2026-09-10

2026-09-10 Thursday - WMIC removed from Windows 11

Windows Management Instrumentation Command-line (WMIC) removal from Windows

https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/09/windows-management-instrumentation-command-line-wmic-removal-from-windows

Published: 2025-12-09 

KB ID: 5067470 

[...] 

See Timeline:  

[...] 

"2026: The WMIC utility has been removed from currently supported versions of Windows 11. The removal is reflected in Windows Insider Preview builds and will be included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2. WMIC is also removed from Windows 11, version 26H1. It is no longer available as a Feature on Demand (FoD)."

 

See Take action: 

"If you have been using the WMIC utility for administrative tasks or in applications, we recommend you migrate away from the WMIC utility and use supported alternatives." 

[...] 

"Use PowerShell for WMI tasks. WMI in PowerShell includes built-in cmdlets for Windows Management Instrumentation that can do everything WMIC did (and more). Common WMIC queries can be directly replaced with PowerShell commands."

For example, to return a list of process names:

  • Replace the WMIC query: wmic path win32_process get Name.
  • Use the PowerShell command instead: Get-CimInstance Win32_Process | Select-Object Name.

[...] 

"If you have batch files or scripts that call WMIC, plan to rewrite them using PowerShell cmdlets (such as Get-CimInstance, Get-WmiObject, Invoke-CimMethod, and so forth). If needed, run PowerShell from a CMD prompt using powershell -c "<command>" syntax. So, even in command-line contexts, you can invoke PowerShell commands to replace WMIC."

[...]

Other Articles: 

  1. https://www.scworld.com/brief/microsoft-removes-wmic-tool-from-windows-11 
  2. https://en.wikipedia.org/wiki/List_of_features_removed_in_Windows_11 
  3. https://learn.microsoft.com/en-us/windows-server/get-started/removed-deprecated-features-windows-server?tabs=ws25 

 

References:

WMIC: WMI command-line utility

  • https://en.wikipedia.org/wiki/Windows_Management_Instrumentation 
    • "Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification. WMI is Microsoft's implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF)."
    • "Also included with Windows was Windows Management Instrumentation Command-line (WMIC), a CLI utility to interface with WMI. However, starting with Windows 10, version 21H1 and Windows Server 2022, WMIC is deprecated in favor of PowerShell"
  • https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmic 

 

WMI Code Creator v1.0 
  • "The WMI Code Creator tool allows you to generate VBScript, C#, and VB .NET code that uses WMI to complete a management task such as querying for management data, executing a method from a WMI class, or receiving event notifications using WMI."
  • "The tool is meant to help IT Professionals quickly create management scripts and to help developers learn WMI scripting and WMI .NET. The tool helps take the complexity out of writing code that uses WMI and helps developers and IT Professionals understand how powerful and useful WMI can be for managing computers."
  • Published: 2024-07-15 

 

 

Posted by No comments:
Labels: , , , ,

2026-08-31

2026-08-31 Monday - Book Review: Build an AI Agent (From Scratch)

Last updated: 2026-08-31 Mon 

[image source: Amazon.com]


Build an AI Agent (From Scratch)

Publication Date: August 18, 2026 (paperback)

https://github.com/shangrilar/ai-agent-from-scratch

  • "Code repository for Manning's Build an AI Agent From Scratch"
  • License: MIT 
  • 57.6% Jupyter Notebook 
  • 42.4% Python 

 

My LinkedIn post: link

My Amazon Review: link

***********************************************************************************

3 stars 
A Good Introduction to Building AI Agents - but security-lite

This book is well written (given its length, and breadth of topics covered), and I like the pacing as well as the quality of the diagrams and illustrations. 

A key missing aspect – which I consider to be essential for a 5-star rating: Additional Suggested Reading citations at the end of chapters. 

I would like to give this book 4 Stars – but Security is not adequately covered. 

