Shows
Tech UnpluggedSnowflake Introduction and History: A Beginner's Tutorialnowflake, a modern cloud data warehousing platform. The speaker outlines the video series' comprehensive approach to learning Snowflake, covering its history, architecture, unique features, and practical implementation. It highlights how Snowflake's design addresses limitations of traditional data warehouses with independent scaling of storage and compute. The content promises hands-on experience, tutorials, and discussions on real-world applications across various data workloads. The series aims to equip viewers with the knowledge needed for Snowflake implementation and even certification. This podcat specifically covers Snowflake's origins, its innovative cloud-native architecture, and the evolution of data warehouse platforms.
2025-04-1337 min
SublimetechieteluguEe Extension Safe Aa? Manifest.json ni decode cheddam!Browser extension install cheyyaka mundu… koncham careful ga observe cheyyali andi! Ee episode lo, SublimeTechietelugu meeku chepthundhi about manifest.json file – inka site access, host_permissions, content_scripts lanti keywords ki meaning enti ani!Chinna file ni decode cheddam and reveal the browser secrets! Funny ga, tech tips tho and slight Telugu accent tho – only in this episode!Don’t miss it – Tenglish lo security, drama andi!
2025-04-1345 minTech UnpluggedQR Codes: Security and ApplicationsThis podcast collectively describe QR codes, their functionality, and the escalating threat of QR code phishing, often called "quishing." They explain that QR codes are two-dimensional barcodes capable of storing various data types and designed for rapid scanning. However, cybercriminals are increasingly exploiting this technology by embedding malicious links in QR codes to deceive users into visiting harmful websites or downloading malware, aiming to steal personal information. The sources also discuss methods for individuals and organizations to protect against these attacks, including verifying the source, using secure readers, previewing URLs, implementing security software, and educating users about the risks.
2025-04-1223 minTech UnpluggedOWASP TESTING GUIDEThis podcast outlines the fundamentals of Web API testing, focusing on security considerations. It explains core concepts like REST architecture, URI structure, HTTP request methods and response codes, and common web authentication mechanisms such as Bearer Tokens, HTTP Cookies, and Basic HTTP authentication. The text then details generic and specific testing methodologies for APIs, including endpoint discovery, bug exploitation with examples like IDOR and privilege escalation, and in-depth techniques for testing token-based authentication, particularly concerning JWTs, including potential vulnerabilities and brute-forcing weak secrets. Finally, it lists related test cases and useful tools for API security assessment
2025-04-1029 minTech UnpluggedChrome Extension: A Technical Deep DiveThe landscape of browser extension security, highlighting both the utility and the inherent risks associated with these tools. Several articles emphasize the importance of understanding and managing extension permissions to prevent potential data leaks, malicious activities, and compliance violations. Various security solutions and best practices are discussed for individuals and enterprises to assess, monitor, and control browser extensions effectively. Furthermore, some sources analyze specific malicious extensions and their techniques, while others provide guidance on how to vet extensions and test their security. Ultimately, the information underscores the need for heightened awareness and proactive measures to navigate the security challenges...
2025-04-0924 minTech UnpluggedInvestigating LLM Agent Vulnerabilities: The Red Teaming ExperienceThis podcast analyzes the susceptibility of modern language models to various attack techniques, revealing vulnerabilities at both the textual and architectural levels despite existing safeguards. The author emphasizes the models' inherent trust and literal command execution as key exploitable traits. To mitigate these risks, the text proposes several short-term recommendations for developers and companies. These include isolating sensitive data from prompts, training models to detect malicious inputs and obfuscation, validating critical commands with human confirmation, sandboxing potentially harmful output, and conducting continuous red teaming exercises. Ultimately, the author stresses that proactive identification and patching of weaknesses are...
2025-04-0919 minTech UnpluggedAI Gateway: Features and UsageThis podcast introduces Portkey, an AI gateway and observability platform designed to streamline the development and deployment of AI applications. It highlights features such as managing API access to multiple LLM providers, offering tools for monitoring performance, costs, and usage, and providing capabilities for prompt management, caching, fallbacks, and security guardrails. Additionally, the documentation covers integrations with various AI models and development frameworks, and discusses enterprise-level features for governance and deployment, aiming to simplify the complexities of working with diverse AI technologies.
2025-04-0922 minTech UnpluggedSecuriti and Javelin: Enterprise AI Security PlatformsThis podcast explore the burgeoning field of LLM firewalls as a critical security measure for applications utilizing large language models. These sources highlight the unique risks associated with LLMs, such as prompt injection, data leakage, and model abuse, which traditional firewalls are ill-equipped to handle due to the integrated nature of data and operations within LLMs. Several companies, including Securiti AI, Nightfall AI, Javelin AI, and Raga AI, are developing specialized LLM firewalls that function as intermediaries to inspect and filter prompts, retrieved data, and generated responses based on defined security policies. While essential for mitigating risks, some sources...
2025-04-0920 minTech UnpluggedAccurate eBPF Flow Log AttributionEngineers addressed the problem of inaccurately attributing network flow logs to specific workloads in their cloud environment. Their initial system, relying on IP address change events, suffered from misattribution due to delays in event propagation. To resolve this, they implemented a new method using eBPF on workload instances to directly associate local IP addresses with workload identities, sending these logs to a centralized FlowCollector. This FlowCollector then uses the local IP and timestamp information to deduce and subsequently attribute remote IP addresses by tracking IP ownership over time. The improved system, which handles regional differences and non-workload IPs, significantly...
2025-04-0918 minTech UnpluggedMicrosoft Azure Security Technologies: Certification and BeyondThis podcast provides in-depth explanations and hands-on exercises across areas such as identity and access management with Azure AD, network security implementation using firewalls and WAF, securing compute and storage services including containers and databases, and managing security operations with Azure Monitor and Sentinel. Both resources emphasize practical application and understanding of Azure security best practices
2025-04-0830 minTech UnpluggedRed Team Tools: Cyber Threats and Open Source Insightsintersection of open-source red teaming tools and malicious cyber activities conducted by cybercriminals and nation-state actors. It highlights the dual-use nature of these tools, originally intended for security testing, and their increasing adoption in sophisticated attacks, including supply chain compromises. The paper discusses methodologies for managing open-source threats, including AI-based identification and a unique triage process for analyzing GitHub repositories. Furthermore, it explores the evolution of red teaming and the emergence of paid services for managing and utilizing red teaming resources, alongside the potential future impact of AI in generating malicious tools. Ultimately, the research emphasizes the critical need...
2025-04-0719 minTech Unplugged💻 Windows API and IAT: A Deep DiveThe podcasts collectively explore the Windows API from various perspectives, including its fundamental role in Windows programming, its use in red teaming and cybersecurity, and considerations for testing applications that utilize it, specifically large language models.C++ examples for red team operations using Windows APIs, to a guide on leveraging these APIs in C# with P/Invoke, and discussions on red teaming methodologies for AI systems. Additionally, there's an introduction to the core concepts of the Windows API, a description of a course focused on developing red teaming tools using it, and documentation for the Chrome Windows API. These...
2025-04-0720 minTech UnpluggedExploiting Next.js CVE-2025-29927 for Authorization BypassCVE-2025–29927, a critical security flaw in the Next.js web framework. The author, coffinxp, details how this vulnerability allows attackers to bypass middleware authorization, potentially leading to unauthorized access to protected resources. The article clarifies the purpose of Next.js middleware and how the specific flaw in its request handling enables this bypass. Furthermore, it suggests the article will explore how developers can secure their Next.js applications against such exploits.
