GIBSON RESEARCH CORPORATION https://www.GRC.com/ SERIES: Security Now! EPISODE: #1046 DATE: October 7, 2025 TITLE: Google's Developer Registration Decree HOSTS: Steve Gibson & Leo Laporte SOURCE: https://media.grc.com/sn/sn-1046.mp3 ARCHIVE: https://www.grc.com/securitynow.htm DESCRIPTION: Qantas says no one can releak their stolen data. Brave's usage is up. But is it really three times faster. Next Tuesday the EU votes on Chat Control. Microsoft formally launches a Security Store. Outlook moves to block JavaScript in SVGs. A new release of Chrome. Gmail will no longer pull external email via POP. Google Drive starts blocking ransomware encryptions. The UK issues another order to Apple. Researchers create a Battering RAM attack device. HackerOne's significant bug bounty payouts. The Imgur service goes dark across the UK. Guess why. The Netherlands plans to say NO to Chat Control. Discord was breached and government IDs leaked. Salesforce says it's not another new breach. Signal introduces a new post-quantum ratchet. Your motherboard MIGHT support TPM 2.0. Google to force Android app devs to register and pay. SHOW TEASE: It's time for Security Now!. Steve Gibson is here once again, making you aware of issues in our community like the Tuesday vote in the EU on Chat Control. What's wrong with that? Well, Steve will explain. He'll also talk about Brave's assertion it's three times faster than other browsers. Really? Researchers create the wildest Battering RAM attack device you've ever seen. And then we will talk about Google's plan to require everybody developing for Android to register with them. Is that a good idea? I think not. Let's find out what Steve thinks, next on Security Now!. LEO LAPORTE: This is Security Now! with Steve Gibson, Episode 1046, recorded Tuesday, October 7th, 2025: Google's Developer Registration Decree. It's time for Security Now!, the show where we get together with the brightest man I know and talk about the latest in security news, technology, with a dash of sci-fi, and every once in a while a pretty funny little Picture of the Week. That's Steve Gibson. STEVE GIBSON: And we actually do have a dash of sci-fi, which we'll be getting to. We have a release date for the second volume or the second tome of Peter Hamilton's whatever the hell that thing was. LEO: That means I have to finish that thing. STEVE: Oh. I don't know, Leo. LEO: Archimedes Engine, yeah. STEVE: We'll talk about it. I don't know. But, yeah, we've got a ton of news. LEO: That's, by the way, that's when I bought the hardcover book. We were talking about having a lot of stuff, you know, physical media, and how I love books. But I bought the physical book because I thought it would be nice to have on my bookshelf. I can never move. STEVE: Well, as I said, you and I love books. LEO: I do. STEVE: I do. I mean, and... LEO: I have a library, the whole room dedicated to books. It's beautiful. STEVE: Well, and I remember that was all there was, once upon a time. LEO: It's all we had. STEVE: And so you spent a lot of time paging through books. And now, you know, I have this huge library, I was telling Leo before that I'm going to be basically downsizing. My wife and I are moving to another place, and we're not going to bring anything that we don't actually need because... LEO: It's a good thing to do. You're going to do the Marie Kondo thing. STEVE: Yeah. LEO: You know about that; right? If it doesn't spark joy, get rid of it. You hold it up. You say, does this spark joy? And if it doesn't, you say... STEVE: Oh, unfortunately, Leo, pretty much everything sparks joy. LEO: You're very [crosstalk]. STEVE: So that's not my criteria. I would love to have the ability to hold, just to keep everything. But, I mean, I'm pointing with my finger there, that is a hard disk exerciser for a CalComp CDC or something or other, you know, old-school... LEO: Well, you can never get rid of that. STEVE: Actually, I do, and I have a garage full of PDP-8s and PDP-11s and things. And so, you know... LEO: Oh, yeah, yeah. STEVE: So, you know, but I think I'm going to ask those Guaranteed Obsolescence guys how they would like to have some actual... LEO: There you go. STEVE: Yeah. I think they would appreciate... LEO: Some reference gear, yeah. STEVE: Yeah. LEO: So what are we going to talk about on the show today? STEVE: Oh my god. LEO: Besides this great Picture of the Week. STEVE: Okay, lots of stuff. For 1046, here's our first show of October, a ton of news. Qantas says no one can releak their stolen data, which is the weirdest thing. We talked about this a few weeks ago. They got a temporary injunction. Now it's permanent. But, what? Anyway, we'll get there. The Brave browser's usage is up, but they make a claim that is just so annoying. I mean, to me, it just - it ends their credibility for them