There is only one arxiv paper cited in the entire book. Citations of such papers, with information on Agent Security and MCP Security could have easily (and dramatically) improved the coverage of security considerations. 

Also, the OWASP MCP Top 10 should have been cited for additional reading.

I think this book should have had a Part 3, Agent Security (with minimally, 2-3 chapters) 
This book would be MUCH BETTER if there were some real world examples cited & discussed regarding cybersecurity events that have occurred due to agent misbehavior, and examples of compromised agents. 

Prompt Injection, as a security risk, is only mentioned once – with no practical examples. 
Chapter 8, page-224, Section 8.2.1 Why sandboxes are necessary 
"We also can’t rule out the possibility that malicious users will deliberately try to execute harmful code through prompt injection."

A suggestion for a 2nd edition of this book:
Consider inclusion of this arxiv paper (2602.11964) "Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments" (2026-02-12)

Some additional observations: 

Page-25: Listing 2.2 
Still specifies the "system" role
Page-26: 
explicitly states that "system" is the previous role name, but that it is now "developer" 


Page-26: Listing 2.3 
- temperature is discussed, but not shown in the example. 
- max_tokens is shown, but not discussed in the example 
- this is the only page that mentions max_tokens. 


page-58: Limiting the Number of Functions
"As a general guideline keep the number of tools under 20. Using too many tools can lead to selection errors."
This begs the following questions: 
- If an agent/LLM can reason, what is magical about 20? 
- How do you know when that upper limit changes (increases? decreases?) 
- How do you determine the magic number, for future/other models?
- How can you test/detect this aberrant error? 


page-67: 
"Security vulnerabilities in dependencies require updates."
(see my "Readers should also note:", below)


page-67: Section 3.4 MCP: Standardizing tools 
- should provide a link to the MCP specification web site 


page-91: Section 4.4.4 Integration MCP tools 
This section *really* should include a discussion of the security risks of MCP tools, and real examples of vulnerabilities that have exposed companies to being attacked. 


*** Good reminder 
page-144: Section 5.5.3 Human-in-the-loop tool-execution approval 
"Sensitive operations such as file deletion, email sending, and database modi­fications should require user confirmation before execution."


*** Good discussion/example 
page-159: Section 6.2.4 Compaction strategy 
For example, see Page-161: "This code turns 100,000 tokens of noise in every prompt into a precise, on-demand resource. The data can be huge, but the context window remains lean."


*** Good discussion 
Chapter 7: Planning and reflection for complex task 


*** A good example of the type of additional suggested reading I referenced at the beginning of my review 
page-222: Section 8.1.3 The effectiveness of code-based actions
(see the paper citation link, and the discussion in that section – in particular, note Figure 8.3) 



*** Good to see this discussed 
page-281: Section 9.6 A2A: Collaborating across networks 



*** This needs more elaboration, re: my suggestion for a Part 3 Agent Security.
page-286: see discussion "[...] security is a critical concern. [...]"


Readers should also note: 

The LiteLLM, that is used throughout the book, suffered a major supply chain attack in March 2026 when malicious versions (1.82.7 and 1.82.8) were published to PyPI, followed by the August 2026 release of a massive 153 GB dataset exposing credentials from over 2,000 affected organizations. (Google "The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials", by Leah Koonthamattam)

A March 2026 blog post by litellm included the following update: 
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."

While the companion GitHub repository for the book stipulates litellm version 1.83.7 (see pyproject.toml, and uv.lock) - on June 1, 2026 – litellm published a blog post:
"Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)"
- "The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."

***********************************************************************************
 

Additional Suggested Background Reading: 
(illustrative, not exhaustive)

LiteLLM 

See: 
pyproject.toml: Line #10, "litellm>=1.83.7",
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/pyproject.toml

See:
uv.lock: Line #449, "{ name = "litellm", specifier = ">=1.83.7" },"
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/uv.lock
    { name = "litellm", specifier = ">=1.83.7" },

 

Security Update: Suspected Supply Chain Incident
https://docs.litellm.ai/blog/security-update-march-2026
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."


