TLS Archives

Winsage

August 15, 2026

After years of requests, Windows 11 is dangerously close to bringing back full taskbar freedom — top, left, right, or bottom

Windows 11 users can now relocate the taskbar to the top or sides of the screen with the latest Insider Preview builds. This feature will be included in the September Patch Tuesday update, but is available immediately to those in the Release Preview Channel. The update also allows for a smaller taskbar option, enhancing screen space for smaller devices. Key features in Build 26100.9267/26200.9267 include: - Taskbar customization with new positioning options and a smaller taskbar option. - Enhanced Start menu with size options, renaming of the Recommended section to Recent, and a redesigned settings page. - Improvements to Windows Search, including a simplified interface and automatic indexing of frequently used folders. - Updates to File Explorer for faster launch times and touch scrolling support. - General design updates with modernized progress indicators. - New Windows Share feature for discovering apps from the share window. - Enhanced security with just-in-time privileges for administrative tasks. - Improved responsiveness when switching between virtual desktops. - Updates for display settings and brightness reliability. - Reliability improvements for Task Manager and Windows Update behavior. - Network improvements for VPN-related issues. - Enhanced typing reliability with the Japanese IME. - Introduction of the ML-KEM algorithm for TLS key exchange. - Removal of the Windows Management Instrumentation Command-line utility in future versions.

Tech Optimizer

August 13, 2026

Enforcing TLS and managing certificate rotation for RDS and Amazon Aurora PostgreSQL

When an Amazon RDS certificate expires and the application’s trust store is outdated, it can cause connection failures. AWS announces Certificate Authorities (CA) rotation events in advance and provides management tools, but a lack of proactive certificate lifecycle management can lead to unplanned downtime. Default configurations for RDS and Amazon Aurora allow both encrypted and unencrypted PostgreSQL connections, which can expose sensitive data if not properly configured. AWS manages the Certificate Authority infrastructure and provisions server certificates, while users are responsible for enforcing TLS usage and managing the rotation lifecycle. Amazon RDS employs a managed Certificate Authority hierarchy that issues server certificates for each database instance, supporting TLS 1.2 and TLS 1.3. The solution to enforce TLS includes server-side enforcement with the rds.force_ssl parameter, client-side verification with the sslmode=verify-full parameter, and automated lifecycle monitoring using Amazon EventBridge, AWS Lambda, and Amazon CloudWatch. Prerequisites for implementing this solution include an AWS account with an Amazon RDS for PostgreSQL or Amazon Aurora PostgreSQL instance, IAM permissions for relevant services, a compatible PostgreSQL client, familiarity with Amazon RDS parameter groups, and the openssl CLI. The rds.force_ssl parameter controls whether Amazon RDS rejects non-SSL connections, with defaults varying by PostgreSQL version.

Tech Optimizer

August 4, 2026

Automated PII redaction for Amazon RDS for PostgreSQL audit logs

The article discusses a serverless pipeline for creating an irreversibly redacted and queryable archive of Amazon RDS for PostgreSQL audit logs. It sanitizes sensitive information, such as Social Security numbers, credit card details, and email addresses, before storing the clean logs in Amazon S3, which can be queried using Amazon Athena. The deployment process is facilitated by a single AWS CloudFormation template. The challenge is that pgAudit logs sensitive data in cleartext to Amazon CloudWatch Logs, which poses compliance risks under regulations like GDPR and HIPAA. While CloudWatch Logs Data Protection offers reversible masking of PII, this is insufficient for compliance needs requiring permanent separation of PII from audit evidence. The proposed pipeline creates an irreversibly redacted copy stored in Amazon S3, ensuring original values cannot be restored. The deployment requires an active AWS account with specific permissions, AWS CLI v2, a compatible AWS region, and confirmation of service quotas. The CloudFormation template has four main parameters for deployment, including ProjectName, DBInstanceClass, DBAllocatedStorage, and EnvironmentType, with sensible defaults provided. Three deployment options are available: via the AWS console, AWS CLI, or a deploy script. After deployment, users can generate test data, trigger the redaction pipeline, and verify results in Athena. The process includes steps to create a PostgreSQL table, insert records with PII, run queries, and monitor the execution of the redaction pipeline. The article emphasizes that unredacted PII remains in the source CloudWatch Logs, recommending enabling CloudWatch Logs Data Protection for added security. To clean up resources and avoid charges, users must empty the S3 buckets and delete the stack. Cost considerations for the pipeline include infrastructure costs and the expense of achieving irreversibility.