to say their browser is three times faster than the competition. It's like, what? LEO: Huh? Huh? STEVE: It's based on Chromium. It's the same as the competition. Anyway, next Tuesday the EU - oh, boy, everyone's holding their breath on this one. There's been some motion among the various countries in the EU will be voting on Chat Control. That'll be the 14th, so I don't think we'll have any probably results by next Tuesday's podcast, but certainly the one after. Microsoft has formally launched a Security Store. So maybe you can actually buy security from Microsoft. I wouldn't hold my breath, but okay. They're selling something. Outlook has decided that they want to block JavaScript in SVGs. Oh. We have a new release of Chrome. Gmail saying they will no longer pull external email via POP. That's not security related, but I thought maybe that would affect our listeners, so I wanted to let them know because I ran across it when I was digging around through other stuff. Google Drive to start blocking ransomware encryption. The UK has reissued an order to Apple. I love that, ordering Apple to do something. Good luck. Researchers have created something called the Battering RAM attack device. HackerOne, we've got news on their bug bounty payoffs. Imgur, that service, has gone dark across the UK. Guess why? Netherlands plans to say no to Chat Control. We'll be talking about that. Discord was breached, and guess what leaked out? Oh, boy. LEO: Uh-oh. STEVE: We saw this coming. Also Salesforce is saying, oh, no, that was not another new breach. They're trying to do some damage control still. Signal introducing post-quantum ratcheting. They have right now a double ratchet. That's not good enough for these guys. I mean, they are really serious about encryption. We're getting a triple ratchet. And it turns out your motherboard might actually support TPM 2.0, and you wouldn't know it, and Windows wouldn't tell you. So finally, once all of that and a Picture of the Week and some feedback from our listeners and a brief mention about SpinRite and a little bit of sci-fi, we're going to look at how Google has decided to force Android devs to register, provide formal identification, and pay, and what that means for the Android store. We have - I found a really beautifully written response from a well-known guy who has been doing a lot of work over at F-Droid, saying that basically F-Droid is effed. LEO: Toast, yeah. STEVE: If Google does this. LEO: I'm so disappointed. I've really wanted to hear what you have to say about this. STEVE: Yeah, it feels like a bait and switch, I mean, like now... LEO: It's very disappointing. STEVE: Now that we've got you all here, we're going to make you unmask. Anyway... LEO: Well, I don't know if you were listening to MacBreak Weekly earlier, but we were talking about with Apple's withdrawal of ICEBlock at the request of the federal government, we were saying, you know, really maybe the solution is having a second store or web-based app so you're not the sole place people can get apps from. But Google seems to be moving in the opposite direction. They like it. They like that lock-in. Well, we'll talk about that in a little bit. STEVE: Yeah. LEO: I have the Picture of the Week queued up. My reaction will be fresh and unsullied. I have not looked at it. STEVE: And not immediate. I should explain to our listeners what I already said to you. This is a wonderful Picture of the Week. I mean, this is, like, tailor-made for this podcast. But when I saw it I had to, like, what? And, like, read it all. LEO: Think about it. STEVE: Think about it for a minute. And then it was like, OMG, this is the cleverest thing. Now, okay, I know it's not the cleverest thing I ever saw. But I want to say that. LEO: It's up there. It's in the top hundred. STEVE: It's way - this is just great, yes. LEO: Now we got back to Steve, and I shall pull up the Picture of the Week, and I will - actually, you know what? Let me leave all three of us onscreen because I think this will fit. And I'm going to scroll up. This is so clever, you can see me trying to decipher this. It says "Black Wallet Found. You can contact me by solving this equation." Okay. Now I need to go full screen. You add your birthday to this number, and that will give you a phone number. "On Monday I will deliver it to the police station." Ah. Because the wallet has his driver's license. So the guy who posted this knows what his birthday is. So he has encoded his phone number. And you would only be able to get his phone number if you knew what your birthday was. If you're the owner. STEVE: Exactly. Exactly. LEO: Brilliant. STEVE: Isn't that just so cool? LEO: Yeah, you know, the other day I was walking by a store, it said: "Lost keys. Come in if you're missing your keys." And they hung the keys on the sign that