2026-06-01: Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)
https://docs.litellm.ai/blog/host-header-auth-bypass
"The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."
 

The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials
by Leah Koonthamattam
https://cybelangel.com/blog/the-litellm-supply-chain-attack/
"In August 2026, a 153 GB dataset of exfiltrated credentials tied to this leak appeared, mapped to more than 2,000 organisations around the world, resulting in one of the largest AI related supply chain incidents of the year."

 

Supply Chain Attack Exposes 2,500+ Companies in Largest AI Infrastructure Breach of 2026 So Far
https://www.cxtoday.com/security-privacy-compliance/supply-chain-attack-exposes-2500-companies-in-largest-ai-infrastructure-breach-of-2026-so-far/
"[ cybersecurity firm CloudSEK] described the incident as the largest supply-chain attack targeting AI infrastructure identified so far in 2026. Orchestrated by the Team PCP threat actor group in March 2026, the attack affected approximately 434,000 CI/CD pipelines, which are automated workflows that build, test and deploy software code."

 

How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/

 

GAIA 

Benchmarking General AI Agents
https://huggingface.co/gaia-benchmark
https://huggingface.co/spaces/gaia-benchmark/leaderboard

 

GAIA - A Benchmark for General AI Assistants
https://www.youtube.com/watch?v=tG9CnyhwU8E

 

GAIA Paper:
GAIA: a benchmark for General AI Assistants (Nov 23, 2023)
https://huggingface.co/papers/2311.12983
https://arxiv.org/abs/2311.12983 (Nov 21, 2023) 

https://huggingface.co/collections/gaia-benchmark/gaia-release
https://huggingface.co/datasets/gaia-benchmark/GAIA

 

JoyAgent-JDGenie: Technical Report on the GAIA (2025-10-01)
https://arxiv.org/abs/2510.00510 

 

Welcome to Meta Agents Research Environments (ARE)
https://facebookresearch.github.io/meta-agents-research-environments/ 

 

Meta ARE: Scaling Up Agent Environments and Evaluations
https://ai.meta.com/research/publications/are-scaling-up-agent-environments-and-evaluations/

 

GAIA2 

Gaia2 and ARE: Empowering the Community to Evaluate Agents 
https://huggingface.co/blog/gaia2

 

Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments (2026-02-12)
https://arxiv.org/abs/2602.11964

 

Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments
https://openreview.net/forum?id=9gw03JpKK4

 

Meta AI Researcher Explains ARE and Gaia2: Scaling Up Agent Environments and Evaluations
https://arize.com/blog/meta-ai-researcher-explains-are-and-gaia2/
https://www.youtube.com/watch?v=lT4qtOlvhak


MCP Security

OWASP MCP Top 10
https://owasp.org/www-project-mcp-top-10/

 

The State of MCP Security, Pynt's 2025 Report
https://www.pynt.io/blog/llm-security-blogs/state-of-mcp-security
"Pynt’s latest research analyzes 281 MCP configurations collected from open agent frameworks and plugin stacks." 

 

MCP Horror Stories: The Security Issues Threatening AI Infrastructure
https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/

 

GitHub MCP Exploited: Accessing private repositories via MCP
https://invariantlabs.ai/blog/mcp-github-vulnerability

 

Securing the Model Context Protocol (MCP) Server
https://kenhuangus.substack.com/p/securing-the-model-context-protocol

 

A Security Engineer's Guide to MCP
https://semgrep.dev/blog/2025/a-security-engineers-guide-to-mcp/

 

Anthropic won't own MCP 'design flaw' putting 200K servers at risk, researchers say
https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/

 

The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic’s MCP
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
"Anthropic design choice Exposes 150M+ Downloads and up to 200K Servers to complete takeover"


The Mother of All AI Supply Chains: Technical Deep Dive
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-technical-deep-dive/

 

 

 

 

 

Posted by No comments:

2026-08-29

2026-08-29 Saturday - The Last 365 Days - some of my LinkedIn engagement stats

[image credit: LubosHouska  on pixabay dot com]

I consider the act of writing to be a craft, and the image of the wheel of the potter resonates well with my intention to create. 

