Light

Episode #856 Quiz

The "Topics" API
Date: 2022-02-01 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Apple patched two zero-days, including CVE-2022-22587 in IOMobileFramebuffer enabling kernel code execution, and a Safari IndexedDB cross-origin flaw exposing other tabs. Linux’s PwnKit in polkit’s pkexec mishandles argc zero, letting crafted environment variables trigger root execution; mitigations include patching or removing pkexec’s SUID bit.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Under Google's Topics API, what determines which one of a user's top five topics is returned to a given site 95% of the time?

Question 1

Under Google's Topics API, what determines which one of a user's top five topics is returned to a given site 95% of the time?

A per-user HMAC keyed with the week number and the site domain A browser-wide hash of the prior three weeks' full browsing history The most recently visited topic from the current browsing session A server-side classification done by Google's ad servers at page load

Question 2: What prevents a site from learning every weekly topic a browser has accumulated under the Topics API?

Question 2

What prevents a site from learning every weekly topic a browser has accumulated under the Topics API?

A rule that reveals topics only after the user manually approves each request A filter that hides topics unless the site has a third-party cookie set A rule that limits all sites to seeing only one topic per browser lifetime A filter that only returns topics previously observed by that site within the prior three weeks

Question 3: In the PwnKit discussion, what specific condition did pkexec fail to check before processing startup arguments?

Question 3

In the PwnKit discussion, what specific condition did pkexec fail to check before processing startup arguments?

Whether argc was zero before dereferencing argv Whether the invoking user belonged to the wheel group Whether the environment block had been sanitized by sudo Whether the process was launched from an interactive shell session

Question 4: What mitigation did the NSA specifically suggest if a Linux system could not be patched immediately for PwnKit?

Question 4

What mitigation did the NSA specifically suggest if a Linux system could not be patched immediately for PwnKit?

Remove the SUID bit from /usr/bin/pkexec by setting mode 0755 Replace pkexec with a wrapper that prompts for a second password Reinstall Polkit from source with compiler hardening flags enabled Disable all local shell access until the next kernel update

Question 5: What was the key reason Steve gave for the smaller-than-expected wave of Log4j exploitation after Log4Shell was disclosed?

Question 5

What was the key reason Steve gave for the smaller-than-expected wave of Log4j exploitation after Log4Shell was disclosed?

The vulnerability only affected development builds of Log4j The exploit required physical access to the server console Most Java applications had already disabled the logging library entirely Most exploit code required per-application customization to work

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.