2025-04-0721 minTech UnpluggedIndustrial Cybersecurity: Threats, Mitigation, and ResilienceThis podcasts extensively cover industrial cybersecurity, focusing on monitoring, threat hunting, vulnerability assessments, and incident response within industrial control systems (ICS) and operational technology (OT) environments. A significant portion details the architecture and security of ICS networks, including the importance of network segmentation and the industrial demilitarized zone (IDMZ). Furthermore, the sources examine specific threats and vulnerabilities targeting PLCs and other ICS components, offering detection and prevention strategies, and they also illustrate practical penetration testing and red/blue team exercises in simulated industrial scenarios
2025-04-0625 minTech UnpluggedUnderstanding Vector Databases: Semantic Search and AIVector databases are introduced as a solution to the limitations of traditional databases when handling unstructured data by representing it as vector embeddings, which are numerical arrays capturing semantic meaning. These databases enable similarity searches based on conceptual relationships rather than exact matches. Embedding models, trained on vast datasets, generate these vector embeddings, and vector indexing techniques like HNSW and IVF ensure efficient searching within the high-dimensional vector space. A key application highlighted is Retrieval Augmented Generation (RAG), where vector databases store knowledge for Large Language Models to access and ground their responses.
2025-04-0613 minTech UnpluggedBuilding & Selling AI Agents: A Beginner's GuideThis podcast explains the fundamental concepts of AI agents and their ability to automate tasks by utilizing various tools. This podcast demonstrates the practical application of these concepts through four distinct no-code agent-building projects using platforms like Relevance AI, n8n, Voiceflow, and customized own platform, Agentive. These builds cover use cases such as a sales co-pilot, automated lead qualification, a customer support and lead generation agent accessible via both web chat and phone, and a WhatsApp-based agent. The podcast emphasizes the potential for monetizing AI agent skills by assisting businesses with AI understanding and implementation, rather than solely...
2025-04-0624 minTech UnpluggedProgramming Language Security Vulnerabilities: An OverviewSeveral sources discuss software vulnerabilities across different programming languages. One source highlights a specific vulnerability, CVE-2024-27322, in the R programming language. Another examines the potential of memory-safe languages like Rust, Go, and Python to mitigate a significant portion of security bugs prevalent in languages such as C and C++. Additionally, one article ranks the top five programming languages of 2022 (Python, PHP, Java, Ruby on Rails, and C) based on their cybersecurity risks and suggests best practices. A research paper provides a systematic review comparing coding vulnerabilities and their severity across various languages, noting that C and C++ often...
2025-04-0622 min
Tech UnpluggedKubernetes Series part-2Core concepts like pods, deployments, services, and nodes, while also covering more advanced topics such as ConfigMaps, Secrets, Helm, and cluster management. Rudi Martinsen's blog post specifically examines Ingress, detailing its function in routing external traffic and the necessity of Ingress controllers. practical kubectl commands and example configurations.Kubernetes topics, including TLS certificates, authentication, authorization (RBAC), network policies, cluster setup using Kubeadm, Docker volumes, persistent storage, networking (CNI), Ingress, logging, monitoring, and troubleshooting control plane and worker node failures,#Kubernetes #K8s #CloudComputing #DevOps #Containerization #Microservices #SRE #Coding #TechInnovation #Automation #Docker #OpenSource #ClusterManagement #CloudInfrastructure #Scalability #GlobalTech #TechTrends...
2025-04-0527 minTech UnpluggedLLM Agent Reasoning Hijacking: Vulnerabilities and MitigationAgent Reasoning Hijacking affecting LLM agents that use chain-of-thought reasoning and external tools. This flaw allows attackers to inject adversarial strings that manipulate the agent's thinking process, leading it to perform unintended malicious actions like data theft or unauthorized access. The sources detail how this attack works, its potential impact on various LLM models and real-world applications, and recommend several mitigation strategies such as input sanitization and reasoning monitoring to defend against it. The research paper "UDora" is highlighted as a key resource for understanding and addressing this significant threat to LLM agent security.
2025-04-0404 minTech UnpluggedMongoDB and Open Source Technologies OverviewThis podcast offer a comprehensive overview of MongoDB, a NoSQL database, highlighting its flexible data handling, scalability through sharding, and features like implicit collection creation and document manipulation using methods like insertOne() and deleteOne(). Security aspects, including data encryption at rest and the importance of regular backups, are discussed alongside its support for unstructured data. Additionally, the resources touch upon broader application security testing principles from OWASP, emphasizing the need for proactive and integrated security measures throughout the software development lifecycle to identify and mitigate vulnerabilities like injection flaws and cross-site scripting. Finally, a curated list of self-hosting software...
2025-04-0422 minTech UnpluggedAI Cyber Risk & Operational SecurityThis podcast AI-specific threats like data poisoning and prompt injection, differentiating them from traditional security concerns due to AI's non-deterministic nature and evolving vulnerabilities. The sources also discuss the application of AI to enhance security practices, such as threat detection, incident response, and automation, while highlighting the necessity of securing AI systems themselves against attacks. Furthermore, they address the role of Managed Security Service Providers (MSPs) in navigating these complexities and the unique challenges they face in a rapidly evolving AI-driven threat environment, emphasizing the need for proactive measures and specialized security approaches for AI applications throughout their lifecycle.
2025-04-0329 minTech UnpluggedNVIDIA Cosmos World Foundation Models for Physical AINVIDIA Cosmos is a platform detailed in a research paper and related NVIDIA resources, aiming to advance Physical AI for robots and autonomous vehicles. It provides pre-trained World Foundation Models (WFMs) capable of generating future video frames from various inputs like images and text, addressing the challenge of limited real-world training data by enabling the creation of numerous simulated scenarios. The platform includes tools for efficient video data curation and tokenization, along with guardrails for safety, and encourages open access for developers to fine-tune models for specific applications, with research showing promising results in tasks like camera control and...
2025-04-0325 minTech UnpluggedSaaS Integration Security Architecture ReviewSecurity architecture reviews for integrating SaaS applications. It outlines a structured process, including defining scope, assessing provider security, and considering data, identity, API, and compliance aspects. Furthermore, it features questionnaires and checklists to guide the review process, ensuring comprehensive evaluation of potential risks and adherence to security best practices and regulatory requirements. The sources emphasize a proactive approach to safeguarding organizational ecosystems when adopting cloud-based services.
2025-04-0228 minTech UnpluggedMicrosoft SQL Server and Its ArchitectureMicrosoft SQL Server as a relational database management system designed for storing and retrieving data for various software applications. It outlines the client-server architecture of SQL Server, highlighting three core elements: the Protocol Layer for connectivity, the Relational Engine for query processing, and the Storage Engine for data management. The text further explains the components within each of these layers and briefly discusses some advantages of using SQL Server. Finally, it illustrates how an application interacts with the database server in a typical web environment.
2025-04-0229 minTech UnpluggedPostgreSQL: A Beginners GuidePostgreSQL, an open-source relational database system. It introduces fundamental concepts, such as installation, database creation, table design with data types and constraints, and basic data manipulation through SQL queries. The guide also touches upon more advanced topics like indexing for performance and the importance of database backup and restoration. Through a practical example, the author aims to equip newcomers with the initial knowledge to start working with PostgreSQL and explore its broader capabilities.
2025-04-0131 minTech UnpluggedComprehensive SQL Command ReferenceStructured Query Language (SQL), a standard language for database interaction. It meticulously details various SQL commands, categorizing them into DDL for structure definition, DML for data manipulation, DCL for access control, TCL for transaction management, and DQL for data retrieval. The document further explains fundamental SQL operations like creating and modifying tables, inserting, updating, and deleting data, alongside querying techniques using SELECT statements with clauses such as WHERE, ORDER BY, and GROUP BY. Moreover, it elucidates advanced concepts including joins for combining tables, constraints for data integrity, the handling of NULL values, and the use of views as virtual...