My first audience is myself. I write to clarify my thinking, to capture contemporaneous events & ideas, and to document what I have discovered and learned – at a point in time.

A secondary goal is to help others: To illuminate, teach, educate, elevate, inform, advise, and provide insights. 

My writing is published through three primary channels: This blog, my LinkedIn posts, and my collection of GitHub repositories. 

With respect to LinkedIn, I took a moment today to reflect on some of my LinkedIn engagement stats.  

Note: 

  • My current LinkedIn Connections count: 6,830 
  • I am *very* selective about who I connect with on LinkedIn. 
  • I decline more connection requests than I accept. 
  • Given a choice between gaining 60K more followers/connections, or just two high quality connections that create, make, contribute, share, and actively post/write – without hesitation, I will choose just the two. 

Discovery: 

2026-08-29 Sat - Last 365 Days, SNAPSHOT

 

Engagement:   

2026-08-29 Sat - Last 365 Days, SNAPSHOT


Demographics: 

2026-08-29 Sat - Last 365 Days, SNAPSHOT

Posted by No comments:

2026-08-24

2026-08-24 Monday - On The Value of Diagrams

This post was inspired by my reply/comment to a LinkedIn post by Will Borici (Senior Consultant - Platform Strategy | Business Architecture (Data/AI-enabled); NTT DATA, Inc.)

 

[image credit: Vilkasss on pixabay dot com]

Over the weekend, I decided to get started building a piece of software that I have long wanted, and needed. In the past, I have used one commercially available software utility – but it was acquired, and is no longer available. Then I switched to using an open source utility – but it is no longer maintained.

So, I decided to begin.

But, beginning does not mean immediately writing code.

I had some very clear thoughts on what I wanted the software to do, but I wanted to explore the requirements, use cases, and design first.

So, I began drawing diagrams.
Diagrams allowed me to see layers of complexity – that if I had simply started coding – would have constrained, or made more difficult, implementing layers of features I *discovered* that I really wanted.

The more I drew, the more my vision became clearer, crisper, tangible. Reflecting on the diagrams - helped me to see which features to build first, and ways of making it more useful to others.


And, I was reminded, yet again ...
Drawing is a goodness, not a waste.
Even if the diagrams are thrown away, eventually.
Even if the diagrams are no longer maintained.

The diagrams are part of the process in creating great software products. 

Posted by No comments:
Labels: , , , , , , , , , ,

2026-08-10

2026-08-10 Monday - Suggested Background Reading: KnownDLLs, and DLL Search Order, Sideloading, Highjacking

 

[image source: seowoo_lee on pixabay dot com]

This blog post was motivated by reading the source code for Rufus (The Reliable USB Formatting Utility). In particular, see line #3388, rufus.c

"// Disable loading system DLLs from the current directory ..."
https://github.com/pbatard/rufus/blob/master/src/rufus.c

[also see my companion LinkedIn post]

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Some suggested background reading on the topics of KnownDLLs, DLL Name Resolution, DDL Search Order, DLL Sideloading, and DLL Hijacking.  

knowndlls
https://docs.dissect.tools/en/stable/plugins/knowndlls.html


Virtual memory and KnownDlls
https://github.com/yo-yo-yo-jbo/virtual_memory_known_dlls


Microsoft: Dynamic-link library search order
https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order


How Windows DLL Name Resolution Works - Search Order and SxS (2026)
https://comcomponent.com/en/blog/2026/03/24/002-windows-dll-name-resolution/


DLLs and Ways They Can Hurt Us (2026)
https://www.cynet.com/security-foundations/attack-techniques/dlls-and-ways-they-can-hurt-us/


