SPR v1.2.0 adds stronger isolation and network controls to SPR's plugin system. SPR can run plugins with krun, authenticate their UIs, and apply network policy to each plugin. Plugins can also request limited API access and add outbound routes to the network topology.
Networking plugins handle untrusted traffic and often need elevated permissions. These boundaries let them extend SPR without sharing the router's level of access.
Reproducible containers started shipping with v1.1.6.
SPR has defended against these attacks since 2022. We identified how weak network isolation was and built SPR from the ground up to solve it. Per-device VLANs, per-device GTKs, per-device passwords, and coordinated Layer 2/3 firewall policy have shipped as defaults from day one. Every mitigation the paper recommends, SPR already does out of the box.
Now a top-tier academic paper from NDSS 2026 (PDF) confirms what we've been saying: Wi-Fi client isolation is fundamentally broken. The researchers tested every major router vendor and found that every single one was vulnerable to at least one of their attacks. Even more critically, the attacks break through guest network boundaries into main networks, meaning the "guest Wi-Fi" that most routers advertise as a security feature provides no real isolation.
I've released a proof of concept for Bitchat running on Linux, along with a plugin configuration for SPR!
Since we last wrote about Bitchat, the security response for Bitchat been pretty much perfect. Jack quickly added prominent warnings that Bitchat was in development, and very quickly (as in within a week or so), the protocol moved to use Noise Encryption, providing strong security guarantees. Not long after Bitchat made it to the App Store. And even more impressively a little while later support for Nostr made it in. Recently I got a patch in for a small security fix for handling plaintext DMs.
Our new SPR PoE+ router, built on the Raspberry Pi CM5 platform, delivers great performance. In this test, we pushed packets to the limits by running simultaneous throughput tests on both the 2.5 Gbps Ethernet port and a 160 MHz WiFi 6 connection, achieving a combined throughput of over 3 Gbps.
The CM5 exposes a single Gen 2 PCIe lane (Gen 3 can be configured). The SPR PoE+ router splits the lane with a Gen 2 2:1 ASM1182e packet switch to share between the WiFi AP and 2.5GbE port, and a key question has been how the packet switch setup fares under real world conditions.
The SPR PoE+ router features:
Our test configuration consisted of:
UPDATE: Since I first wrote about this, Bitchat quickly added a label that Bitchat is under development and will be reviewed for security. And they rapidly moved to implement end-to-end cryptography with noise. See the bitchat update blog post
Many of us have seen glimpses of what agentic generative coding does for security. We see the missteps, and sometimes wonder about the shallow bugs that pile on. Config managers that are almost always arbitrary file upload endpoints. Glue layers that become bash command launch as a service. And most frustratingly, code generation that's excellent at pretending forward progress has been made when no meaningful change has occurred. One of the most impressive parts of agentic coding is exactly that: how convincing it is by appearance and how easily we're tricked about the depth of substance in the code gen. In some ways we extend our trust of people to the stochastic code parrots, assuming that generative coding produced the actual work a human would have probably performed.
I'm no stranger to e2e breaks, and have been following along over the past decade. Some of my favorite breaks I have found personally include Vaudenay oracles against Kakao, LINE, and bypassable OTR signature verification in iCloud Keychain compromising the password sync.
So this morning when bitchat came up I took some time to look through the code and write up some demos. My first thought was we really don't want or need another protocol, many aspects of Noise would fit in for finer points around true forward secrecy.
But bitchat's most glaring issue is identity. There's essentially no trust/auth built in today. So I would not really think about this as a secure messenger. The protocol has an identity key system, but it's only decorative as implemented and has misleading security claims. The 32-byte public key gets shuffled around with ephemeral key pairs as an opaque blob. The user verification is unfortunately disconnected from any trust and authentication. These are the hallmarks of vibe code (in)security.
Supernetworks macOS SMB Client Vulnerabilities
Supernetworks identified several vulnerabilities in macOS Sequoia’s SMB client code.
The worst of which can result in remote kernel code execution via an SMB URL delivered through any application that allows clickable URLs (e.g. messaging apps. Browsers, email client). This isn’t necessarily a one click attack, as a user may need to click through some UI elements to trigger the exploit. A privileged network position could also be used to carry out a man-in-the-middle attack against a user that typically uses SMB shares. It goes without saying that this also operates as a local privilege escalation from a non privileged user to kernel code execution.
SPR now supports dedicated Guest WiFi networks! This convenient feature provides internet access to visitors while maintaining separation from your primary network.
uBlock Origin is the best browser-based content blocker available on the web today. And it's user supported, free to use. Sadly today Google just pulled the plug on it by enforcing their new v3 manifest.
Users need to migrate or employ dns based content and ad blocking, which SPR can provide.
Supernetwork's flagship project, SPR, is a pioneer in WiFi security and we've supported multi-pass WPA3 from the inception of the project in 2022.
To use newer protocols like WiFi 6-e and 7, users can not fall back to WPA2, which is excellent since WPA2 suffers from passive sniffing & password cracking attacks.
WPA3 provides a zero knowledge proof: there's no handshake to sniff and crack -- but the protocol is rigid and makes it hard to support multi-pass. So most products only do it for WPA2 sadly, meaning they can't operate on 6-e or 7. This leaves users making more bad security tradeoffs. SPR works to give people the best security choices by default but the user experience could still vastly improve.
A new project, DecoyAuth, by Mathy Vanhoef, seeks to do that just that and make WPA3 better support multipass.
The project was presented at PAKE25 and the slides are here.