Light

Episode #1055 Quiz

React's Perfect 10
Date: 2025-12-09 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Episode 1055 details critical security developments including France fining Vanity Fair €750,000 for cookie violations and GrapheneOS exiting France due to coercion and key rotation fears. India mandated smartphone tracking and SIM-dependent encrypted messaging but later retreated. Chrome now prompts user permission for local network access.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the primary reason GrapheneOS decided to leave France, as discussed in Security Now! episode 1055?

Question 1

What was the primary reason GrapheneOS decided to leave France, as discussed in Security Now! episode 1055?

French authorities demanded backdoors in encryption and coerced open-source privacy projects, leading to harassment and raids on GrapheneOS teams. The French government banned all Android-based operating systems in favor of proprietary solutions. GrapheneOS left due to hardware supply chain disruptions caused by French import restrictions. GrapheneOS was unable to comply with new EU-wide data localization laws requiring data hosting exclusively within France.

Question 2: In the episode, what principle does the new browser 'Local Network Access' permission primarily aim to enforce?

Question 2

In the episode, what principle does the new browser 'Local Network Access' permission primarily aim to enforce?

Disable access to localhost addresses from all browsers to prevent local attacks completely. Allow any JavaScript running in the browser to freely access the local network for compatibility with all websites. Automatically block all local network access from any external website to eliminate risks without user input. Require explicit user permission before a website can access devices and services on the user's local network to prevent unauthorized intrusions.

Question 3: What change did GRC's DNS Benchmark Version 2 introduce compared to the original Version 1?

Question 3

What change did GRC's DNS Benchmark Version 2 introduce compared to the original Version 1?

Version 2 measures DNS resolver performance solely based on cached queries to optimize for speed. Version 2 aggregates resolver performance by averaging cached, uncached, and dotcom query types instead of prioritizing cached queries only. Version 2 removes sorting options and uses a fixed ranking of resolvers regardless of query type performance. Version 2 only tests IPv4 DNS servers, continuing Version 1's legacy approach without support for modern protocols.

Question 4: Regarding the Indian government's Sanchar Saathi app mandate, what conflicting aspect emerged about the app's installation and user control?

Question 4

Regarding the Indian government's Sanchar Saathi app mandate, what conflicting aspect emerged about the app's installation and user control?

The app was offered only as an optional download from app stores with no pre-installation mandate. Apple fully complied with the mandate and integrally incorporated Sanchar Saathi into all iPhones sold in India. The government mandated pre-installation and pushed app updates that could not be disabled, conflicting with the claim that app usage is voluntary and that users can remove it. The app was pre-installed but could be easily removed before or after purchase with no restrictions.

Question 5: What is the core technical cause of the critical React Server Components vulnerability CVE-2025-55182 described in the episode?

Question 5

What is the core technical cause of the critical React Server Components vulnerability CVE-2025-55182 described in the episode?

A buffer overflow in client-side React rendering that crashes browsers but does not allow code execution on servers. Unsafe deserialization of malformed payloads allowing attacker-controlled data to influence server-side execution logic and execute privileged JavaScript code remotely without authentication. Exploitation of insecure cross-site scripting (XSS) flaws in React's front end requiring valid user authentication. Man-in-the-middle attacks exploiting weak TLS encryption used by React servers to intercept user data.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.