said "Lost Keys." That's not how you do it. You say, "I've got them in my pocket. Can you describe them?" Right? STEVE: Right. Right. LEO: This is a great way to do it. STEVE: I thought this was just so clever. So for those who are listening to this going, "Huh? Huh? What?" Okay. So some person has left his wallet, like it fell out of his back pocket when he was at the restaurant. And some clever person comes along and discovers the wallet. And he thinks, okay, well, now, I found the guy's wallet. And I want to make sure it gets back to him. So how can I leave a note such that only the legitimate owner of the wallet will essentially authenticate himself and call me so that we can arrange to get his wallet back to him? So the person who discovers the wallet knows what his own phone number is. So he writes his own phone number out. Then beneath that he puts down the day, month, and year under the digits right aligned of his phone number, and subtracts those two numbers. The phone number will be 10 digits so it's larger than the day, month, and year. Subtracts the day, month, and year, getting a new number. LEO: You know that he did it that way because this is written on graph paper. STEVE: Yeah. LEO: And everything fits nicely into a little square. STEVE: And they are, you're right, they are lined up in the graph squares, yes. So then he takes the resulting number, and this is what he writes down on this piece of paper because since his phone number minus the guy's day, month, and year birth date created another number. When you take that other number and add the lost wallet owner's day, month, and year number, you'll get back the phone number of the person who discovered and is holding the wallet. Anyway, I just thought this was so clever. LEO: Good way to do it. I like it. STEVE: Many of our listeners got it and thought it was great. A couple, because they're our listeners, of course, said, well, you know, Steve... LEO: I know [crosstalk] going to say birthday collisions; right? Birthday collisions. STEVE: Not that as much as the fact that come on, now if the year is four digits, you know it's going to probably be 19, maybe 20. LEO: 19, yeah. STEVE: So anyway... LEO: Two numbers. STEVE: Everybody understands the nature of entropy. And we've gone over that for years in various reasons and forms on the podcast. So they're like, oh, you know, this could have been better. And other people wanted the day, month, and year moved into other orders for various reasons, or the digits interposed. I said, okay, you know, yeah. But you get the idea. LEO: You know what, this is just a filter system; right? So he has a second-factor authentication. You know, like what's in the wallet or something like that. This is just a filter out... STEVE: Yeah, well, and presumably there's a picture of the guy on his driver's license. So when the guy shows up, it's going to be like, uh, wait a minute, you used to have blond hair. So... LEO: I think you could just pop that in the mail, and the post office will deliver it. But that's all right. STEVE: Anyway, I just thought it was very clever. LEO: Very clever. STEVE: Okay. So we touched on this weird story in July. After the Australian Airline, Qantas, you know, Australia's big famous airline Qantas, was able to obtain a temporary injunction, get this, to prevent the use of data which had been stolen from them in a recent ransomware attack. Okay. What? No. I mean, even then, okay, so that temporary injunction has now been made permanent by the Australian New South Wales Supreme Court. This court order, which Qantas now has, prevents third parties from publishing, viewing - can't even look at it - or accessing the data if it should be released by the attackers. Turns out that, I mean, this was a bad breach. 5.7 million Qantas Airlines customers were compromised in a data breach which there was one - it was a breach of one of the airline's call centers. The data that was stolen included the business and residential addresses attached to 1.3 million accounts, phone numbers of 900,000 customers, and the dates of birth of a further 1.1 million. So it's a mess. The ruling justice of the Supreme Court in this case also agreed to impose a six-month, what they called a "non-publication order," basically a gag order, for the press over the names of the, they call them "solicitors" in Australia, you know, the attorneys who were acting on Qantas's behalf in the matter, the attorneys insisted that their identities not be published in any press coverage for fear of retaliation from the attackers. You know, this is the world we live in today where, you know, like everyone feels vulnerable, even if you didn't do anything and you're not high profile. So the whole thing seems really bizarre. Now, I'm pretty certain that the attackers could not care