DLL Sideloading - beyond classic DLL Hijacking - Red team diaries (2026)
https://cp.center/en/blog/post/dll-sideloading-beyond-classic-dll-hijacking-red-team-diaries


Intruders in the Library: Exploring DLL Hijacking (2024)
https://unit42.paloaltonetworks.com/dll-hijacking-techniques/


Breaking into Libraries – DLL Hijacking (2024)
https://labs.jumpsec.com/breaking-into-libraries-dll-hijacking/


Windows DLL 101 (2024)
"What the heck is a DEE ELL ELL and how do I hijack it?"
https://cybytes.substack.com/p/cybytes-issue-1-windows-dll-101


DLL Search Order Hijacking (2023)
https://medium.com/@sealteamsecs/dll-search-order-hijacking-c9c46ea9026c


OpenFileMapping and KnownDlls (2023)
https://inbits-sec.com/posts/openfilemapping-and-knowndlls/


DLL Side Loading (2022)
https://twelvesec.com/2022/12/16/a-dll-side-loading-technique-in-teamspeak-server-that-gains-reverse-shell-with-ms-real-time-enabled/


The DLL Search Order And Hijacking It (2021)
https://malwareandstuff.com/the-dll-search-order-and-hijacking-it/


Detecting and blocking unknown KnownDlls (2021)
https://www.elastic.co/blog/detect-block-unknown-knowndlls-windows-acl-hardening-attacks-cache-poisoning-escalation


DLL Hijacking: Top 7 Attack Variants and 6 Ways to Mitigate Them 
https://www.airlockdigital.com/learn/dll-hijacking-top-attack-variants-and-ways-to-mitigate-them

 

Posted by No comments:
Labels: , , , ,

2026-07-31

2026-07-31 Friday - Book Review : Deep Learning with R, Third Edition

 

[image source: Amazon.com]

Deep Learning with R, Third Edition
From first principles to generative AI

Published by: Manning

Authors:

✅ François Chollet

o   https://www.manning.com/authors/francois-chollet

o   https://www.linkedin.com/in/fchollet/ 

o   Founder of Keras

§  https://keras.io/

o   Co-Founder Ndea

§  https://ndea.com/

o   Co-Founder ARC Prize

§  https://arcprize.org/

o   https://intro.co/francoischollet

o   https://fchollet.com/

✅ Tomasz Kalinowski

o   https://www.manning.com/authors/tomasz-kalinowski

o   https://www.linkedin.com/in/t-kalinowski/ 

o    Engineering Manager, Posit (formerly RStudio) 

o   https://opensource.posit.co/people/tomasz-kalinowski/

o   https://posit.co/

o   https://github.com/t-kalinowski

o   https://bsky.app/profile/t-kalinowski.bsky.social

 Companion GitHub Repository: 

Publication Date: June 2, 2026

Pages: 648

My Review Rating:  5-Stars  

Also see my review on Amazon

My companion post on LinkedIn 

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Review Title: A Master Class - A Deep Treatment of Deep Learning with R

My immediate first impression of this book:

👉 In one word: Excellence;

👉 In three words: Attention to Detail.

I will admit upfront that I am a longtime fan of François Chollet’s writing, and his creation of Keras (from Chapter 7, Section 7.1, “The design of the Keras API is guided by the principle of progressive disclosure of complexity: make it easy to get started, yet make it possible to handle high-complexity use cases while requiring only incremental learning at each step. Simple use cases should be easy and approachable, and arbitrarily advanced workflows should be possible.”).

I consistently find great value in the books he has written.

This book is no “flash in the pan” – with 20 chapters, and over 600 pages of content.

This is a book that will extend your knowledge and help deepen your understanding.

