Welcome to MAKE / BREAK. Every other week you get three things: what actually happened in security (minus the jargon), one tip if you're new to all this, and something to build or break with your own hands. Let's go.
> this week in security
Four things worth 60 seconds of your attention. Two of them you can act on right now.
Update your browser today — this one's being used right now. Google shipped an emergency Chrome fix for a hole attackers are already exploiting (CVE-2026-85046). The US cyber agency gave federal staff two weeks to patch it, which is government-speak for "drop everything." Takes 20 seconds.
→ do this: Chrome menu → Help → About Google Chrome → let it update → Relaunch. Same for Edge, Brave, Opera, Vivaldi. (source)
Your phone got a big patch too. Apple just pushed its largest-ever security update (260+ fixes, iOS 27) and Android's September update kills several remote-takeover bugs. Boring, unglamorous, and the single highest-value thing you'll do all week.
→ do this: iPhone: Settings → General → Software Update. Android: Settings → Security → Security update. Turn on automatic updates while you're there. (source)
Careful with QR codes in the wild. Scammers are sticking fake QR codes over real ones — on parking meters, restaurant tables, posters — so a scan sends you to a lookalike site that grabs your card details or logins. It's phishing with a sticker.
→ do this: if the QR is clearly a sticker slapped on top, or the page it opens asks you to log in or pay, back out and type the real address yourself. (source)
Tell your parents about this one. A nasty scam doing the rounds starts with a pop-up screaming that your bank account or computer has been "compromised", then a friendly "official" talks the victim into moving their savings somewhere "safe" — sometimes literally handing over cash or gold bars.
→ do this: no real bank or police force ever phones to move your money to safety. Hang up. Ring the number on the back of your card. Forward this to someone who needs it. (source)
> beginner's corner
New to all this? One skill here will protect you more than any paid antivirus: smelling a phish. Three tells, ten seconds.
1. It's rushing you. "Account will be closed", "points expire today", "act now". Manufactured panic is the oldest lever there is. Real companies don't threaten you into clicking.
2. The link doesn't match the words. Hover over it on a computer, or
long-press on a phone, and read the actual address. If the message says T-Mobile but
the link is tmobile-rewards-claim.xyz, it's a fake.
3. It wants you to log in from the message. Don't. Ever. Open a fresh tab and type the site's address yourself. Same rule for QR codes. That single habit beats the vast majority of attacks.
That's the whole skill: slow down, check the link, log in yourself. You're now harder to phish than most people with a security team.
The project — a screen that breathes
The main event. Build a colour-cycling plasma in ~30 lines — then drag it around and break it, right here.
This is a plasma: the colour-cycling, liquid-light effect the demoscene has been showing off since the early 90s. It's alive below — poke the sliders.
That's ~130,000 pixels recomputed every frame, in your browser, from three sliders. No library.
01Make it yourself
Save this as breathe.html and open it. That's the whole thing:
<!doctype html>
<canvas id="c" width="480" height="480"></canvas>
<script>
const c = document.getElementById('c'), x = c.getContext('2d');
const W = c.width, H = c.height, img = x.createImageData(W, H), d = img.data;
let t = 0;
function frame(){
for (let y = 0; y < H; y++){
for (let px = 0; px < W; px++){
// shape = a stack of sine waves = organic ripple
const v = Math.sin(px*0.04 + t) + Math.sin(y*0.03 - t)
+ Math.sin((px+y)*0.03 + t)
+ Math.sin(Math.hypot(px-W/2, y-H/2)*0.04 - t*1.5);
// colour = one value into 3 sines shifted 120° = the cycling
const h = v*0.6 + t*0.2, i = (y*W+px)*4;
d[i]=128+127*Math.sin(h); d[i+1]=128+127*Math.sin(h+2.094);
d[i+2]=128+127*Math.sin(h+4.188); d[i+3]=255;
}
}
x.putImageData(img,0,0); t += 0.05; requestAnimationFrame(frame);
}
frame();
</script>02Why it works
The shape is a sum of sine waves over x, y,
x+y and distance-from-centre. Each is a ripple; stacked, they interfere into
something organic. That last term — distance from the middle — gives the radial breathing.
The colour is the demoscene trick: take that one value and feed it
into three sines shifted by 120° (2.094 and 4.188 radians) for R/G/B. Nudge everything by
t each frame and that's the cycling. Drag colour spread to feel it.
03Now break it
Don't just run it — maul it. Change the 0.04 / 0.03 constants (the
ripple slider): bigger = tighter and chaotic, smaller = vast and slow. Then add a
kaleidoscope fold — mirror the coordinates at the top of the loop:
const fx = Math.abs(px - W/2), fy = Math.abs(y - H/2);
// then use fx / fy in the waves instead of px / yInstant symmetry. That's issue #01's whole world — you just previewed it.
> your turn
Make the plasma follow your mouse — feed the pointer's position into the ripple, or move the centre point to wherever the cursor is. Ten minutes, tops. Reply with a ten-second screen-grab and the best one runs at the top of issue #01, with your name on it. Go on.
Stop scrolling. Start making.
A new one every other week — free, right here, no signup needed. Rather it came to you? Your call.
Get it by email ▚ or RSS— the Norfolk Hacker
No paywall, no ads, no sponsor telling me what to say. If an issue earned you a brew, ☕ buy me a coffee — it keeps the soldering iron hot.