AppWizard

July 31, 2026

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight's investigation revealed that inexpensive Android TV boxes are being shipped with applications that can change their hardware identity, allowing them to impersonate popular smartphone brands like Samsung and Huawei. This operation, named Fuyao, is linked to Zhejiang Fengwo IoT Technology Co., Ltd., a Chinese company established in 2019. The H96MAXV11 model was frequently reported among the affected devices. In one day, the operation received 65,957 reports from about 38,000 unique MAC addresses, with many devices misidentified as phones due to spoofed identifiers. Fengwo has also promoted over 120,000 "AI digital humans," though details on this marketing term are vague. The command-and-control server for Fuyao sends phone profiles to devices, masking their actual hardware specifications. The operation uses machine vision technology and a YOLOv8s object-detection model to identify advertisements. Bitsight documented 40 fraud tasks, 21 unique campaigns, and 166 modules across four devices. The operation's payout structure involves 144 operator-owned domains, with an estimated gross return of .25 per device daily, potentially leading to annual revenues in the millions. Attribution to Fengwo is supported by shared TLS certificate data and public patent records, although the patents do not directly address advertising. There is uncertainty about how the fraudulent apps were installed and at what point in the supply chain they were introduced. Device owners are advised to verify Play Protect certification and disconnect suspicious devices.

Tech Optimizer

July 28, 2026

Migrate self-managed PostgreSQL to Amazon RDS using the RDS console

Running PostgreSQL on Amazon EC2 requires users to manage operational tasks such as patching, backups, and security. Migrating to Amazon RDS for PostgreSQL or Amazon Aurora PostgreSQL-Compatible Edition offers a fully managed service that automates these tasks, allowing development teams to focus on application development. The migration process uses the auto-migration feature in the Amazon RDS console, supported by AWS Database Migration Service (AWS DMS), which facilitates PostgreSQL-to-PostgreSQL migrations using native tools for accurate schema mapping and faster migration. The migration can be executed using various methods, including pg_dump/pg_restore, manual AWS DMS tasks, or third-party tools, with the RDS console approach being preferred for its reliability and minimal setup effort. AWS DMS supports three replication modes: full load, CDC only, and full load + CDC, with the migration duration depending on database size and network throughput. Prerequisites for migration include having a source PostgreSQL 10.4+ on Amazon EC2, a target RDS for PostgreSQL or Aurora PostgreSQL, proper IAM roles, stored credentials in Secrets Manager, and appropriate networking configurations. Considerations include unsupported objects, potential issues with sequence values, and the need to avoid schema changes during CDC. The migration involves preparing the source database, creating necessary users and permissions, and executing the migration through the RDS console. Post-migration, it is essential to verify data integrity, optimize performance by updating statistics and rebuilding indexes, and implement security best practices such as disabling the DMS user and enforcing SSL/TLS connections. Common troubleshooting errors during migration include permission issues, incorrect WAL levels, and connection refusals, each with specific resolutions. Finally, to avoid ongoing charges, it is recommended to clean up resources created during the migration process, including deleting the DMS migration task, logical replication publications, Secrets Manager secrets, and the target RDS/Aurora instance.

