Tech news picked on 2026-10-31
How to connect to a private DB with AWS Session Manager without opening inbound ports
- When a database sits on a network that cannot be reached directly from the internet, the traditional approach was to place an SSH relay server with port 22 open to the internet and manage key files. This article outlines how to connect to RDS or Aurora from a local DB client using AWS Systems Manager Session Manager without opening ports.
- Session Manager works because the SSM Agent installed on the EC2 server opens an outbound HTTPS connection to AWS, so the security group needs no inbound rules. However, the author explains that the Agent cannot be installed on RDS, so one EC2 relay server is still required.
- The configuration the author operates places Aurora PostgreSQL in a private subnet with no internet path, and keeps a t4g.nano relay server with no key pair and an empty inbound rule set turned off most of the time. The source presents this as the author's operational case and does not include cost or performance 3 verification results.
- According to the source, access is controlled by the ssm:StartSession permission in IAM policies, and the start and end of sessions are recorded in CloudTrail. The source states explicitly that the SQL content passing to the database in port forwarding sessions is not recorded.
Some Apple Intelligence features are coming to iPhones in China in the iOS 27.3 beta
- iPhone users in China will be able to use features such as notification summaries, live translation, writing refinement and proofreading, and removing objects from photos. The source presents these features as early features of Apple Intelligence, Apple's bundle of AI features.
- In an announcement on Apple's China newsroom, Apple said it will release the iOS 27.3 beta on November 4 and bring the official version in December. This schedule was reported by MacRumors.
- The latest Siri AI is not included in this China launch. Apple said it will connect Alibaba's AI chatbot Qwen for some experiences, and the source says this connection is similar to the ChatGPT integration.
- Approval in China came in July, and Reuters reported that in August Apple separately trained an LLM for China. The source treats this approval as a sign that the launch is getting close.
How XSS attacks slip malicious scripts into user input, and basic defenses
- XSS is an attack that runs malicious scripts made by an attacker in other users' browsers. A script is a small program that makes a web page move. The source explains that just opening a malicious link or viewing a compromised page can make it run with the site's permissions.
- The source divides XSS into reflected, stored, and DOM-based types. Reflected and stored XSS happen when the server builds dangerous HTML and sends it back. DOM-based XSS happens when the server sends only normal HTML and the browser's script inserts a URL value into the page, so server-side escaping is hard to rely on to block it.
- The basic defense is to insert user input with textContent instead of innerHTML, so it is displayed only as text. The source also introduces Sanitizer APIs such as setHTML(). Citing web.dev material, it says Firefox supports them from 148 (2026 February), Chrome and Edge from 146, and Safari does not support them.
- HttpOnly cookies stop scripts from reading cookies, which reduces the risk of session information theft. However, they do not stop script execution itself. CSP restricts execution of scripts that are not allowed, but the source says it has trade-offs: setting up external service integrations is troublesome and pages can easily break.