"The first and most important field of philosophy is the application of principles such as 'Do not lie.' Next come the proofs, such as why we should not lie. The third field supports and articulates the proofs, by asking, for example, 'How does this prove it? What exactly is a proof, what is logical inference, what is contradiction, what is truth, what is falsehood?' Thus, the third field is necessary because of the second, and the second because of the first. The most important, though, the one that should occupy most of our time, is the first. But we do just the opposite. We are preoccupied with the third field and give that all our attention, passing the first by altogether. The result is that we lie - but have no difficulty proving why we shouldn't."

Welcome to September!

Security, General:

Several agents will run git status before controls are in place, and in an untrusted repo that has implications (patching progress varies): https://www.manifold.security/blog/ai-coding-agents-git-hijack

Security, Apple Platforms:

I mentioned this ongoing story about macOS Screen Sharing CVEs recently, but after sending, I changed the BBB web version link to an article instead of the original writeup I had chosen, because I wasn't sure if the original writeup was the right explanation for this newsletter, which is intended to be for engineers with an interest in this platform who want to know what's happening in their security milieu. Now, Csaba Fitzl has written the in-depth writeup of my dreams about this multiphase (and, to a very small extent, multidrama) bug variant and CVE series, which I think should be interesting to anyone engineering on this platform, so, without further ado, Screen Sharing part 2: https://www.iru.com/blog/inside-the-screensharingd-bugs-how-macos-screen-sharing-went-from-root-file-access-to-pre-auth-compromise

Interesting Paper:

“Reporting the breach, protecting the reporter: whistleblowing at the intersection of NIS2, the Cyber Resilience Act and Directive (EU) 2019/1937” by Fabian Teichmann: https://link.springer.com/article/10.1365/s43439-026-00174-8

Interesting Tool:

I'm really enjoying these rude "stream the experts from an SSD and run a way-too-many-parameters model somewhat slowly on underprovisioned Silicon" local LLM optimization hacks, so here is slotstream, for doing it with Qwen3.8-Flash-Next with MLX, and it looks like it supports MTP too: https://github.com/carloslfu/slotstream

Apple Platforms Security Concept of the Week:

HomeKit Camera Security https://support.apple.com/en-euro/guide/security/sec525461d19/1/web/1

Berlin Bassline Brief concept of the week:

I have an announcement of my own, which is that Cate Huston from DRI Your Career (and so much more) and I have developed a course called Breaking Into the Security Mindset. It is a values-first approach to getting to grips with the new application security realities, for engineers and engineering managers, and if this sounds like a topic you've been wondering about lately, you can check it out right here: https://www.driyourcareer.com/security

See you next week!