Writing · topic · 12 articles
Vulnerability catalogs, breach records, operational security, and privacy enforcement.
Information-rights posture has two axes — how open the government is (Right to Information) and how protected the citizen is (Data Protection). Joining the two new Voidly datasets on country (a rare exact key), this maps the two-by-two space and the real tension where privacy law is used to deny access and openness without protection exposes individuals.
Censorship and information control · Cybersecurity and privacy · Transparency and open data
There is no single US cyber-breach registry. One incident can surface in three unconnected federal places — CISA’s KEV catalog (the exploited vulnerability), an SEC 8-K Item 1.05 filing (the material event), and the HHS OCR breach portal (health data) — each with a different trigger, threshold, and clock. A guide to joining them by victim organization and date.
Cybersecurity and privacy · Finance and markets · Transparency and open data · Engineering and infrastructure
The full catalog of known software vulnerabilities runs into the hundreds of thousands — far too many to patch all at once. CISA’s Known Exploited Vulnerabilities catalog cuts that universe down to the ~1,600 CVEs confirmed to be exploited in the wild, and Binding Operational Directive 22-01 turns the list into an enforceable federal patching mandate. This guide reads it as the highest-signal vulnerability prioritization feed the government publishes.
The Federal Trade Commission announces nearly everything it does — every settlement, every merger challenge, every new rule — through a press release, and those releases together form a searchable public log of US consumer-protection and antitrust enforcement. This guide reads the FTC’s ~10,700-record press and enforcement archive as a dataset: the Section 5 frame, the consumer-protection and competition missions, landmark privacy penalties, the shifting priorities of junk fees and noncompetes and big-tech antitrust, and a Python workflow that tallies releases by year and topic.
Consumer protection · Justice and immigration · Cybersecurity and privacy · Federal data
HHS-OCR publishes every reported healthcare data breach affecting 500+ patients — the "Wall of Shame." Over 5,000 entries covering ransomware attacks, stolen laptops, unauthorized employee access, and business associate failures. Here is what the database contains and what it reveals about healthcare security failures.
Federal data · Health and medicine · Cybersecurity and privacy
The NIST National Vulnerability Database is the federal record that turns CVE identifiers into structured, comparable data — roughly 459,000 catalogued software vulnerabilities, each carrying a CVE ID, CVSS severity score, CWE weakness type, affected products, and references. It is the layer that makes the world catalogue of known vulnerabilities something you can query, rank, and prioritize.
NIST NVD enriches 250,000+ CVE records with CVSS scores, CWE classifications, and CPE product data. CVE Numbering Authorities (400+ CNAs): Microsoft, Google, Apple, Red Hat, MITRE root CNA. CVSS v3.1: Attack Vector/Complexity, Privileges Required, User Interaction, Scope, CIA impact. Score ranges: Critical 9.0-10.0, High 7.0-8.9, Medium 4.0-6.9. CISA KEV catalog: 1,000+ confirmed-exploited CVEs, BOD 22-01 mandates federal patching within 14 days. Log4Shell CVE-2021-44228 CVSS 10.0; EternalBlue CVE-2017-0144 9.3; Heartbleed CVE-2014-0160 7.5. CWE-787 Out-of-Bounds Write dominates Critical CVEs. NVD REST API /rest/json/cves/2.0 with cvssV3Severity/cweId/cpeMatchString/hasKev parameters. FedRAMP, PCI DSS, FISMA compliance applications. Here is CVE assignment mechanics, CVSS base/temporal/environmental scores, KEV operational mechanics, and a Python Critical CVE analysis for 2024.
The CISA Known Exploited Vulnerabilities catalog lists CVEs confirmed as actively exploited in the wild — with mandatory federal patching deadlines under BOD 22-01. Here is the catalog structure, how CISA decides what gets listed, how it differs from CVSS severity scoring, and how security teams use it as a minimal-patch prioritization framework.
How the Swarm SDK rotates cryptographic material without grounding the fleet — scheduled signed pre-key rotation on a 7-day timer, OTP replenishment when bundle drops below 20 keys, emergency revocation via gossip-flooded KeyRevocationAnnouncement, BKPSRAM zeroization with 0xFF pattern verification, and staggered rotation coordination across the mesh.
How the Swarm SDK protects drone mesh communications against traffic analysis — six fixed message size bins, ±15% transmission timing jitter, store-and-forward ring buffer for burst smoothing, degraded-channel operational mode, and RF fingerprint resistance on STM32H7.
How Voidly protects probe operators in jurisdictions that criminalize censorship measurement: strict data minimization (no name, address, or IP logging), WireGuard peer-key authentication, daily probe ID pseudonymization, optional Tor hidden service upload, measurement scrubbing, country-tier legal risk assessments, and a one-tap emergency stop with full data erasure.
Censorship and information control · Cybersecurity and privacy · Engineering and infrastructure
How Voidly delivers measurement configuration to probes without a persistent control channel: gzip+CBOR bundles signed with Ed25519 (signature verified before decompression to prevent zip-bomb attacks), a pull-based auto-update scheduler with 6-hour intervals and exponential backoff, version pinning and two-snapshot rollback, and anonymous country tokens derived via BLAKE3 from ISO code + epoch-week salt so the CDN cannot correlate which overlay a probe applies.
Censorship and information control · Engineering and infrastructure · Cybersecurity and privacy
All topics: the writing index.