Beginning with ‘Chapter 2, The mathematical building blocks of neural networks’, the authors set out to give you a foundation of understanding. This type of foundational prep is missing in many books. Without understanding the fundamental concepts and principles, the reader may be able to do the mechanics of coding something – but will usually fall short in understanding and be unaware/unable to apply the appropriate concepts, where/when needed.

This is not a book that you should read quickly, nor is it a book you should assume to read only once.

To get the optimum benefit of this book, you must put in the work. Revisiting chapters, like an old friend.

You should approach reading this book, like you would if you wanted to build muscles in your mind. There will be effort required to build the skills that will develop intuition – and that’s what will likely differentiate the diligent reader who selects this book, from the dilettante that merely touches it with the fingertips.

The rewards will be many.

This book strikes an excellent balance between the narrative of teaching, and the steady pacing of hands-on coding examples (which are invariably well explained).

A key distinction that elevates this book above many others: It teaches the Why, not just What.

Also, I suspect that readers will be pleased with the quality of the illustrations, particularly those that immediately help illustrate possibly unfamiliar concepts.

In some Japanese arts, there is the concept of a shokunin. While it might be simplistically translated as “craftsman”, or “artisan” – the meaning is much deeper: It represents a profound lifelong vocational philosophy – a relentless, meditative drive to continuously refine their work. As researchers, writers, and teachers – the authors are just such master shokunin.

 

A minor update that will be required for the next edition of this book:

re: See page-15 ("AI is making major strides toward helping accelerate science. The AlphaFold model from DeepMind is helping biologists predict protein structures with unprecedented accuracy.")

2026-07-28:  Google DeepMind dismantles Nobel-winning AlphaFold team in strategy shift (Yahoo Finance > Financial Times)

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Additional Reading Suggestions:

  1. R in Action, Third Edition: Data analysis and graphics with R and Tidyverse (2022)

 

Posted by No comments:
Labels: , , ,

2026-07-24

2026-07-24 Friday - Book Review: Software Security for Developers

Last Updated (see Addendums): 2026-08-07 Fri

[My LinkedIn companion post]

[image source: Amazon]



Book: Software Security for Developers: With Examples in Java and Spring

Publisher: Manning 

Publication Date: June 9, 2026

Authors: 

Adib Saikali
Distinguished Software Engineer @ Tanzu
Toronto, Ontario, Canada
https://www.linkedin.com/in/adibsaikali/

Laurentiu Spilca 
Principal Development Consultant, Endava
Bucharest, Romania
https://www.linkedin.com/in/laurspilca/?locale=en 

 

Review Rating:  4-Stars

Review Title: A good book for an introduction to Software Security - for both Developers and Managers 

[Link to my Amazon Review]

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

I enjoyed reading this book. It is well-written, and provides a broad survey of important software security concepts and techniques – with easy to understand illustrations, descriptions, and code examples. 

The companion GitHub repository provides 27 subfolders with Java & Spring examples.


Chapters 2-17 include a number of exercises (182), and at the end of the chapter there is a consistent approach in providing Exercise answers – as well as a Summary. The summary bullets are meaningful, and well written. 

If the reader leverages the contents of each chapter, including the exercises, and the code examples – then this book will provide the diligent reader with a very HANDS-ON learning experience.


Some minor nits:

The naming convention of the folders in the companion GitHub repository for the book would have been better named using a consistent 2-character identifier for the chapter, and a 2-character identifier for the exercise - so that a natural sort order would be enforced.

"Single-sign on" is improperly written, it should be "Single sign-on"
page-v
page-211 
page-335


While the writing is crisp & concise, and the coverage of the subject matter is *mostly* sufficient for a book of this length – there are three notable deficiencies:

1. The book suffers from a paucity of coverage for the very important topic of Post Quantum Cryptography (PQC).

Although the book was published in June 2026, there are only two pages (53, 75) that vaguely refer to NIST cryptographic algorithms standards – and neither of those mention the NIST work on Post Quantum Cryptography (PQC). Nor are there any "additional reading" suggestions. 