AppWizard

July 27, 2026

My parents’ Android phones were ruined by invasive ads. Here’s how I fixed them for good

Mobile advertising on Android devices has seen a rise in deceptive pop-ups that mimic legitimate notifications or system updates, leaving many users, particularly less tech-savvy individuals, vulnerable. A personal experience highlighted this issue when a family member fell for a misleading PDF ad, leading to the installation of multiple fraudulent applications. Recently, similar deceptive ads were encountered on YouTube, raising concerns about the safety of family members who rely on their devices for important tasks. Discussions on platforms like Reddit have pointed out the prevalence of misleading ads on family-friendly platforms. The author expressed a desire to block all ads if companies cannot ensure their safety. To address the issue, the author sought an ad-blocking solution that allows for remote management and network-wide filtering, ultimately choosing NextDNS. This content filtering solution offers a free account with sufficient monthly DNS queries and supports individual profiles for tailored settings. The setup process for NextDNS involves creating profiles for each family member, allowing for distinct settings and blocklists, and configuring devices with the provided DNS-over-TLS endpoint details. While NextDNS is effective, it does not eliminate all ads, particularly those from platforms like YouTube, indicating that additional measures may be necessary for comprehensive security. Regularly reviewing app permissions and uninstalling unnecessary applications are also recommended for enhancing security.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

Winsage

June 13, 2026

Windows Server is getting new network safety capabilities with DNS over HTTPS

Microsoft has introduced DNS over HTTPS (DoH) on Windows Server 2025, enhancing network security by encrypting DNS traffic for client-to-server communications. This feature, previously available only in Windows client editions, is now part of Microsoft's Zero Trust architecture. DoH routes DNS traffic through HTTPS secured with TLS certificates, preventing eavesdropping and safeguarding DNS data from tampering. It adheres to the IETF DNS over HTTPS standard (RFC 8484) and can integrate with existing infrastructure, allowing organizations to maintain unencrypted DNS traffic if needed. DoH is available for Windows Server 2025 systems updated to the latest Patch Tuesday release, and Microsoft has provided guidance on enabling this feature. However, DNS traffic exchanged between two DNS servers will not be encrypted by DoH.

Winsage

June 13, 2026

Windows Server 2025 Adds DNS Over HTTPS for Secure DNS Traffic

Microsoft has rolled out support for DNS over HTTPS (DoH) in Windows DNS Server as part of the Windows Server 2025 update. This feature enhances the security of DNS communications through encryption and server authentication, allowing encrypted client-to-resolver traffic in on-premises DNS environments. DoH encrypts DNS queries and responses using HTTPS, protecting sensitive information from interception or alteration. It also uses digital certificates for DNS server authentication to reduce spoofing and impersonation risks. The feature is compatible with existing Windows DNS Server configurations and supports both encrypted and traditional DNS. DoH support is available on Windows Server 2025 with the June 9, 2026 update or newer. Administrators must configure a trusted TLS certificate and enable DoH in the DNS Server service to deploy this feature. Microsoft plans to extend encryption capabilities to include communication between the Windows DNS Server and upstream DNS resolvers in the future.

Tech Optimizer

June 6, 2026

Implementing real-time change data capture with Debezium for Amazon Aurora PostgreSQL and Amazon RDS for PostgreSQL

Amazon Aurora PostgreSQL-Compatible Edition and Amazon RDS for PostgreSQL support native streaming replication, allowing data changes to flow from source databases. Organizations often struggle with real-time data capture and dissemination, leading to outdated information due to traditional batch ETL pipelines. Debezium is an open-source platform for change data capture (CDC) that streams database changes to applications or data pipelines in real time. The CDC solution utilizes PostgreSQL's logical replication capabilities and Debezium's framework. Key components include Amazon Aurora for PostgreSQL as the source database, a Debezium PostgreSQL connector on MSK Connect, Amazon MSK for message streaming, and an Amazon EC2 instance for testing. To implement the solution, users must enable logical replication on Amazon Aurora, create an Amazon MSK cluster, set up an EC2 instance with Kafka, and create a custom plugin for MSK Connect. The process involves configuring IAM roles and policies, connecting to the database, and creating an Amazon MSK connector to stream changes. Testing the solution includes verifying real-time changes by inserting, updating, and deleting records in PostgreSQL, with events appearing in Kafka. Monitoring tools are available through CloudWatch for troubleshooting issues like replication slot lag and connector failures. To clean up resources after testing, users should delete the MSK Connect connector, custom plugin, Amazon MSK cluster, Aurora PostgreSQL database instance, EC2 instance, IAM role and policy, Secrets Manager secrets, CloudWatch Logs log group, and S3 bucket.