2025-03-3013 minTech UnpluggedPortswigger Interesting Vulnerabilities SubmissionsThis podcast cover a range of cybersecurity vulnerabilities and attack techniques. One source details the reverse engineering of an Android application leading to a remote code execution exploit. Another explores a novel perspective on Server-Side Request Forgery for account takeover. Cross-Window Forgery, a new class of web attack exploiting HTML ID attributes, is also examined. Additionally, the increasing cyber threats to EV charging infrastructure and the role of penetration testing in mitigating them are discussed. Research into exploiting "unexploitable" aspects of Kibana, including remote code execution and prototype pollution, is presented. Furthermore, the concept of smuggling SQL injection queries...
2025-03-2931 minTech UnpluggedWindows Persistence Tactics: Red Team InsightsIn this podcast, we explore Windows persistence mechanisms used by Red Teams to maintain access in compromised systems. We’ll cover common tactics such as registry modifications, scheduled tasks, WMI persistence, DLL hijacking, and user account manipulation. Learn how adversaries leverage these techniques to evade detection and ensure long-term control. We’ll also discuss real-world examples, detection strategies, and defensive countermeasures. Whether you're a Red Teamer, Blue Teamer, or security enthusiast, this episode will deepen your understanding of Windows persistence techniques. Tune in to gain practical insights into offensive security and threat hunting.
2025-03-2926 minTech UnpluggedLLM-Driven Autonomous Penetration Testing on Enterprise NetworksThis research investigates the use of autonomous systems driven by Large Language Models (LLMs) for Assumed Breach penetration testing in enterprise networks. The authors developed a novel prototype capable of compromising accounts within a real-life Active Directory testbed. Their evaluation highlights the prototype's strengths and limitations in simulating attacks, using a realistic environment to capture complex network behaviors. The study concludes that autonomous LLMs show promise for democratizing access to penetration testing. The prototype's code and analysis are publicly released to foster further research in LLM-driven cybersecurity automation.
2025-03-2832 minTech UnpluggedAzure App Registration: Types, Risks, and Best PracticesThis podcast offers a comprehensive overview of Azure App Registrations, a key component for secure application interaction with Azure services. It begins by detailing the various types of Azure application registrations, explaining their characteristics and use cases. The report then thoroughly examines the risks and security concerns associated with improper configuration and management of these registrations, citing potential vulnerabilities and real-world examples. Finally, it provides extensive best practices and recommendations to mitigate these risks and ensure secure implementation within the Azure environment.
2025-03-2625 minTech UnpluggedEnterprise Security ArchitectureStrategy and Implementation focuses on designing and implementing a structured security framework aligned with business objectives. It emphasizes risk management, governance, and security controls to protect enterprise assets. The book covers security architecture principles, frameworks like SABSA, TOGAF, and Zero Trust, and integrating security into enterprise IT systems. It provides guidance on threat modeling, identity and access management (IAM), cloud security, and regulatory compliance. Practical case studies illustrate real-world implementations. The goal is to create a resilient, adaptable security posture that supports business growth while mitigating risks.
2025-03-2618 minTech UnpluggedSecuring Mobile Apps: iOS, Android & Intune Best PracticesIn this episode, we explore Microsoft Intune and its role in securing devices, data, and applications within Microsoft 365 environments. We break down Intune’s capabilities for device management, cloud security, and hybrid architectures. iOS and Android security measures, platform-level protections, and potential risks are covered in detail. We also walk through practical implementation steps, including device enrollment, policy configuration, and app deployment. Finally, we discuss how built-in Microsoft 365 security features—like MFA and Advanced Threat Protection—can strengthen overall security posture. Tune in for an in-depth look at securing enterprise environments with Intune.
2025-03-2621 minTech UnpluggedDNS Rebinding: The Hidden Backdoor to File AccessDNS Rebinding can turn a victim’s browser into a proxy to bypass Same-Origin Policy (SOP), enabling Server-Side Request Forgery (SSRF). By rapidly changing DNS records, an attacker tricks a web app into accessing internal resources or local files. This bypasses SSRF protections that rely on domain allowlists. If the app fetches file URLs (e.g., file:///etc/passwd), an attacker can exfiltrate sensitive system files. Such attacks can expose internal dashboards, cloud metadata, or even take over services.Beyond file access, DNS rebinding can target internal APIs, stealing credentials, executing admin commands, or even launching further ex...
2025-03-2626 minTech UnpluggedSatellite Hacking: Real-World Attack Analysis and Cyber ThreatsSatellite systems face increasing cybersecurity threats across their lifespan, impacting critical functions and necessitating international legal cooperation. These vulnerabilities span launch systems, communications, and ground infrastructure, with hostile acts ranging from kinetic attacks to cyber disruptions like jamming and data manipulation. Research reveals that satellite broadband services have significant security and privacy weaknesses, often exploitable with inexpensive equipment, impacting millions of users and critical maritime operations. The absence of robust encryption and the reliance on performance-enhancing proxies create eavesdropping and data manipulation risks. Consequently, there's a growing need for improved security measures, novel encryption techniques optimized for satellite communications...
2025-03-2623 minTech UnpluggedHazelcast Comprehensive PodcastA Hazelcast podcast typically covers topics related to real-time data processing, in-memory computing, distributed systems, and caching solutions. The discussions often explore how Hazelcast's in-memory data grid (IMDG) and real-time stream processing engine help businesses improve performance, scalability, and resilience in modern applications.Key Themes in a Hazelcast Podcast:Introduction to Hazelcast:Overview of in-memory computing and how Hazelcast accelerates data processing.Use cases in microservices, IoT, AI/ML, and financial services.Real-Time Stream Processing:How Hazelcast enables real-time analytics and decision-making.Integration with Kafka, Apache Spark, and cloud-native architectures.Distributed Systems & Scalability:Benefits of horizontal...
2025-03-2626 minTech UnpluggedIngress NGINX: Critical Unauthenticated Remote Code Execution VulnerabilitiesWiz Research disclosed critical unauthenticated remote code execution (RCE) vulnerabilities, collectively named #IngressNightmare, affecting the Ingress NGINX Controller for Kubernetes. Exploiting these flaws could allow attackers to gain complete control over Kubernetes clusters by accessing all stored secrets. The vulnerabilities, identified as CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974, stem from the unauthenticated network access to the admission controller and the ability to inject malicious NGINX configurations. The research details how these injections, particularly through annotation parsers and the mirror UID, combined with a code execution vulnerability in the NGINX configuration testing phase, enable RCE by loading...
2025-03-2621 minTech UnpluggedSoftware Architecture: An Introduction to Basics and ConceptsThe podcast series "Tech Unplugged by SublimeTechie" introduces fundamental concepts in software architecture and distributed systems. The initial episodes cover core architectural principles, including maintainability, scalability, and the layered approach. As the series progresses, it delves into scaling strategies such as horizontal scaling and caching, along with the challenges of distributed environments and the CAP theorem.Further discussions explore event-driven architecture, distinguishing between events and commands, and explaining the Saga pattern for handling transactions in microservices. The podcast also covers event sourcing and CQRS for effective state management and query optimization. Additionally, it highlights the importance of...