less, the attackers who are probably in Russia or China, you know, could not care less who Qantas hired to obtain an order blocking the publication of their stolen data, any more than they could care about some Australian court order blocking the publication of that data. You know, it's not as if anyone who might use the stolen data would be law abiding and would feel the least bit constrained by some court order issued by another country. You know, the data would be released to the Dark Web, perhaps be merged into a larger aggregate database, which we've seen in the past. Who knows? But no reputable law-abiding entity that might manage to obtain the data would be re-publishing it anyway, with or without a Supreme Court order. So anyway, the only thing that makes sense to me, some of the coverage had a picture of the Qantas CEO. The only thing that made sense to me is that this was just what you might call a CYA move by the Qantas CEO to appear to be doing whatever responsible thing could be arranged after one of their call centers was breached. So, you know, maybe this looks good to the shareholders. Oh, we've got a court order, and the Supreme Court has given us a permanent injunction against our data being, you know, looked at by anyone who might see it after it's been released. It's like, okay. Well, the bad news is you were breached. One would hope that they're spending equal time and money shoring up the security of their systems to prevent more trouble like this in the future because I don't think that the bad guys are going to be moved by them obtaining a court order. Okay. This one. The news is, the news that generated the posting from Brave was the Brave browser has surpassed 100 million active monthly users, or monthly active, MAU, monthly active users is their abbreviation. So here's what they wrote, and then we'll talk about it: "Over the past two years," they said, "the Brave browser has seen an average of about 2.5 million net new users each month. This September, we officially surpassed 100 million monthly active users (MAU) worldwide. At the same time, we surpassed 42 million daily active users" - of course that's DAU, they share with us - "for a DAU-to-MAU ratio of 0.42, underlining the high engagement that users have with Brave." And I completely agree with that. If you've got 42 million daily active users, though you've got basically 42 million people for whom Brave is their browser. You know, they don't have it, like, added to their collection of browsers. Let's see, what should I use today? Chrome? Do I want to use Firefox or Brave? No. They're just using Brave. They said: "This growth has been fueled by a global awareness that Brave is an alternative to Big Tech and that users benefit greatly from a browser that preserves their privacy and is up to three times faster" - uh-huh - "than competitors. Also, when users are given a choice, users exercise that choice and switch to new browsers. For example, daily installs for Brave on iOS in the EU went up 50% with the new browser choice panel..." LEO: Oh, that's interesting. STEVE: "...following the implementation of the DMA and the release of iOS 17.4 back in 2024." Okay. So they go on, but we don't care. Their usage numbers are nice, as I said, and they have an impressive, you know, upward-pointing graph. But what really annoyed me was their utterly bogus claim - I mean, come on - "of being up to..." LEO: But wait a minute, they've got weasel words. "Up to" three times faster means if you're using, like, Internet Explorer 6. Right? STEVE: Okay, but that's not a competitor, really. LEO: No, I know, but they're saying "up to." STEVE: Yeah. If you've got that, wait, my Palm Pilot browser, Leo... LEO: Exactly. STEVE: I would imagine... LEO: I'm sure there are browsers that are a third as fast as Brave somewhere. STEVE: If I took it out of the refrigerator and warmed it up, you know... LEO: Yeah. By the way, are you going to take that with you when you move? STEVE: So I call nonsense on this. Brave, as we know, is based upon the same Chromium engine as Chrome, Edge, Vivaldi, and Opera, their competitors. And believe me, if it was possible for any of those browsers to go any faster, they already would be. It's not as if the Brave folks have some magic pixie dust that they're keeping to themselves which magically triples the speed of their browser. Brave is no faster than any of those others when it's doing the same job. And that's the key. You know, it can't be. The only possible way for any browser that's using the same underlying engine code to render pages any faster would be for it to be rendering less of those pages. And that's the only way I can see Brave makes any claim at all. But 300%? Give me a break. If you managed to find a web page that's massively loaded down with large advertisements