Swift Tool Blocks BadUSB Keystroke Attacks on macOS Before They Execute

·2 views

A developer building a macOS security utility called RoamSwitch demonstrated how a malicious OMG Cable — indistinguishable from a standard USB-C charging cord — can compromise a Mac in under 500 milliseconds by injecting keystrokes at over 1,000 words per minute. The attack exploits macOS trust architecture, which treats any authorized USB keyboard as legitimate human input, bypassing Ventura's accessory-connection dialog once a user clicks 'Allow.' To counter this, the developer implemented a fail-closed keystroke quarantine in Swift using IOHIDManager to detect unrecognized USB keyboards and a system-wide CGEventTap to instantly drop all keystrokes before they reach the OS. A modal prompt then asks the user to approve or reject the new device, ensuring no payload can execute during the confirmation window. The solution deliberately avoids Apple's DriverKit framework to sidestep lengthy entitlement approvals and complex installation requirements for indie developers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why AI Self-Improvement Claims Need Falsifiable Gates, Not Self-Reported Wins

A developer built a meta-science framework for the All Things Agentic Hackathon to rigorously test whether AI self-improvement claims are genuinely verifiable. The core principle holds that no agent should be allowed to judge its own outputs, drawing on Popper's falsifiability standard and Pearl's distinction between correlation and causal intervention. Proposals from the AI model are placed in a non-authoritative tier and can only be promoted to canon by outperforming a baseline on unseen test worlds by a defined margin, preventing noise from being mistaken for progress. In three live runs, the system promoted only one of Gemini's three proposals, with most rejections involving real but insufficient gains. The project also turned its scrutiny inward, uncovering a flaw in its own benchmark methodology that was only caught through rigorous self-auditing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Team Builds AI Support Agent That Flags Knowledge Gaps Instead of Guessing

A small development team at Elite Solution in Moldova built an agentic system called Foundry in two weeks for the Google Cloud All Things Agentic Hackathon. Foundry crawls a business website, drafts a support knowledge base, and identifies gaps or contradictions it cannot answer — then prompts the human owner to fill them in before publishing. All responses served by the support bot are human-approved, and unanswered queries are declared as gaps rather than guessed. The entire system runs on Google Cloud infrastructure, using tools such as Vertex AI, Gemini Flash, Cloud Run, and Firestore to manage a draft-to-active-to-superseded content lifecycle. The team's key insight was that silent failures — bugs that pass tests but break in real use — pose a greater risk in agentic systems than outright crashes, leading them to adopt mandatory end-to-end human walkthroughs before marking any feature complete.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer seeks fix for simultaneous div reposition and resize on left-edge drag

A developer on DEV Community is struggling to implement left-edge dragging on a dynamically created HTML div using JavaScript. The core challenge involves updating both the div's left position and its width simultaneously, as moving the left edge rightward should reduce the width while shifting the element. The developer has a working mouse-move function that handles free dragging and other border interactions, but the left-edge logic causes erratic behavior. The issue stems from trying to modify style.left and style.width together without correctly recalculating the relationship between position and dimensions. The developer has shared their full mousemove handler code and is seeking guidance on the correct approach.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Germany's Konrad Zuse Museum to Close Permanently Due to Funding Shortfall

The Konrad Zuse Museum in Germany is shutting down after failing to secure sufficient funding to continue operations. The museum was dedicated to Konrad Zuse, the German engineer widely credited with building the world's first programmable computer. Located in the Saxony region of Germany, the institution preserved the legacy of one of computing's most influential pioneers. The closure marks a significant loss for the history of computer science and technology heritage in the country.

0 comments Read more at Hacker News