This Fedora Magazine guide demonstrates how to use a TPM2 chip with clevis and systemd-cryptenroll to automatically unlock LUKS-encrypted partitions at boot.

It explains TPM2 PCRs (Platform Configuration Registers), trust assumptions, prerequisites, and step-by-step commands.

It gives concrete commands and workflow: install clevis packages, regenerate the initramfs with dracut, bind a LUKS device using clevis luks bind, use systemd-cryptenroll, and update /etc/crypttab.

• Automates disk unlocking using a TPM-bound secret to avoid typing a passphrase each boot.
• Uses PCR measurements (e.g., 1,4,5,7,9) to restrict unlocking to a specific, measured boot state.
• Notes the need to rebind after kernel or initramfs updates and provides clevis luks regen and unbind instructions.
• Warns about security trade-offs and firmware/manufacturer trust, citing BitLocker research as a cautionary example.
• Includes troubleshooting tips (delay plymouth prompts, dracut regeneration) and links to further resources.

Suitable for users who want convenience while accepting the platform-trust tradeoffs and who keep passphrase backups.

CISA tracks vulnerabilities that are knowingly exploited in their KEV catalog. This information is useful for prioritization of vulnerabilities.

This website offers a ranking of many computer security conferences. The ranking is accompanied by a yearly acceptance ratio statistic.

WhySoNil's DNS guide explains DNS as the internet's distributed "phonebook", designed for speed and scale.

It covers transport (UDP on port 53 with TCP fallback), namespace delegation (root → TLD → authoritative), and the importance of caching and TTL.

It details zone files, common record types (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV), and glue records.

It explains performance and resilience techniques such as anycast and multi-layer caching.

It summarizes security: DNSSEC for integrity and DoT/DoH/DoQ for encrypted transport, with practical trade-offs.

It includes practical debugging commands and tools (dig, dig +trace, dig +dnssec, nslookup, dog) and pointers to DNSViz and intoDNS for visualization.

Key takeaways:

• DNS is optimized for small, fast UDP queries; TCP is the fallback for large responses.
• TTL-driven caching scales DNS but requires careful TTL management during changes.
• DNSSEC provides integrity, not privacy; DoH/DoT/DoQ add privacy but shift trust to providers.
• Use dig and dig +trace to diagnose delegation, caching, and DNSSEC issues.

The page also includes a short self-check quiz and links to RFCs and Cloudflare learning for further reading.

Ben Hardill reviews the DNS records that support email security and deliverability for hardill.me.uk. The post explains SPF, DKIM and DMARC as TXT records and gives concrete examples. It shows MX records for mail routing and options for client auto-configuration using SRV or .well-known. It covers MTA-STS (TXT + HTTPS file) to enforce TLS for inbound delivery and TLS-Reporting for telemetry. The author demonstrates parsing DMARC reports (zipped XML) with parsedmarc and a visualizer to inspect compliance. Practical tips include SPF syntax, DKIM selectors, DMARC rua reporting, and the t=s flag for subdomains.

The European Union Vulnerability Database tracks and scores vulnerabilities. It uses the EUVD- prefix for their identifiers, but has references to other identifiers like CVE and GHSA. The entries are enriched with information about the current exploitation, the Exploit Prediction Scoring System (EPSS), and Common Vulnerability Scoring System (CVSS). Lastly, vulnerabilities that are coordinated by EU Computer Security Incident Response Team (CSIRT) are marked.

GitHub's Advisory Database tracks CVEs and all GitHub advisories. Contributions to GitHub advisories are possible.

Global Security Database (GSD) is a project run by the Cloud Security Alliance to collect and track vulnerabilities. Conceptually it is similar to CVEs but with an open collaborative contribution process. Data from other vulnerability databases is imported and managed together.

This entry summarizes multiple public services for checking whether personal data appears in leaked databases.

• https://sec.hpi.de/ilc/: HPI Identity Leak Checker is an academic service that searches an HPI research database for email addresses and related personal data, returns obfuscated notifications by email, and emphasizes privacy and research use.
• https://monitor.mozilla.org/: Mozilla Monitor scans known breaches for your email, offers free scans and continuous monitoring, and guides users through remediation while respecting user privacy.
• https://haveibeenpwned.com/ Have I Been Pwned is a widely-used public breach index that provides email and domain search, Pwned Passwords, APIs, and subscription alerts for individuals and organizations.
• https://leakchecker.uni-bonn.de/ Uni Bonn LeakChecker is a university-operated tool (powered by Identeco) that tests email accounts against leaked datasets and returns results by email with clear privacy notices.

The website offers a feed showing which CVEs are exploited in the wild. The entries contain a date and link to the original source. It also contains a feed for available exploits.

The Known Exploited Vulnerabilities Catalog is a project by the Cybersecurity & Infrastructure Security Agency (CISA) tracking actively exploited vulnerabilities. The data includes the vulnerability, the affected product, a brief description of the vulnerability, and remediation actions. The data is available in machine-readable format.

The OWASP Cheat Sheet Series was created to provide a concise collection of high-value information on specific application security topics. These cheat sheets were created by various application security professionals who have expertise in specific topics. The website contains cheat sheets on a wide area of topics. The all cheat sheets are available as download.

osv.dev is a vulnerability database or open-source projects. It mainly acts as an aggregator for multiple other databases. For example, data from Google's OSS-Fuzz project and various language-specific vulnerability databases is combined.

The System Security Circus by Davide Balzarotti presents many statistics about the Top-4 security conferences, such as authors and affiliations.

The website lists all known speculation side channel attacks. Each attack contains information about the attacked buffer, the affected vendors, and working state. They are sorted into a hierarchy. Each attack is also linked to proof-of-concepts and the academic papers.

deps.dev is a dependency analyzer for multiple language ecosystems (npm, Go modules, Maven, PyPI, Cargo). It shows basic information, such as the metadata (including license) about each package, dependencies, and reverse dependencies. It enhances this information by adding a diff viewer for the versions. Security advisories affecting a package or dependency are highlighted. The OpenSSF scorecard is also integrated, showing more insights about the project health.

The second feature of the website is an advisory viewer. It shows details about each advisory, including affected versions. It also calculates how much of the ecosystem is affected and patched.