bringing massive JavaScript blobs and tracking code and heavy scripting all being served by slow servers a long ways away, then okay, sure, okay. If Brave's privacy enhancing policies block some of that crap from being loaded at all, it gets to declare "done" for that page faster than its sibling competitors, but only because Brave is choosing to render a partial page, whereas the rest of them are rendering the page's entire burden. So the claim did drive me to poke around the 'Net to see what I could find. There are some useful head-to-head benchmark comparisons on the Android platform where, when Brave is loading a heavily privacy-disrespecting page, it manages to perform around 21% better than browsers that are rendering the entire page. So that's useful. It means that sometimes Brave will, indeed, be a little bit faster than other browsers. But, you know, Brave should be ashamed of themselves for claiming that users will, in any meaningful way, actually ever experience Brave running three times faster than its competitors. As I noted, they're actually all the same browser. They differ only in UI and feature policies, not in their underlying page-rendering technologies. LEO: This is true. STEVE: They can decide not to render some things that they think are privacy invading. And in not rendering them, they'll finish a little quicker than the browsers that do render everything that they're being asked to render. LEO: I guess the real question is, is the Blink engine or the Chromium engine any faster than Firefox's engine, or WebKit Safari's engine. STEVE: That would be, it'd be Safari or Firefox would be the actual alternative to compare. I just looked at this saying, you know, we're 300% faster than our competitors. That's like, if you were, you wouldn't have any competition. You know, one of the things that we know Google found out very early on is how fast they had to make Chrome. And, you know, they spent a long time working on Chrome speed optimization back in the day. I have a chart here in the show notes, bottom of page 3, showing the Brave adoption. And, I mean, it's impressive. There's no doubt about it. I mean, Brave is doing well. People are responding to the, I mean, I did. When Firefox wasn't randomizing my fingerprint, I switched to Brave for a while. I came home to Firefox. But, you know, I can see people thinking, hey, what the hell, it's just as fast. Maybe it's three times faster. No. But I might as well use Brave. LEO: I don't like the crypto association with Brave, and I'm not too crazy about Brendan Eich. So I don't, you know, there are other choices. I use Helium, lately I've been using Helium which is a Chromium, de-googled Chrome Chromium fork that has uBlock Origin built in, so you get uBlock Origin back. And it's just like Chrome. And I get you that's faster than Brave because it doesn't have all the BAT tokens and all the other stuff Brave's doing. Right? STEVE: Right. Right. Right. LEO: It feels pretty snappy. STEVE: Okay. So next Tuesday, as I mentioned, October 14th, the EU member countries vote on "Chat Control," as it's informally known. Some news coverage from last Wednesday, which I had Firefox translate from German, reads: "The head of the messenger app Signal" - who we all know is Signal's president Meredith Whittaker - "threatens to withdraw from the European market. The reason is the EU's plan to install backdoors in apps that allow automatic search for criminal content." That's actually a pretty good explanation of what this boils down to. The translation continues: "The head of the Signal app has criticized plans in the EU, according to which Signal Messenger should have backdoors to enable the automatic search for criminal content. Meredith Whittaker told the DPA news agency: 'If we were faced...'" And, you know, she probably has this printed on her business card so she just hands that out. "'If we were faced with a choice of either undermining the integrity of our encryption and our privacy safeguards or leaving Europe, we would unfortunately make the decision to leave the market.'" Which, you know, Leo, if this goes far enough, means that only our own administration will be using Signal. Anyway... LEO: By the way, that's one of the things about Chat Control that the EU... STEVE: Right. LEO: ...legislators exempt themselves. STEVE: The government excludes - yes. LEO: Holy cow. That's a tell right there. STEVE: And how is that, how exactly is that going to work in practice? Like, you know, how do you tell, you know, Signal, oh, no, no. I'm with the Parliament, so... LEO: I'm okay. STEVE: So you can't look at my pictures. So this announcement said: "The European Union has been deliberating for three years" - yes, because, I mean, admittedly these are hard problems - "on a law to re-regulate the fight against