🗣️ SPEC ID IS BETTER DEVICE ID Device ID was built for a world where identity lived inside the browser. If JavaScript ran and signals were available, you could link sessions together and approximate a user. That model breaks the moment the browser stops cooperating. 💡 Spec ID doesn’t depend on the browser at all. More importantly, it changes what identity means. Instead of tying activity to a device, Spec ID ties activity to an actor. ➡️ Events that look unrelated start connecting ➡️ Reconnaissance links to execution ➡️ Signup, login, and transaction behavior collapse into a single journey What looked like thousands of users resolves into one coordinated system. It's the identity layer that allows you to see how attacks actually operate. Once you can see the full journey, everything downstream gets better: 🛡️ Detection becomes more precise 📈 Models get cleaner data 👇🏼 False positives go down 👤 Real users experience less friction Most systems are still evaluating moments while attackers are operating across time. Spec ID connects the two. Get the full breakdown →

🧵 Part 2: Most people think a browser extension is just "a script on top of the page." It's not. Not even close. A security extension is actually a distributed mini-application split across multiple isolated environments inside the browser. One part listens in the background. One part watches the page. One part talks to the user. None of them share memory. They only communicate through structured messages. That architecture isn't a limitation. It's what makes it safe enough to sit alongside your banking portal, your email, and everything else open in your browser at the same time. Understanding how an extension actually lives inside the browser is what separates real browser security from a URL filter with a logo on it. This is Part 2 of the series. Full breakdown here 👇 https://lnkd.in/gAg358T5 Part 3 is where it gets interesting. Detection. Signal analysis. How a page becomes evidence. 👀

Your API has no rate limiter. That means anyone can do this: for (let i = 0; i < 100000; i++) {  fetch('/api/login', { method: 'POST', body: credentials }); } Brute-force your login endpoint. Scrape all your data. Crash your server with a burst. Rate limiting is not optional. Here's how I implement it in Express/Node.js: import rateLimit from 'express-rate-limit'; const loginLimiter = rateLimit({  windowMs: 15 * 60 * 1000, // 15 minutes  max: 10, // max 10 login attempts per window  message: { error: 'Too many attempts. Try again in 15 minutes.' },  standardHeaders: true,  legacyHeaders: false, }); app.post('/api/auth/login', loginLimiter, authController.login); Different endpoints need different limits: → Login: strict (10/15min) — brute force target → Public search: relaxed (100/min) — UX matters → File upload: very strict (5/hour) — resource cost I added this to every project after forgetting it in my first one. Security is not a feature you add at the end. It's a constraint you build around from day 1. #Backend #Security #NodeJS #APIDesign #WebSecurity

OpenClaw v2026.3.24: Breaking Changes, Security Fixes & What AI Agent Operators Need to Know If you're running AI agents in production — especially OpenClaw — the latest update isn't business as usual. Version 2026.3.22 introduced a breaking change: the old extension-api is gone. Plugins that haven't migrated to the new SDK (via ClawHub) will fail. WeChat, Feishu, custom integrations — check compatibility before upgrading. But the bigger story is security. This release patches 10+ vulnerabilities, including: Windows SMB credential leaks Unicode zero-width bypasses (approval UI spoofing) Environment variable injection These aren't theoretical. They're the same class of failures that brought down LexisNexis last week — an unpatched React app, one overprivileged role, and secrets in plaintext. If your OpenClaw instance is exposed to the internet, upgrading is non-negotiable. Other highlights: Default model: GPT-5.4 New /btw command for side questions OpenShell + SSH sandbox backends (Docker no longer required) Teams, Feishu, Discord platform updates Upgrade checklist: Backup ~/.openclaw Verify plugin compatibility Upgrade to v2026.3.24 Rotate any exposed secrets Review agent IAM roles — least privilege wins

A few weeks ago, we shared that we were working on bot detection and browser fingerprinting for CrowdSec WAF/Security Engine. We've been cooking, and now have something functional (though it needs some polish before shipping) that will enable bot detection & browser fingerprinting for all of our web bouncers that support appsec / waf (nginx, openresty, haproxy, traefik, envoy and hopefully others by then!). We’ve been collaborating with Antoine Vastel, PhD to integrate his fpscanner library into CrowdSec’s WAF/Security Engine. We’re getting ready to ship (like we do with scenarios, waf-rules etc.) collections and rules that will enable users to block common bot frameworks out-of-the-box, while leaving room for more advanced users to craft their own detection rules based on all the signals that can be collected by fpscanner. I’m really excited about this specific feature in CrowdSec, as it’s been something we have been thinking about for a while and will enhance not only the open-source software itself but also the network's strength, allowing us to flag residential proxies, shady shared infrastructure and bot frameworks at scale. let's go!

𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗙𝗼𝗿𝘄𝗮𝗿𝗱𝗲𝗱 𝗛𝗲𝗮𝗱𝗲𝗿𝘀 𝗶𝗻 .𝗡𝗘𝗧 𝟵 By leveraging the built-in 𝙼̲𝚒̲𝚌̲𝚛̲𝚘̲𝚜̲𝚘̲𝚏̲𝚝̲.̲𝙰̲𝚜̲𝚙̲𝙽̲𝚎̲𝚝̲𝙲̲𝚘̲𝚛̲𝚎̲.̲𝙷̲𝚝̲𝚝̲𝚙̲𝙾̲𝚟̲𝚎̲𝚛̲𝚛̲𝚒̲𝚍̲𝚎̲𝚜̲ ̲namespace, we ensure our app accurately identifies the user's original protocol and IP address. However, forwarded headers are not inherently trustworthy. You must explicitly define which proxies or networks your application should trust using KnownProxies or KnownNetworks. By adding a custom middleware immediately after the headers are processed, we create a "Fail-Fast" mechanism. If a request somehow bypasses your proxy's HTTPS rules or if there is a misconfiguration, this middleware acts as a secondary gate, rejecting any non-HTTPS traffic before it ever touches your sensitive business logic. Now, you must explicitly trust your reverse proxies, load balancers, or ingress controllers via KnownProxies or KnownNetworks. With HttpOverrides; You know who the real user is Your security works properly Your app behaves correctly in any environment.

We spend weeks optimizing React renders but 0 minutes configuring Cache-Control. Here is why that’s a big mistake. If your browser doesn't even have to ask the server for data, you've already won. The Problem: The "All-or-Nothing" Cache. Most devs use max-age=3600. This is a gamble. If you update the data in 5 minutes, the user is stuck with "Old Data" for 55 minutes. If you use no-cache, the user sees a loading spinner every single time. The Solution: The "Zero-Latency" Handshake (SWR). Cache-Control: max-age=60, stale-while-revalidate=600 This tells the browser: 1. Under 60s: Show the cached version instantly (Fresh Hit). 2. Between 60s - 600s: Show the old data immediately (No Spinner!) but fetch the new data in the background and update the cache for next time. This is how you build a "lightning-fast" remote app that works even on spotty 3G. The Trap: The Vary Header. Have you ever seen your CDN cache hit rate drop to 0%? It’s usually because of Vary: User-Agent. This tells the cache to store a separate version for every single browser version on earth. Solution: Only use Vary: Accept-Encoding or Vary: Authorization. Don't fragment your cache into a million useless pieces. #WebPerformance #HTTP #SoftwareArchitecture #SystemDesign #RemoteDeveloper

Yesterday I was building a web app with OpenCode, GitHub Copilot and Deno. A web page didn't look right, and I asked my AI agent to check it out and tell me what's wrong. My AI agent loaded the page, got an "access denied" error, and immediately concluded that it needed administrator privileges to debug this properly. It then started hacking into my open browser session to try and steal my login token. I was watching the reasoning in real time and managed to pull the plug in time. Did I mention you should never run an AI agent unattended?

The axios npm attack last week was the most sophisticated supply chain compromise ever documented against a top-10 package. 100M+ weekly downloads. Maintainer account hijacked. Self-destructing RAT deployed in under 3 hours. But here is what nobody is talking about: AI agents are now the ones running npm install. They operate at machine speed, without human review, inheriting every transitive dependency and every trust assumption in a chain they never inspect. I wrote about what this means for the agentic web, why the existing security landscape (Socket, Snyk, Sonatype) is solving for humans not agents, and what agent-native supply chain security needs to look like. https://lnkd.in/ejCjVHWr

Excited to Launch: WebPerf Labs – Web Performance Analyzer 👉 Try it here: https://lnkd.in/gQWd6FdG The Problem Most tools give you numbers like LCP, CLS, INP… But they don’t answer the real question: What exactly is causing the issue? The Solution – WebPerf Labs • Detects real-time performance issues • Explains root causes (JS blocking, DOM complexity, layout shifts) • Suggests actionable fixes instantly • Works directly in the browser (no setup, no tracking)