威脅模型：安全檢查的邊界與決策
對於高價值資產、架構快速變動或信任邊界改變的系統，安全檢查若缺乏威脅模型，容易退化為形式上的合規勾選。清單在低風險情境提供高效且可稽核的標準，但在動態架構中單獨使用時可能不足以覆蓋風險。真正的取捨在於資產、信任邊界與攻擊路徑的清晰度，而非追求形式上的完美。
Security
Threat Modeling: The Boundaries and Decisions of Security Checks
For high-value assets, rapidly changing architectures, or shifting trust boundaries, checklists without threat models can become formal compliance.
ExploitGym：AI 代理在受控環境下的漏洞利用能力與邊界
ExploitGym 以 898 個真實漏洞測試 AI 代理的攻擊轉換能力。Claude Mythos Preview 與 GPT-5.5 在解除防禦下分別達成 157 與 120 次成功，但啟用 ASLR 等防護後成功率大幅下降。本文解析其機制、邊界與風險管理準則。
ExploitGym: AI Agents’ Exploitation Capabilities and Boundaries in Controlled Environments
ExploitGym tests AI agents’ ability to turn 898 real vulnerabilities into attacks. With defenses disabled, Claude Mythos Preview and GPT-5.5 achieved 157 and 120 successes respectively, but success rates dropped sharply after protections such as ASLR were enabled. This article examines its mechanisms, boundaries, and risk-management principles.
Kubernetes Admission 異常模式與復原防線
當 Webhook 驗證服務異常時，系統面臨保全合規與保障可用性的取捨。本文解析 Kubernetes Admission Control 的行為邊界：Fail 模式會阻斷匹配請求但確保政策強制力，Ignore 模式則放行請求但留下未攔截的配置偏差。同時探討 Gatekeeper 在極端條件下的寫入僵局與復原路徑。
Kubernetes Admission Failure Modes and Recovery Safeguards
When a Webhook validation service fails, the system faces a trade-off between preserving security compliance and ensuring availability. This article analyzes the behavioral boundaries of Kubernetes Admission Control: Fail mode blocks matching requests but ensures policy enforcement, whereas Ignore mode permits requests but leaves configuration drift that is not intercepted. It also explores Gatekeeper write deadlocks and recovery paths under extreme conditions.
iOS SSL Pinning and Certificate Validation Guide
Implement SSL pinning and certificate validation in iOS apps using Swift URLSession and certificate chain verification. Protect against man-in-the-middle attacks with public key pinning and custom trust evaluation for mobile security developers.
iOS SSL Pinning 與憑證驗證完整指南
在 iOS 應用中實現 SSL Pinning 與自定義憑證驗證，防止中間人攻擊，確保 HTTPS 通訊安全。本文涵蓋 URLSession、SecTrust API 與實務驗證步驟。
Chunghwa Telecom Certificate Revocation: In-Depth Analysis of Causes, Technical Details, and Impact
h2 Event Overview/h2 p On May 30, 2025, Google’s security team announced through their official blog that Chrome 139 and later versions would stop trusting T…
中華電信憑證撤銷事件深度分析：前因後果、技術細節與影響
h2 事件概述/h2 p 2025年5月30日，Google 安全團隊透過官方部落格宣布：自2025年8月1日起，Chrome 139及後續版本將停止信任中華電信簽發的 TLS 憑證。這是台灣憑證基礎建設史上首次重大信任危機，影響超過10,000個網站，包括8,000個政府網站與2,000個企業網站。/p p…