depictions of child sexual abuse. The proposal of the corresponding regulation stipulates that messengers such as WhatsApp, Signal, Telegram, or Threema should enable the content to be checked before encryption." Okay, now, that key should be checked before encryption. This is not the first time that we've seen this new language talking about checking the content before its encryption. If this were going to be done, that's the way to do it. You have an image that's essentially in plaintext before it's pushed through the encrypted tunnel. So don't screw with the encryption. Don't mess with backdoors or any of that nonsense. If you insist upon breaching the user's privacy, don't also weaken the integrity of their communications at the same time. Simply check the image before it's sent or after it's received. But here's where I hope somebody with some technical chops is paying attention. No application running on iOS or Android has any contact whatsoever with the underlying imaging hardware, either its capture or its display. All of the messaging and communications apps are application programs, so they are accessing an application program interface, which we shorten to API, which is published by the underlying operating system to give its client applications, those programs with apps running on it, access to camera and stored images and to the device's screen. The API deliberately divorces all of the hundreds of thousands of platform applications from the underlying hardware. This allows the manufacturer the freedom to change their smartphone hardware at will. It explains why the same app can run on wildly differing smartphones without any trouble at all. And, of course, you know, this is all Computer Science Operating Systems 101. During the first year, it turns out, of my life, 70 years ago between 1955 and 1956, just shortly before you were born, Leo, General Motors Research, working with IBM, developed what was known as the GM, for General Motors, -NAA I/O system for the IBM model 704 mainframe computer. That work, for the first time in human history, used an I/O abstraction layer between the programs running on the machine and its underlying hardware. LEO: This is fascinating. I had no idea. Fascinating. STEVE: Needless to say, the idea was a good one, and it stuck. And it's been evolving ever since. So here's my point: It is completely wrong-headed for any legislation to be aimed at any communicating platform application, whether it's encrypted or not. That's the wrong target. And if that's the target, that is, if it is made to be the target, then we're playing an endless game of Whac-A-Mole. The legislation should be directed at the underlying operating system. It's the OS that runs the camera, and the screen, and the storage. It's not any messenger app's fault if it's given an abusive image to send. It's the operating system that gave that image to the messenger app in the first place. The operating system always sees the image first. And if the EU insists upon some behavior based upon the detected content of the image, then the operating system is the proper place to have that happen. If this is not done, then every application that communicates, whether encrypted or not, will need to be doing this, including iOS's and Android's own built-in encrypted Messenger apps. You know? We have printer drivers today so that every application doesn't need to bring along its own collection of printer drivers. Filtering messaging content is exactly the same. Rather than expecting every application to do this separately, which is crazy, especially since iOS and Android will also be needing to have this technology themselves to support their own legally EU-compliant messaging apps, it ought to be centralized. And that solves the problem of there being black market messaging apps that don't do this, whereas the good apps are complying. If this is moved into the underlying OS, no apps will have access to the hardware, and there's no way to get around this. So I just wanted to make sure everybody understood that there is one place for this to happen. Lord knows Apple doesn't want to have anything to do with that. I don't know where Google and Android would stand. But that's the right target for this legislation. So we don't know what's going to happen one week from today. But, you know, it's only a week away. Twelve of the EU bloc's 27 members have publicly stated that they are going to back the proposal with yeas. Eight are against. And the rest have said they're undecided. The proposal will pass if the Council is able to obtain what they define as "qualified majority." In this case that means at least 55% of the 27 member states, so that would be 15 of 27, and that majority must also represent at least 65% of the EU's total aggregate population. Also, the measure