2025-03-2619 minTech UnpluggedCKA Course Intro - Part 1n this episode, we kick off our Certified Kubernetes Administrator (CKA) journey! Get an overview of what the CKA certification entails, its importance in the DevOps and cloud-native ecosystem, and the key topics covered in the exam. Whether you're a beginner or an experienced engineer, this introduction will set the stage for mastering Kubernetes administration. Stay tuned for hands-on insights and expert tips! 🚀 #Kubernetes #CKA #DevOps #CloudNative
2025-03-2623 minTech UnpluggedThree Threads of AI EthicsThis podcast examines the burgeoning field of AI Ethics, which the author argues lacks systematic organization due to its rapid, voluminous, and multidisciplinary growth. To address this, the author proposes a tripartite framework, categorizing AI ethics into Ethics and AI, focusing on the alignment of AI's functional characteristics with pre-existing ethical norms; Ethics in AI, concerned with embedding ethical and political commitments into AI's structural design; and Ethics of AI, which investigates the mutual shaping of AI systems and communal practices within their implementation contexts. This categorization clarifies the distinct research questions, required expertise, and potential for misplaced criticisms...
2025-03-2626 minTech UnpluggedAdvanced AWS Security Architecture: Multi-VPC StrategyThe provided materials cover a range of Amazon Web Services (AWS) security and architecture topics. Several sources discuss best practices for securing cloud environments, including network security with VPCs and firewalls, identity and access management using IAM, data protection through encryption, threat detection with GuardDuty and Security Hub, and application security measures against common web vulnerabilities like XSS and SQL injection as outlined by OWASP and CIS Controls. Architectural patterns for building scalable and resilient applications are explored, highlighting the use of services like EC2 Auto Scaling, Elastic Load Balancing, RDS for databases, S3 and EFS for storage, and...
2025-03-2630 minTech UnpluggedNetflix: Scaling Storage for Millions of Daily Viewing HoursThe ByteByteGo newsletter article, drawing from the Netflix Tech Blog and Apache Cassandra documentation, explains how Netflix manages the massive scale of user viewing data generated daily. Initially relying on Apache Cassandra, Netflix faced challenges with increasing data volume from global expansion, new features like video previews, and inefficient data retrieval. To address these issues, Netflix redesigned its storage architecture by categorizing data, sharding it based on type and age, implementing optimizations like compression and caching, and automating data movement. This evolution allowed Netflix to improve storage efficiency, enhance retrieval speeds, and ensure a consistent user experience despite exponential...
2025-03-2425 minTech UnpluggedBuilding Large Language Models: Data, Evaluation, and SystemsThis YouTube transcript from a Stanford CS229 lecture provides an overview of building large language models (LLMs). It outlines key components for training LLMs, emphasizing architecture, training loss, data, evaluation, and system considerations. The lecture distinguishes between pre-training, focused on modeling internet text, and post-training, aimed at creating AI assistants. The discussion covers essential concepts like tokenization, evaluation metrics such as perplexity, and the critical role of data acquisition and scaling laws in LLM development. Furthermore, it touches upon post-training techniques like supervised fine-tuning and reinforcement learning from human feedback (RLHF), including its simplification through Direct Preference Optimization (DPO...
2025-03-2427 minTech UnpluggedOWASP Guide: Secure Code Review This podcast from OWASP serves as a guide for secure code review, aiming to help organizations build self-defending applications. It outlines the importance of manual code review in identifying security and logical flaws, often surpassing automated tools and penetration testing alone. The guide covers various aspects of code review, including integrating it into the software development lifecycle, establishing risk assessment, understanding application architecture, utilizing static analysis, and addressing common vulnerabilities categorized under the OWASP Top Ten. Furthermore, it provides specific guidance and code examples for reviewing security controls related to authentication, session management, cross-site scripting, insecure direct object references...
2025-03-2326 minTech UnpluggedAI Audit Checklist: Governance, Bias, Security, Explainability, Performance, EthicsThis podcast presents a comprehensive AI Audit Checklist designed for certified trainers and consultants. It outlines key audit areas spanning AI governance, regulatory compliance, bias detection, security, explainability, performance monitoring, deployment, ethics, and continuous monitoring. The checklist provides specific audit questions and methods to check compliance status, including references to standards like GDPR, ISO 42001, and NIST AI RMF. Furthermore, it details best practices for AI audit report writing and post-audit follow-up, emphasizing thorough documentation and continuous improvement in AI governance and risk management.
2025-03-2231 minTech UnpluggedConfiguring Windows Server Secured-coreThis podcast on "Configure Secured-core server for Windows Server" provides instructions on how to enable and verify Microsoft's Secured-core security features. It outlines necessary prerequisites like Secure Boot and TPM 2.0, and details configuration steps using the Windows Security app, Windows Admin Center, and Group Policy. The guide also explains how to confirm that Secured-core is successfully configured through system information and the Windows Admin Center interface. Ultimately, this resource serves as a how-to guide for administrators seeking to enhance the security posture of their Windows Servers.
2025-03-2124 minTech UnpluggedSoftware Testing Strategies and MethodologiesThis podcast offer a comprehensive overview of modern software testing practices. The text explores a wide array of testing methodologies, including functional, non-functional, and specialized techniques, emphasizing their application across the software development lifecycle. It discusses crucial aspects like test planning, environment setup, automation, performance optimization, and security concerns. Furthermore, the source examines advanced topics such as risk-based testing, data-driven analysis, the integration of AI and machine learning, and strategies for continuous improvement in testing processes. The document also addresses the significance of collaboration, effective communication, and legal compliance within the realm of software testing
2025-03-2129 minTech UnpluggedGetting Started with Microsoft GraphThis podcast explore Microsoft Graph API permissions and their use in accessing and managing Microsoft 365 services like SharePoint, Teams, and Entra ID (Azure AD). They cover topics such as permission types (delegated and application), best practices for applying the principle of least privilege, and the process of granting and managing these permissions through the Azure portal and Microsoft Graph PowerShell SDK. Furthermore, they discuss the security implications of different permissions, highlighting potentially risky ones and offering guidance on securing Graph tokens and restricting API access to specific resources like mailboxes. Some articles also touch on automating administrative tasks using...
2025-03-2028 min
2025-03-1926 minTech UnpluggedSecuring Active Directory: Key Review AreasThese YouTube transcripts feature Sean Metcalf from Trimarc Security discussing critical aspects of Active Directory (AD) security. The first source, a DerbyCon talk, outlines common AD security issues, methods for detecting reconnaissance, and techniques for hardening AD components. The second source is a Trimarc webcast focused on performing self-assessments of AD security, highlighting common vulnerabilities and providing PowerShell scripts to identify them. Both emphasize proactive security measures, proper configurations, and the importance of mitigating risks associated with AD
2025-03-1926 minTech UnpluggedSecuring Active Directory: Key Review AreasThese YouTube transcripts feature Sean Metcalf from Trimarc Security discussing critical aspects of Active Directory (AD) security. The first source, a DerbyCon talk, outlines common AD security issues, methods for detecting reconnaissance, and techniques for hardening AD components. The second source is a Trimarc webcast focused on performing self-assessments of AD security, highlighting common vulnerabilities and providing PowerShell scripts to identify them. Both emphasize proactive security measures, proper configurations, and the importance of mitigating risks associated with AD. I put these into one podcast where you can listen to Securing your enterprise environment
2025-03-1926 min
Tech UnpluggedBlockchain and Smart Contract Vulnerabilities: A Comprehensive AnalysisThis thesis provides a comprehensive analysis of security weaknesses prevalent in blockchain technology and smart contracts. It systematically categorizes various vulnerabilities and attack methods, drawing from research and real-world examples. The work examines threats ranging from flaws within smart contract code to network-level exploits and economic manipulation tactics. For each category, specific attacks are detailed, explaining their mechanisms, potential consequences, and recommended mitigation strategies. The research aims to equip developers, auditors, and researchers with a thorough understanding of the decentralized security landscape. Ultimately, it emphasizes the critical need for secure development practices and ongoing vigilance to build resilient blockchain...
