still your neighbor.

And to the volunteer officers of ICE: thanks for nothing.

uspirates.org/through-the-spyg…