481
Macs with T2, M1 chips cannot be restored to factory state without Apple
Modern Apple computers can no longer be fully used and maintained in 100% offline environments, or in ways that will reasonably ensure that the computer is…
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 684 posts.
482
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
483
“Stylish” is back, and you still shouldn't use it
2 days after I published ‘“Stylish” browser extension steals all your internet history’, Stylish was pulled from the Chrome and Firefox stores. The story echoed around parts of the internet for a few days, my name was misspelled on several right-wing British news websites, and I felt that I’d helped make the world a…
484
Bash 'shellshock' scan of the Internet
NOTE: malware is now using this as their User-agent. I haven't run a scan now for over two days. I'm running a scan right now of the I...
485
486
487
H(m || k) also insecure, you really should use HMAC
The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to addr…
488
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
489
Someone is pretending to be me
One random day - someone spills the beans. They were picked to impersonate me and get a job using my information.
490
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
491
Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
Also here's a cool unrelated photo of a chipmunk because I need some chill
492
Wacom tablets track every app you open
I have a Wacom drawing tablet. I use it to draw cover illustrations for my blog posts, such as this one.
493
It is no longer safe to move our governments and societies to US clouds
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
494
495
Instagram can track anything you do on any website in their in-app browser
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
496
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
497
That Secret Service SIM farm story is bogus
It's just normal crime
498
The All-Seeing “i”: Apple Just Declared War on Your Privacy
“Under His Eye,” she says. The right farewell. “Under His Eye,” I reply, and she gives a little nod.
499
Delve – Fake Compliance as a Service
How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out
500
501
502
503
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
504
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
505
506
The quiet renovation at Bitwarden
Back in March, I wrote about Bitwarden doubling their Premium price — and specifically how they did it. Buried in a feature announcement. Priced in fake...
507
Password Rules Are Bullshit
Of the many, many, many bad things about passwords, you know what the worst is? Password rules. Let this pledge be duly noted on the permanent record of the Internet. I don’t know if there’s an afterlife, but I’ll be finding out soon enough, and I plan
508
The Problem with Perceptual Hashes
Apple just announced that they will use “perceptual hashing” to detect illegal photos on iPhones. I have some experience to share on this technology.
509
WebKit will delete all local storage after 7 days
Apple will delete your data if you don’t use an app for seven days. This effectively kills offline web apps.
510
End of "Chat Control": EU parliament stops mass surveillance
The controversial mass surveillance of private messages in Europe is coming to an end. After the European Parliament had already rejected the indiscriminate and blanket Chat Control by US tech companies on 13 March, conservative forces attempted a democratically highly questionable maneuver yesterda