Light

Episode #869 Quiz

Global Privacy Control
Date: 2022-05-03 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

DIB-VDP’s vetted HackerOne bug bounty found 401 actionable flaws in 348 defense-industrial assets, proving sanctioned disclosure works. OpenSSF’s Package Analysis scanned PyPI and npm, flagging 200 malicious packages via static heuristics, typosquatting, and dependency confusion. Connecticut’s privacy bill mandates Global Privacy Control, a Sec-GPC: 1 HTTP header, revocable opt-out signal.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific observation did the OpenSSF Package Analysis project use to identify the npm package `roku-web-core/ajax` as malicious during its first month of analysis?

Question 1

What specific observation did the OpenSSF Package Analysis project use to identify the npm package `roku-web-core/ajax` as malicious during its first month of analysis?

It exfiltrated machine details and then opened a reverse shell during install. It searched local browser databases for a Discord token and exfiltrated it. It injected a backdoor into the Discord Electron client during post-install. It queried a Heroku server and conditionally ran a returned command.

Question 2: According to the episode, what is the key new enforcement feature that distinguishes Global Privacy Control from the earlier Do Not Track effort?

Question 2

According to the episode, what is the key new enforcement feature that distinguishes Global Privacy Control from the earlier Do Not Track effort?

It requires every website to implement its own opt-in consent dialog. It is only advisory unless a browser vendor chooses to honor it by default. It becomes legally enforceable under existing privacy frameworks and laws. It relies on browser fingerprinting to infer user privacy intent.

Question 3: Which state-privacy-law timing detail did Steve highlight as making Connecticut part of the “3Cs” with California and Colorado?

Question 3

Which state-privacy-law timing detail did Steve highlight as making Connecticut part of the “3Cs” with California and Colorado?

Its right-to-cure provision sunsets on January 1, 2023. Its privacy working group is required to report by September 1, 2024. Its opt-out requirement first takes effect on July 1, 2024. Its right-to-cure provision sunsets on December 31, 2024.

Question 4: What did the `random-voucher-code-generator` npm package do when imported, according to OpenSSF’s analysis?

Question 4

What did the `random-voucher-code-generator` npm package do when imported, according to OpenSSF’s analysis?

It searched browser databases for a Discord token and sent it to attacker infrastructure. It opened a simple reverse shell from an imported Python module. It downloaded a Discord backdoor and installed it into the Electron client. It queried a Heroku server that returned a command and execution flag.

Question 5: What did Moxie Marlinspike say was the fundamental reason port knocking is even necessary?

Question 5

What did Moxie Marlinspike say was the fundamental reason port knocking is even necessary?

OpenSSH has no history of remotely exploitable vulnerabilities. Firewall rules cannot isolate services from the public Internet. Network services are usually exposed with security vulnerabilities in them. Port knocking is mainly needed because encryption cannot protect asynchronous messaging.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.