Further, on Page-94, this statement is made:
"Cryptographers are building encryption algorithms that can resist quantum computers, but none has been standardized so far."
- This is incorrect. 


On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIPS 204, and FIPS 205. [see NIST press release]

✅ Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation. The standard is based on the CRYSTALS-Kyber algorithm, which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism. 

✅ FIPS 204, intended as the primary standard for protecting digital signatures. The standard uses the CRYSTALS-Dilithium algorithm, which has been renamed ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm. 

✅ FIPS 205, also designed for digital signatures. The standard employs the SPHINCS+ algorithm, which has been renamed SLH-DSA, short for Stateless Hash-Based Digital Signature Algorithm. The standard is based on a different math approach than ML-DSA, and it is intended as a backup method in case ML-DSA proves vulnerable. 

On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange.The new algorithm is as a backup for ML-KEM, the main algorithm for general encryption.

Additionally, there are international alternatives to the NIST standard, that could have been briefly cited, and links provided. For example, see this Akamai article, 'A Guide to International Post-Quantum Cryptography Standards', published on Oct 08, 2025.


2. The book suffers from an absence of "further reading" suggestions for the important topic of Zero Trust. 


3. The book does not mention Homomorphic Encryption. 
 

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Addendums: 

Note: 2026-07-26 Sunday: I will probably add another 10-20, or 30 links here, before I am finished. 

These are just some of the suggested additional reading resources such a book could have included:
(illustrative, not exhaustive)

Status: Work-In-Progress 

Suggested sites for further reading:  

 
Java Security: 
 
Spring Security:  

 

 Interesting Security-related web sites: 

 

 

 


Interesting Security-related GitHub Resources:  

 

Homomorphic Encryption (HE) / Fully Homomorphic Encryption (FHE): 
  • Suggested Background Reading: 
    • https://en.wikipedia.org/wiki/Homomorphic_encryption 
      • "Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first having to decrypt it. The resulting computations are left in an encrypted form which, when decrypted, result in an output that is identical to that of the operations performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. This allows data to be encrypted and outsourced to commercial cloud environments for processing, all while encrypted."
      • Note table: "Implementations" 
    • https://en.wikipedia.org/wiki/Paillier_cryptosystem 
      • "The Paillier cryptosystem, invented by and named after Pascal Paillier in 1999, is a probabilistic asymmetric algorithm for public key cryptography. The problem of computing n-th residue classes is believed to be computationally difficult. The decisional composite residuosity assumption is the intractability hypothesis upon which this cryptosystem is based."

 

 

 

  • Papers:
    • OpenFHE: Open-Source Fully Homomorphic Encryption Library
      • https://eprint.iacr.org/2022/915 
        • "Fully Homomorphic Encryption (FHE) is a powerful cryptographic primitive that enables performing computations over encrypted data without having access to the secret key. We introduce OpenFHE, a new open-source FHE software library that incorporates selected design ideas from prior FHE projects, such as PALISADE, HElib, and HEAAN, and includes several new design concepts and ideas. The main new design features can be summarized as follows: (1) we assume from the very beginning that all implemented FHE schemes will support bootstrapping and scheme switching; (2) OpenFHE supports multiple hardware acceleration backends using a standard Hardware Abstraction Layer (HAL); (3) OpenFHE includes both user-friendly modes, where all maintenance operations, such as modulus switching, key switching, and bootstrapping, are automatically invoked by the library, and compiler-friendly modes, where an external compiler makes these decisions. This paper focuses on high-level description of OpenFHE design, and the reader is pointed to external OpenFHE references for a more detailed/technical description of the software library."
      • [Also see 'openfhe-development' GitHub Repo citation below, under 'GitHub Resources']

 

 