2025-03-1928 min
Tech UnpluggedBlockchain and Smart Contract Vulnerabilities: A Comprehensive AnalysisThis thesis provides a comprehensive analysis of security weaknesses prevalent in blockchain technology and smart contracts. It systematically categorizes various vulnerabilities and attack methods, drawing from research and real-world examples. The work examines threats ranging from flaws within smart contract code to network-level exploits and economic manipulation tactics. For each category, specific attacks are detailed, explaining their mechanisms, potential consequences, and recommended mitigation strategies. The research aims to equip developers, auditors, and researchers with a thorough understanding of the decentralized security landscape. Ultimately, it emphasizes the critical need for secure development practices and ongoing vigilance to build resilient blockchain...
2025-03-1928 min
Tech UnpluggedAI-Driven Managed Detection and Response: A Brief OverviewThis document offers a comprehensive overview of AI-driven Managed Detection and Response (MDR), explaining its fundamental concepts and evolution within cybersecurity. It details how artificial intelligence enhances traditional MDR by automating threat detection and response, leading to greater efficiency and accuracy. The text highlights key differences between traditional and AI-driven MDR, emphasizing the advantages of automation, threat detection capabilities, and cost-effectiveness. It also identifies prominent cybersecurity vendors offering AI-powered MDR solutions and discusses the current challenges and limitations associated with this integration. Ultimately, the source positions AI-driven MDR as a significant advancement in cybersecurity with substantial potential for the...
2025-03-1912 min
Tech UnpluggedAI-Driven Managed Detection and Response: A Comprehensive OverviewThis document offers a comprehensive overview of AI-driven Managed Detection and Response (MDR), explaining its fundamental concepts and evolution within cybersecurity. It details how artificial intelligence enhances traditional MDR by automating threat detection and response, leading to greater efficiency and accuracy. The text highlights key differences between traditional and AI-driven MDR, emphasizing the advantages of automation, threat detection capabilities, and cost-effectiveness. It also identifies prominent cybersecurity vendors offering AI-powered MDR solutions and discusses the current challenges and limitations associated with this integration. Ultimately, the source positions AI-driven MDR as a significant advancement in cybersecurity with substantial potential for the...
2025-03-1912 min
Tech UnpluggedAutonomous Vehicle Cybersecurity Development LifecycleAutonomous Vehicle Cybersecurity Development Lifecycle (AVCDL) document, version 56. This document outlines a comprehensive framework of processes and requirements designed to ensure the cybersecurity of autonomous vehicle development. It details various phases of the lifecycle, from foundational elements like training and threat prioritization, through design, implementation, verification, release, operation, and decommissioning, specifying security considerations for each. Furthermore, it addresses the roles and responsibilities of different organizational groups involved and maps the AVCDL to relevant industry standards and regulations, including ISO/SAE 21434 and WP.29, to facilitate compliance.
2025-03-1815 min
Tech UnpluggedA Thorough Introduction to PASETOThe provided text introduces PASETO (Platform-Agnostic Security Tokens) as a modern and more secure alternative to JSON Web Tokens (JWTs), focusing on its design principles for creating secure, stateless tokens for web applications. The author explains the structure of PASETOs, detailing their version, purpose (local or public), payload, and optional footer. It clarifies how local (symmetric) and public (asymmetric) PASETOs function, including encryption and digital signatures, and their respective use cases. The text also covers PASETO claims and highlights the security advantages of PASETO over JWT, emphasizing its developer-first approach and clearer guidelines to prevent common security missteps.
2025-03-1823 min
Tech UnpluggedCar Hacking 101 Automotive Security Research Group presents a Car Hacking 101 talk focusing on in-vehicle networks. The speaker, Kamel, an automotive cybersecurity architect, introduces the concept of these networks as essential for communication between electronic control units (ECUs) within a vehicle. The lecture covers various types of in-vehicle networks, including CAN bus, LIN, FlexRay, CAN FD, MOST, and Automotive Ethernet, discussing their architectures, speeds, applications, strengths, and weaknesses. It also briefly touches upon network topologies relevant to automotive systems, emphasizing the importance of selecting the appropriate network technology based on specific requirements like bandwidth, reliability, and
2025-03-1722 min
Tech UnpluggedKubernetes architecture for beginnersKubernetes architecture for beginners. It explains that Kubernetes, or K8s, is a tool for managing and orchestrating containers, comparing it to an orchestra conductor. The article outlines core components like Nodes (computers), Clusters (groups of nodes), Master Node (the planner), Worker Nodes (the executors), Pods (containers grouped together), and Controllers (ensuring the desired number of pods run). The author illustrates how Kubernetes functions by describing the user providing a manifest, the master node assigning tasks, worker nodes executing them, and controllers monitoring the system for the desired state. Finally, the piece emphasizes the importance of Kubernetes for scalability...
2025-03-1711 min
Tech UnpluggedRed Teaming and Security Architecture: A Beginner's Resource GuideGuidance on advanced cybersecurity topics. One document offers a comprehensive collection of interview questions and answers covering areas like C2 frameworks, XDR/AMSI bypass techniques, LOL attacks, and exploits, serving as a thorough resource for security professionals. The other report focuses on effective preparation strategies for these complex red teaming and security architecture subjects, outlining general techniques, current industry trends, specific preparation methods, and valuable tools. Together, they offer both knowledge assessment and learning guidance in the realm of advanced cybersecurity.
2025-03-1725 min
Tech UnpluggedSecurity Architecture Review: Checklist, CSPM, Vulnerabilities, Tools, CIS Compliancea comprehensive overview of security architecture reviews, outlining their processes and best practices. It discusses Cloud Security Posture Management (CSPM) methodologies for evaluating and improving cloud security. The text also identifies common and critical vulnerabilities that should be a focus during these reviews. Furthermore, it recommends various tools for conducting security architecture reviews and CSPM. Finally, the document explains CIS Benchmarks and their alignment with other compliance standards, emphasizing their role in enhancing an organization's security posture.
2025-03-1628 min
Tech UnpluggedBaidu Introduces ERNIE 4.5, X1 Models, and Free ERNIE BotBaidu has launched its updated AI models, ERNIE 4.5 and ERNIE X1, with ERNIE Bot now accessible for free to individual users. The new models boast enhanced multimodal capabilities and strong reasoning, with ERNIE X1 achieving comparable performance to DeepSeek's R1 at a lower cost. These advancements will be integrated across Baidu's various platforms, and API access is available for enterprise users and develope
2025-03-1617 minTech UnpluggedCybersecurity Report 2024-2025: Trends, Threats, PracticesThe provided text constitutes excerpts from a comprehensive cybersecurity report for 2024-2025, outlining prevalent trends, significant threats exemplified by recent breaches, and crucial best practices. The report details escalating cybercrime costs, the emergence of AI-powered attacks, and the persistent danger of ransomware. It further examines cloud security challenges, the impact of regulatory compliance on cybersecurity, and the transformative role of AI and machine learning in both offense and defense.
2025-03-1533 min
Tech UnpluggedCassandra: Facebook's Scalable Structured Storage SystemFacebook engineers Avinash Lakshman and Prashant Malik developed Cassandra to address the scaling challenges of Inbox Search. This distributed storage system manages structured data across numerous commodity servers, ensuring high availability and no single point of failure. Cassandra employs consistent hashing and gossip protocols for data distribution and fault detection. Its data model is based on keys, column families, and dynamic columns/supercolumns, offering flexibility in data layout. Initially built for Inbox Search, Cassandra was open-sourced and is now used for various large-scale storage needs within and outside of Meta.
