NEXUS-Q is an open-source Rust security engine for protecting data, cryptographic keys, and identities. Its intended workflows include authenticated encryption of files and streams, key generation and lifecycle management, and digital signatures and verifiable credentials. The project organizes its cryptographic core, algorithm-specific crates, application interfaces, optional services, and language bindings as separate components. It offers a Rust library, command-line tool, server, vault and storage features, policy checks, audit logging, and bindings for languages including C, Python, Go, Java, Swift, and TypeScript. The repository presents standardized classical and post-quantum cryptography, including ML-KEM and ML-DSA, with RustCrypto as the default implementation path.
The project emphasizes documented security boundaries and an auditable development workflow, including security CI and fuzz testing, while clearly limiting its assurance claims. Version 4.1.2 is described as audit-ready, not production-ready: no independent external audit or FIPS validation is claimed, and an external audit remains pending. The native ML-KEM/ML-DSA backend is experimental, opt-in, and unaudited; algorithm support does not mean every interface exposes every operation. Protection also depends on deployment conditions: stolen vault files remain vulnerable if unlock secrets are obtained, and controls such as zeroization cannot guarantee safety on a compromised system. Package availability, platform support, and release provenance vary by ecosystem, so users are directed to verify the specific package and deployment documentation.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A covert Russian network used fake media posts to exploit French riots, spreading false claims about migrants and portraying the government as weak. French and EU assessments also found Israeli-linked and MAGA accounts pushing hostile narratives about the unrest. (reuters.com)
A Microsoft-signed boot shim can be reused to undermine Secure Boot protections on corporate computers. The research explains how Secure Boot validates trusted boot components and previews a practical technique for exploiting that trust. (leosmith.wtf)
ChatGPT Desktop forwards your local SSH agent to remote machines. Remote agents can use your SSH credentials to access private repositories and push code. (news.ycombinator.com)
Chinese surveillance technology is helping repressive African governments monitor citizens and suppress dissent. The systems give authorities tools to track critics and control public activity. (economist.com)
U.S. officials say Alice Huang, a Chinese businesswoman close to Nvidia CEO Jensen Huang, was recruited by China’s Ministry of State Security to gather intelligence on him and seek access to advanced AI chips. House committee leaders have requested a closed-door briefing from Jensen Huang about his interactions with her. (nytimes.com)
Security researchers found vulnerabilities in a major automaker’s connected-car systems while examining the infrastructure behind its remote-unlock app. An exposed admin tool and weaknesses in the platform enabled access to cars across much of the world. (shubs.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.