Ideas for building
better software.

ISC Stormcast For Monday, September 14th, 2026 https://isc.sans.edu/podcastdetail/10092, (Mon, Sep 14th)

The case against JPEG XL

Article URL: https://giannirosato.com/blog/post/case-against-jxl/ Comments URL: https://news.ycombinator.com/item?id=49690554 Points: 256 # Comments: 339

Apple's Dimensional Drawings

Article URL: https://developer.apple.com/accessories/dimensional-drawings/ Comments URL: https://news.ycombinator.com/item?id=49690174 Points: 373 # Comments: 125

Perplexity trusts GPT-6 Astra with end-to-end systems

Perplexity uses Astra to write communications, change software, and monitor production systems, and checks in much less frequently than with earlier models.

Access - Require fresh authentication for SAML identity providers

Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on Require reauthentication in the Cloudflare dashboard, or set force_authn to true through the API. Access will then set ForceAuthn to true in signed and unsigned SAML authentication requests. This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is false. For config

Browser Run - Control which hostnames Browser Run sessions can access

Browser Run now supports guardrails, which limit a browser session's HTTP and HTTPS requests to permitted hostnames. Use guardrails when you need to: Keep a browser workflow limited to a specific website and its subdomains. Load only known third-party APIs, scripts, images, and fonts. Generate a screenshot or PDF from HTML you provide while preventing it from loading external content. Set guardrails when starting a session with Puppeteer, Playwright, or the REST API. With a browser binding named

Data Loss Prevention - Discover where sensitive data goes before you create a Data Loss Prevention policy

Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs. The dashboard brings together detections from sampled HTTP request and response bodies. Select an entry to follow its detections over time, review destinations, and check policy coverage. You do not need a

AI Gateway - Prevent Unified Billing fallback for BYOK third-party providers

AI Gateway can now require credentials for third-party provider requests. Credentials must accompany the request or be stored on the gateway. This setting prevents fallback to Unified Billing with Cloudflare-managed credentials. Turn on Require provider credentials in your gateway settings. To use the API, set byok_only to true in the request body of a PUT request to update the gateway: { "byok_only": true } To require provider credentials for one third-party request, set the cf-aig-no-wholesa