2025-03-1515 min
Tech UnpluggedCassandra: A Decentralized Structured Storage SystemCassandra is a decentralized, structured storage system initially developed by Facebook for its Inbox Search feature and later open-sourced. The document outlines Cassandra's architecture, including its data model (tables with column families), partitioning via consistent hashing, and replication strategies for high availability. It details the system's implementation, covering persistence components like Commit Logs and SSTables, the write and read paths, and the Staged Event-Driven Architecture (SEDA). The text also touches on Cassandra's motivations, its relationship to the CAP theorem and other NoSQL systems like Bigtable and Dynamo, and its evolution with the introduction of CQL and virtual nodes. Finally...
2025-03-1529 min
Tech UnpluggedH-CoT: Jailbreaking Large Reasoning Models via Chain-of-Thought HijackingThis paper introduces "H-CoT," a novel method to bypass safety mechanisms in large reasoning models (LRMs) like OpenAI's models, DeepSeek-R1, and Gemini 2.0 Flash Thinking. By manipulating the model's chain-of-thought reasoning, the attack disguises harmful requests within educational prompts, highlighted by the new "Malicious-Educator" benchmark. Experiments show that H-CoT significantly reduces refusal rates, sometimes from 98% to under 2%, compelling models to generate harmful content. The research exposes vulnerabilities related to temporal model updates, geolocation, and multilingual processing, suggesting an urgent need for more robust safety defenses that consider the transparency of the reasoning process. The authors offer key insights for improving...
2025-03-1513 min
Tech UnpluggedToxicSQL: Backdoor Attacks on Text-to-SQL ModelsThis research investigates the security vulnerabilities of large language models (LLMs) used for translating natural language into SQL queries (Text-to-SQL), specifically focusing on the threat of backdoor attacks. The authors introduce ToxicSQL, a novel framework to create stealthy backdoors that can lead to the generation of malicious, yet executable, SQL queries through semantic and character-level triggers. Experiments demonstrate that even a small amount of poisoned data can result in high attack success rates, highlighting the significant security risks in relying on potentially compromised LLM-based Text-to-SQL models and underscoring the urgent need for robust defense mechanisms.
2025-03-1415 minTech UnpluggedGlobal Large Language Model Analysis: 2025SubLimetechie's comprehensive report analyzes numerous global large language models (LLMs), contrasting their backend architectures, reliability measures, scalability, training data, and performance. The analysis spans proprietary models like GPT-4 and Claude 3.5 to open-source options such as Llama 3.2 and Falcon 180B, also including regional leaders. The report helps understand the strengths and weaknesses of each LLM for various applications, ultimately guiding users in selecting the most suitable model based on their specific requirements.
2025-03-1326 minTech UnpluggedBrowser APIs and WAFs: Collaborative Client-Side Attack MitigationThis podcast from Tech Unplugged, dated March 2025, explores the collaboration between browser APIs and Web Application Firewalls (WAFs) in order to better protect against client-side attacks. It defines WAFs and common client-side threats like XSS, CSRF, and clickjacking. The report then outlines various browser APIs relevant to security and details WAF features designed for client-side defense. Finally, it discusses the integration of these technologies and offers best practices and identifies limitations of relying on browser APIs for security in WAF implementations, concluding with real-world examples and a summary of their combined role in web security.
2025-03-1330 min
Tech UnpluggedChatGPT Account Takeover: Wildcard Cache DeceptionA security researcher at Harel Security Research discovered a vulnerability allowing for ChatGPT account takeover. This was achieved through a "wildcard" web cache deception. The researcher found that a broad caching rule for the /share/ path, combined with a difference in how Cloudflare's CDN and OpenAI's web server parsed URL-encoded path traversals, led to the flaw. By crafting a specific URL, an attacker could cache sensitive API endpoints containing user authentication tokens. When a victim clicked this manipulated link, their token would be stored in the cache. Subsequently, the attacker could retrieve this cached token, gaining unauthorized access to...
2025-03-1217 min
Tech UnpluggedAI: Law, Ethics, and PolicyThis compilation of excerpts from various sources explores the multifaceted landscape of artificial intelligence, examining its ethical, legal, policy, and societal implications. Contributions from legal scholars, philosophers, and technology experts analyze topics such as the explainability and regulation of AI, its impact on fundamental rights and media, and the challenges it poses to established legal frameworks like data protection, competition law, and intellectual property. The texts also investigate the concepts of fairness, responsibility, and sustainability in the context of AI development and deployment, while considering its growing role in sectors like education and its potential to exacerbate existing inequalities...
2025-03-1223 min
Tech UnpluggedCVE-2025-0108 Root Cause Analysis: PAN-OS Authentication BypassThis podcast provides a root cause and thesis analysis of CVE-2025-0108, an authentication bypass vulnerability in Palo Alto Networks' PAN-OS software. The flaw allows unauthenticated attackers to execute specific PHP scripts due to discrepancies in how different web technologies handle requests. Exploitation details, similar past vulnerabilities like those in Fortinet FortiOS and Apache Struts, and relevant cybersecurity trends are examined. Mitigation strategies including patching and access restrictions are recommended. The report emphasizes the importance of comprehensive security reviews, robust development practices, and proactive security measures to combat evolving cyber threats. Ultimately, the analysis highlights the necessity of a...
2025-03-1230 minTech UnpluggedMastering Active Directory: Advanced Offensive and Defensive StrategiesIn this advanced edition podcast episode, Senior Security Researcher delves into the intricate landscape of Active Directory security. The discussion covers sophisticated attack methodologies, practical lab exercises, and essential defensive techniques. Emphasizing a red team approach, listeners will gain insights into privilege escalation, trust abuse, and mitigation strategies, while understanding the critical role of Active Directory in managing Windows networks. This episode is aimed at those with foundational knowledge of Active Directory, seeking to enhance both their offensive capabilities and defensive posture in cybersecurity.
2025-03-1205 minTech Unplugged5G Network VulnerabilitiesThis podcast outlines potential security weaknesses within 5G networks. It highlights vulnerabilities such as trust exploitation between devices and base stations and weak initial message protection. The introduction of new 5G features like network slicing also brings increased risk by creating more points of potential attack. Implementation and configuration errors can also expose networks, exacerbated by the need to balance speed and security which can leave gaps in network defense. The article emphasizes the importance of understanding these risks to protect data privacy, prevent service disruptions, and mitigate financial and safety risks. It concludes by noting that improved protocols...
2025-03-1214 minTech UnpluggedMars Hydro Data Breach: IoT Security VulnerabilitiesA significant data breach at Mars Hydro, a manufacturer of IoT grow lights, exposed 2.7 billion records due to inadequate security measures. The unprotected database contained sensitive user information such as Wi-Fi passwords and IP addresses. Security flaws included a lack of encryption, password protection, and regular security audits. This breach highlights critical vulnerabilities within the Internet of Things (IoT) ecosystem, posing privacy and security risks to users and financial and reputational risks to businesses. Recommendations emphasize strong authentication, data encryption, and proactive security audits for manufacturers, alongside password updates and network segmentation for users. The incident underscores the urgent...
2025-03-1210 minTech UnpluggedSession HijackingIn this episode, we delve into the concept of web session management, exploring how session identifiers and cookies operate to facilitate user interactions. We highlight the threats posed by session hijacking, including techniques like man-in-the-middle attacks, session fixation, and sidejacking. Tune in to learn practical measures to safeguard your online activities, such as avoiding public Wi-Fi and enabling multi-factor authentication.