    • SoK: New Insights into Fully Homomorphic Encryption Libraries
      via Standardized Benchmarks (2022)
      • https://eprint.iacr.org/2022/425.pdf 
      • "Fully homomorphic encryption (FHE) enables arbitrary computation on encrypted data, allowing users to upload ciphertexts to cloud servers for computation while mitigating privacy risks. Many cryptographic schemes fall under the umbrella of FHE, and each scheme has several open-source implementations with its own strengths and weaknesses. Nevertheless, developers have no straightforward way to choose which FHE scheme and implementation is best suited for their application needs, especially considering that each scheme offers different security, performance, and usability guarantees. To allow programmers to effectively utilize the power of FHE, we employ a series of benchmarks called the Terminator 2 Benchmark Suite and present new insights gained from running these algorithms with a variety of FHE back-ends. Contrary to generic benchmarks that do not take into consideration the inherent challenges of encrypted computation, our methodology is tailored to the secure computational primitives of each target FHE implementation. To ensure fair comparisons, we developed a versatile compiler (called T2 ) that converts arbitrary benchmarks written in a domain-specific language into
        identical encrypted programs running on different popular FHE libraries as a backend. Our analysis exposes for the first time the advantages and disadvantages of each FHE library as well as the types of applications most suited for each computational domain (i.e., binary, integer, and floating-point).        "
      • "This work was partially supported by the University of Delaware Research Foundation Grant 21A01012 and
        the Electrical and Computer Engineering department at the University of Delaware.        "

 

 

  • GitHub Resources:
    • GitHub Repo: Awesome - A curated list of amazing Homomorphic Encryption libraries, software and resources

 

    • GitHub Repo: mpc4j
      • https://github.com/alibaba-edu/mpc4j 
      • "Multi-Party Computation for Java (mpc4j) is an efficient and easy-to-use Secure Multi-Party Computation (MPC), Homomorphic Encryption (HE), and Differential Privacy (DP) library mainly written in Java."
      • Language: Java
      • License: Apache 2.0
      • Status: Appears to be active (recent updates in 2026) 

 

 

    • GitHub Repo: Ciphercraft
      • https://github.com/ADWISE-VCU/Ciphercraft 
      • "Contains Packages for ElGamal, Paillier, Goldweiser-Micali and DGK Homomorphic Encryption System. Also implements secure multiplication, division and comparison." 
      • Language: Java 
      • License: MIT 
      • Status: (last updated ~2025) 

 

    • GitHub Repo: fhe-core
      • https://github.com/kryptnostic/fhe-core 
      • Language: Java, Wolfram Language 
      • License: Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public 
      • Status: DEPRECATED (see krypto)

 

 

  • Spring Security support for Homomorphic Encryption (HE): 

 

 Suggested links for relevant IETF RFCs:

 

 

 

 

 

 

 

 

Suggested software development (security-related) books for further reading:   

(Note: I will be citing books published by Manning, O'Reilly, and Packt - as well as some others)

 

 

 Post-Quantum Cryptography (PQC) links for further reading: 

  

  • Regulatory Forces:

 

  
  • Spring Security support for Post Quantum Cryptography (PQC):  
  • Enhancement: NimbusJwtEncoder does not support Edwards Curve signature (EdDSA) family algorithms. #17098


National Institute of Standards and Technology (NIST) Cryptographic links for further reading:  

  • Use of Cryptographic Modules by Federal Agencies and Departments
    • https://csrc.nist.gov/projects/cryptographic-module-validation-program
      • "FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies. Agencies must use cryptographic-based security systems to provide adequate information security for all operations and assets as defined in 15 U.S.C. § 278g-3."
      • "Non-validated cryptography is viewed as providing no protection to the information or data—in effect the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 or FIPS 140-3 is applicable. In essence, if cryptography is required, then it must be validated. Should the cryptographic module be revoked, use of that module is no longer permitted."

 

Posted by No comments:
Labels: , , ,
Subscribe to: Posts (Atom)

WordCount

Copyright

© 2001-2026 International Technology Ventures, Inc., All Rights Reserved.