could be blocked by at least four countries which represent more than 35% of the EU population voting no. So this is obviously a big deal. We'll know in a week, or in a week or two. But the vote will be happening next Tuesday. So, really interesting to see how this thing shakes out. With any luck, it'll just - it won't succeed, again. In which case they'll, you know, who knows what, try to change it, amend it, you know, three years and counting. So this is obviously a heavy lift. Leo, we're going to talk about Microsoft's Security Store, which they just announced last week. LEO: Oh, I didn't know security was for sale. STEVE: Oh, yeah, because that's a profit center, Leo. If you've got bugs, you can charge for fixing them. LEO: The Security Store. Let's all go shopping. STEVE: That's right. Securitystore.microsoft.com, for anyone who wants to jump ahead. LEO: Unbelievable. Unbelievable. I swear. STEVE: Anyone going to the URL securitystore.microsoft.com will find themselves looking at Microsoft's just launched Security Store, as the name would suggest, from which Microsoft is literally selling Azure solution solutions. So just to be clear, this is not for end-users. This is not for, you know, us. But it's, you know, Azure cloud-based, and there it is onscreen. Discover, buy, and deploy security solutions and agents. LEO: I think their tagline should be, yes, your security is for sale. STEVE: Oh, wow. So last Tuesday, the Microsoft Security Community Blog posted under the title "Introducing Microsoft Security Store," which starts out saying: "Security is being reengineered" - because, you know, we didn't get it right the first time - "for the AI era" - of course we had to get that in - "moving beyond static, rule-bound controls and after-the-fact response toward platform-led, machine-speed defense." Ooh, that all sounds wonderful. I wonder what it costs. "We recognize that defending against modern threats requires the full strength of an ecosystem, combining our unique expertise and shared threat intelligence. But with so many options out there, it's tough for security professionals to cut through the noise" - and of course they're creating some more - "and even tougher to navigate long procurement cycles" - yeah, you don't want those. You just want to click a button and have it - "and stitch together tools and data before seeing meaningful improvements. "That's why we built Microsoft Security Store, a storefront designed for security professionals to discover, buy, and deploy security SaaS solutions and AI agents from our ecosystem partners such as Darktrace, Illumio, and BlueVoyant. Security SaaS solutions and AI agents on Security Store integrate with Microsoft Security products, including Sentinel platform, to enhance end-to-end protection. These integrated solutions and agents collaborate intelligently, sharing insights and leveraging AI to enhance critical security tasks like triage" - wait, isn't that what happens after you get attacked? Anyway, "threat hunting, and access management." So anyway, the page continues at some length describing how the Security Store essentially allows security professionals to browse, point, click, purchase, deploy, and manage their cloud security more easily than ever before. No more waiting for those pesky purchasing cycles and authorizations. You know, just get what you need and start using Microsoft's new "Security Copilot" solutions in minutes. So I have no doubt that we have many listeners who will probably find this new Microsoft packaging and deployment to be very useful, so I just wanted to make sure that those listeners were aware of this new facility. I am fortunate that I have nothing to do with Azure. LEO: Yeah, yeah. STEVE: And I will be able to live out the rest of my life happily with that statement remaining true, I'm quite sure. Okay. So there's welcome news on the Scalable Vector Graphics security front. Remember earlier this year the world saw a dramatic rise in the abuse of SVG-format image files. To ours and many other people's surprise and astonishment, it turns out that SVG image files, being formatted and formally defined as XML, have always, from version 1.0, been allowed to contain JavaScript, which would be faithfully executed whenever the image was rendered by whatever was rendering it, like unfortunately people's email, you know, clients. So this capability pretty much sat idle for most of that image format's life because SVG's been around for quite a while, until it was recently rediscovered by malefactors and starting being abused with increasing frequency. So much so that the, I mean, like, everybody, all the security industry, did articles on the explosion in scalable vector graphics abuse. Various product vendors changed the behavior of their SVG rendering code, such as stripping out