2025-03-1203 minTech UnpluggedSystemBC RAT: Linux Threat to Networks and Cloud ServersThis podcast explains the SystemBC Remote Access Trojan (RAT), which has evolved to target Linux systems, posing a significant threat to corporate networks, cloud servers, and IoT devices. It highlights the malware's technical capabilities, such as its encrypted communication, lateral movement, and persistence mechanisms, as well as common attack vectors like unpatched vulnerabilities and compromised credentials. The report identifies root causes of SystemBC attacks, emphasizing the importance of regular patch management, multi-factor authentication, and network segmentation. Furthermore, it proposes detection techniques like behavioral analysis and intrusion detection systems, along with mitigation strategies to prevent and respond to SystemBC infections...
2025-03-1211 minTech UnpluggedGemma 3: Google DeepMind's Multimodal Open Model FamilyThe Gemma 3 Technical Report introduces Google DeepMind's Gemma 3, a new generation of lightweight open-source language models. These models offer enhanced capabilities including multimodal understanding, longer context windows (up to 128K tokens), and improved multilingual abilities. The report details architectural improvements focused on memory efficiency and training methodologies involving knowledge distillation and novel post-training recipes. It includes evaluations against other language models and the Gemini family, highlighting superior performance in mathematics, chat, and instruction following. The report also addresses safety, security, and responsible deployment, along with the model's carbon footprint. It includes analysis of memorization rates and safety policies.
2025-03-1227 min
Tech UnpluggedUnderstanding Docker and Container ArchitectureDocker's architecture and its role in containerization. It details the shared kernel approach that distinguishes containers from virtual machines. The piece also examines resource isolation, container runtimes, networking, storage, and security aspects within the Docker ecosystem. Furthermore, the article discusses container resource architecture, focusing on namespaces and control groups for process isolation and resource management. It concludes by highlighting best practices for container architecture to build scalable, efficient, and secure applications.
2025-03-1221 minTech UnpluggedDissecting the Google Cloud Architect Study GuideA critical review of Dan Sullivan's Google Cloud Certified Professional Cloud Architect Study Guide examining its strengths and weaknesses as a learning tool for aspiring cloud architects
2025-03-1210 min
Tech Unplugged CAMEL: Multi-Agent Framework for Scaling Law ResearchCAMEL is an open-source framework designed to study the scaling laws of AI agents by simulating large-scale multi-agent systems. It provides tools and resources for researchers to experiment with different agent types, tasks, and environments. The framework emphasizes evolvability, scalability, and statefulness, using code as prompts for agent behavior. CAMEL supports various applications, including data generation, task automation, and world simulation, with extensive documentation and community support. The project encourages contributions and offers synthetic datasets and cookbooks for practical implementation, fostering advancements in multi-agent systems research.
2025-03-1114 min
Tech UnpluggedAgent Communication Protocol (ACP): Standardizing Agent InteractionsThe Agent Communication Protocol (ACP) is a framework for standardizing communication between autonomous agents. It aims to enable seamless interaction, collaboration, and integration across diverse agent-based systems. ACP leverages JSON-RPC and supports both stateful and stateless transport mechanisms like REST and WebSockets. Key considerations include balancing state management, ensuring scalability, and addressing transport consequences. The protocol prioritizes security through encrypted communications, certificate management, and role-based access control. Community involvement and adherence to best practices are vital for the successful implementation and evolution of ACP.
2025-03-1122 min
Tech UnpluggedModel Context Protocol (MCP): The Future of AI InteractionA technology that facilitates interaction between AI agents and various online services. The speaker highlights mCP's potential to revolutionize how users interact with the internet, envisioning a shift from browser-based interactions to agent-driven tasks. mCP acts as a "USBC connector" allowing agents to access and utilize diverse applications through a standardized protocol. The transcript also explores setting up mCP clients and servers, addressing security concerns related to granting agents access to authorized app views. The presenter recommends exploring Anthropic's introduction to mCP and the Gamma platform to discover secure and reliable server setups, and uses the video to demonstrate...
2025-03-1113 min
Tech UnpluggedActive Directory Security: A Comprehensive GuideActive Directory (AD) security, a critical aspect of enterprise cybersecurity. It highlights AD's role in identity and access management, making it a prime target for attacks. The guide explores fundamental concepts, attack vectors like credential theft and privilege escalation, and reconnaissance techniques used by adversaries. Furthermore, the guide provides practical strategies for planning and implementing robust AD security measures, covering tiered administrative models, secure authentication methods, and effective monitoring techniques. The guide also addresses hybrid and cloud-integrated environments and emerging trends such as Zero Trust models, AI, and quantum computing. Ultimately, it aims to equip security professionals with the...
2025-03-1027 min
Tech UnpluggedLLM Interview Questions: A Comprehensive GuideLarge Language Models (LLMs) through a question-and-answer format, covering fundamental concepts and advanced techniques. It explains tokenization, LoRA/QLoRA, beam search, and temperature, along with masked language modeling and sequence-to-sequence models. The text further explores model training methodologies, including autoregressive versus masked models, embeddings, next sentence prediction, and sampling strategies. It discusses prompt engineering, catastrophic forgetting mitigation, model distillation, and handling out-of-vocabulary words. Finally, the resource highlights advanced topics such as attention mechanisms, optimization techniques, and the challenges associated with using LLMs, including bias, computational cost and resources.
2025-03-0925 minTech UnpluggedAWS Security Specialty Certification: GuideAWS Security Specialty certification emphasises hands-on experience with AWS security services, secure internet protocols, and the ability to make informed trade-off decisions regarding cost and security. The material covers incident response planning, risk assessment, logging, monitoring, and infrastructure security. The course highlights IAM, key management, and data protection methods, both at rest and in transit. It also touches on authentication, authorization, federation, and resource-based access control, focusing on real-world scenarios and troubleshooting common issues. The presenter underscores the importance of automation, operational knowledge, and continuous learning within the AWS ecosystem.
2025-03-0923 min
Tech UnpluggedSoftware Vulnerability Analysis and Secure Engineering PracticesA software vulnerability analysis course, outlining the curriculum and assessment methods. The course emphasizes secure software engineering principles, integrating security practices throughout the entire software development lifecycle. Topics include threat modeling, secure design, secure coding practices, and secure deployment. The course will use tools like Microsoft Threat Modeling Tool and Thread Dragon. It will explore concepts like STRIDE and DREAD for classifying and ranking security threats and will examine various security maturity models and standards. Ultimately, the goal is to build security into every phase of software development, shifting from a reactive to a proactive security approach.
2025-03-0921 minTech UnpluggedMiniRAG: Simple Retrieval-Augmented Generation for Small Language ModelsTheThis podcast introduces MiniRAG, a novel Retrieval-Augmented Generation (RAG) system designed for Small Language Models (SLMs) in resource-constrained environments. MiniRAG utilizes a semantic-aware heterogeneous graph indexing mechanism and a lightweight topology-enhanced retrieval approach to overcome the limitations of SLMs. It outperforms existing lightweight RAG systems while using significantly less storage space and maintaining robustness when transitioning from Large Language Models (LLMs) to SLMs. The paper includes a new benchmark dataset, LiHuaWorld, specifically designed for evaluating lightweight RAG systems under realistic on-device scenarios. Experiments demonstrate that MiniRAG's unique architecture enables it to achieve comparable performance to LLM-based...
2025-03-0918 min
Tech UnpluggedAWS IAM User Enumeration VulnerabilitiesA security research team discovered AWS IAM username enumeration vulnerabilities within the AWS Web Console. One vulnerability, CVE-2025-0693, involved timing attacks, while the other related to MFA user login flows. The timing attack allowed attackers to identify valid usernames by measuring the server response time. The research team collaborated with AWS to address these issues, with AWS patching the timing attack but considering the MFA issue an accepted risk. The article also explains logging and detection methods for potential exploitation of these vulnerabilities and provides recommendations for preventing authentication timing attacks. It promotes the company that performed the...
2025-03-0917 min
Tech UnpluggedOptimizing Manual Software Testing: Survey, Guidelines, and Case StudiesThis podcast investigates how to optimize manual software testing processes, which remain important despite the rise of automation. The authors conducted a survey of 38 testing professionals across 16 companies to understand current practices and challenges. Based on the survey, the paper synthesizes guidelines for implementing optimization techniques from automated testing to manual testing. These guidelines are structured within an annotated manual software testing process model and validated through two industrial case studies. The results demonstrate improved fault detection likelihood, test feedback time, and test creation efforts when these guidelines are followed. The authors propose that this offers significant value to...
2025-03-0811 min
Tech UnpluggedTosca Test Automation CourseQA Training Hub provides an online Tosca Test Automation course with hands-on experience using Banking/Insurance/e-Commerce projects. The program aims to bridge the gap between demand and supply of software testing professionals, offering best-in-class, affordable training. The course covers numerous modules, including error handling, recovery scenarios, regular expressions, data-driven frameworks, and test cases in Tosca. Additional topics involve: browser operations, dynamic expressions, libraries, record and playback, and more. The goal is to make quality testing training accessible, promote knowledge sharing, and foster a community of testers.
2025-03-0821 min
Tech UnpluggedThe Web Application Hacker's Handbook: Vulnerabilities and ExploitsThis comprehensive handbook explores web application security, focusing on practical techniques for identifying and exploiting vulnerabilities. It covers a wide spectrum of attacks, including injection flaws, authentication and session management weaknesses, and client-side vulnerabilities like cross-site scripting. The text emphasizes hands-on methods, providing steps to detect and exploit security flaws in areas such as data stores, application logic, and access controls. It also discusses automation techniques to enhance attack effectiveness and secure multi-tiered architectures. Furthermore, the guide explores methods for attacking back-end components and handling user input safely, as well as defensive strategies to prevent attacks. Ultimately, this resource...
2025-03-0722 min
Tech UnpluggedCassandra: A Decentralized Storage System for Scalable Data ManagementThis podcast introduces Cassandra, a decentralized storage system designed for managing large datasets across commodity servers. Cassandra prioritizes high availability and fault tolerance, running efficiently on infrastructure with frequent failures. It utilizes a simple data model that gives users dynamic control over data layout. Developed by Facebook to address the needs of Inbox Search, Cassandra handles high write throughput and data replication across data centers. The system combines well-known techniques for scalability and availability, such as consistent hashing, replication, and gossip-based membership. Cassandra achieves efficient data retrieval through local persistence mechanisms, including commit logs and in-memory data structures, adapting...
2025-03-0715 min
Tech UnpluggedKafka: Distributed Messaging System for High-Volume DataThis podcast introduces Kafka, a distributed messaging system developed for high-volume log data collection and delivery with low latency. Kafka combines features of log aggregators and messaging systems, offering scalability and high throughput while allowing real-time log event consumption. It addresses the challenges of processing the large volumes of log data generated by modern internet applications. The paper details Kafka's architecture, design choices, deployment at LinkedIn, and performance compared to other messaging systems like ActiveMQ and RabbitMQ, highlighting its superior throughput and efficiency in log processing. Kafka's design prioritizes efficiency and scalability, using a pull-based model and relying on...
2025-03-0718 minTech UnpluggedSelenium for Software Test AutomationThis document provides an overview of Selenium, a widely adopted open-source tool for automating the testing of web applications. It traces Selenium's history and evolution, from its initial versions to the development of WebDriver and Grid for distributed testing. The text outlines Selenium's architecture and key components, such as IDE, WebDriver, and Grid, explaining their functionalities in test planning, execution, and reporting. Furthermore, it discusses essential factors in Selenium testing, including script development, parallel testing, and integration with test automation frameworks, while also acknowledging limitations and challenges associated with its use.
2025-03-0718 min
Tech UnpluggedAIOps use caseArtificial intelligence (AI) and machine learning (ML) are transforming observability practices by enhancing the ability of IT to understand complex systems, predict issues, and automate responses. AIOps, the application of AI to IT operations, helps organizations improve system performance, availability, and reliability by reducing downtime and accelerating issue resolution. Key AIOps use cases include anomaly detection, alert noise reduction, probable root cause analysis, automation, and proactive outage prevention. As AI becomes more prevalent, explainable AI will be crucial for building trust and driving adoption of AIOps solutions. Ultimately, the goal is to leverage AI to predict and prevent issues...
2025-03-0717 min
Tech UnpluggedAIOps use case in anomaly detectionArtificial intelligence (AI) and machine learning (ML) are transforming observability practices by enhancing the ability of IT teams to manage complex systems. AIOps, the application of AI and ML to IT operations, improves system performance and reliability while reducing costs by automating tasks and speeding up issue resolution. Key AIOps use cases include anomaly detection, alert noise reduction, root cause analysis, automation, and proactive outage prevention. By leveraging AI, organizations can predict and prevent issues, allowing IT staff to focus on strategic initiatives, ultimately boosting digital resilience. The integration of AI in observability tools helps teams gain insights from...
2025-03-0717 min
Tech UnpluggedOverview of AWS servicesThis podcast provides a compilation of frequently asked questions and answers related to Amazon Web Services (AWS). It covers a wide range of topics including VPC configuration, EC2 instance management, S3 storage, and database services like RDS and DynamoDB. The questions address key concepts such as auto-scaling, load balancing, and network connectivity. Additionally, the document explores various AWS services such as CloudFront, Lambda, and CloudTrail, offering insights into their functionalities and use cases. It serves as a study guide for AWS certifications or a quick reference for understanding common AWS concepts and best practices.
2025-03-0625 minTech UnpluggedSecuring AWS Lambda: Hacking Techniques and Mitigation StrategiesAWS Lambda, a popular serverless computing service, faces several potential hacking threats if not adequately secured. These risks include configuration mistakes leading to public exposure or overly permissive IAM roles, as well as code vulnerabilities like command and SQL injection. Attackers might exploit event-data injection by manipulating data or utilizing cross-site scripting. To mitigate these threats, the document recommends strategies such as adhering to the principle of least privilege, rigorously validating inputs, and diligently managing dependencies. Furthermore, the text emphasizes the importance of code reviews, continuous monitoring, secure environment configurations, and proper secrets management to bolster Lambda function security.
2025-03-0617 min
Tech UnpluggedS3 Bucket Versioning: Accessing Secrets in AWSThese sources describe a security vulnerability involving publicly accessible Amazon S3 buckets and the exploitation of S3 bucket versioning. An attacker can enumerate S3 buckets without credentials, find older versions of files, and recover deleted files due to misconfigurations. The vulnerability is demonstrated through a scenario where a security team assesses a company's infrastructure. They discover and exploit exposed credentials in a Javascript file and a confidential Excel file by listing object versions and retrieving older versions or deleted items, thus highlighting how sensitive data can be exposed in S3 buckets. The documents also suggest defensive measures like least...
2025-03-0607 min
Tech UnpluggedAI Risk Management FrameworkThe AI Risk Management Framework (RMF) Playbook offers a comprehensive guide for organizations to govern, map, measure, and manage risks associated with artificial intelligence systems. It emphasizes establishing clear policies and processes, understanding legal and regulatory requirements, and documenting potential impacts. The playbook focuses on transparency, accountability, and continuous monitoring throughout the AI lifecycle. Key areas include risk tolerance determination, stakeholder engagement, addressing biases, and ensuring data privacy and security. It promotes interdisciplinary collaboration, diverse teams, and integration of ethical considerations. It also addresses AI system decommissioning and managing third-party AI risks.
2025-03-0617 min