271
Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony
Update: taking this down for now until some questions about the deterministicbuilds are answered; currently I do not believe the Zcash trusted setup shouldbe...
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
272
Blockchain and Trust
In his 2008 white paper that first proposed bitcoin, the anonymous Satoshi Nakamoto concluded with: “We have proposed a system for electronic transactions without relying on trust.” He was referring to blockchain, the system behind bitcoin cryptocurrency. The circumvention of trust is a great promise, but it’s just…
273
The PGP problem (2019)
The PGP problem
274
275
Why Rust for safe systems programming
In this series , we have explored the need for proactive measures to eliminate a class of vulnerabilities and walked through some examples of memory safety issues we’ve found in Microsoft code that could have been avoided with a different language. Now we’ll peek at why we think that Rust represents the best…
276
277
New [July 2, 2021] Audacity Data Collection Policy
Audacity is the world's most popular audio editing and recording app. Edit, mix, and enhance your audio tracks with the power of Audacity. Download now!
278
279
Facebook and Genocide: How Facebook contributed to genocide in Myanmar and why it will not be held accountable - Harvard Law School
On July 22, 2013, Turkish scholar and social media expert Zeynep Tufekci tweeted “Last year, I pondered the first ‘social-media fueled ethnic cleansing.’ With ethnic tensions & expanding online hate speech, is it Burma?” 1
280
sean cassidy : Don't Pipe to your Shell
It's everywhere . Sometimes they tell you to ignore certificates as well (looking at you, Salt). That's dumb.
281
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
282
Comcast caught hijacking web traffic
On November 20th, 2012 Comcast hijacked my HTTP traffic and re-routed it through their own servers, injecting a “notice” on the page before completing the request. What this means is instead of my web request being routed to the website I wanted to visit, Comcast took it upon themselves to hijack my web…
283
Redirect to sslh
My homepage for projects, jokes and bunnies.
284
Sophos News - The Sophos Blog
The Sophos Blog
285
lloyd.io - How BrowserID Works
lloyd.io is the personal website of Lloyd Hilaiel, a software engineer who lives in Denver, Colorado.
286
Peter Selinger: MD5 Collision Demo
C:\TEMP> md5sum hello.exe cdc47d670159eef60916ca03a9d4a007 C:\TEMP> .\hello.exe Hello, world! (press enter to quit) C:\TEMP>
287
Intel's Management Engine
Recent CPUs from Intel requires a binary called the “Management Engine” (Intel ME, or ME for short). This binary is one of three parts required if a business elects to use Intel’s Active Management Technology (AMT), which Purism avoids. Purism laptops can function with a neutralized and disabled ME, as we have tested…
288
Privacy in Ubuntu 12.10: Amazon Ads and Data Leaks
See part 2 of Privacy in Ubuntu 12.10: Full Disk Encryption. Earlier this month the eagerly awaited free software operating system Ubuntu 12.10 was released, and it includes a slew of new features (YouTube link), some of which have infuriated users because of privacy concerns. Over the last couple...
289
What science can tell us about C and C++'s security
There are not a lot of very strong empirical results in the field of programming languages . This is probably because there’s a huge amount of variables to control for, and most of the subjects available to researchers are CS undergraduates. However, I have recently found a result replicated across numerous codebases…
290
Today's CPU vulnerability: what you need to know
Posted by Matt Linton, Senior Security Engineer and Pat Parseghian, Technical Program Manager [Google Cloud, G Suite, and Chrome customers...
291
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...
292
How The Intercept Outed Reality Winner
Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor ...
293
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
294
Mitigating Spectre with Site Isolation in Chrome
Posted by Charlie Reis, Site Isolator Speculative execution side-channel attacks like Spectre are a newly discovered security risk for web...
295
Ethereum is a Dark Forest
It’s no secret that the Ethereum blockchain is a highly adversarial environment. If a smart contract can be exploited for profit, it eventually will be. But this unforgiving environment pales in comparison to the mempool. If the chain itself is a battleground, the mempool is something worse: a dark forest.
296
Hacking with AI SASTs: An overview of ‘AI Security Engineers’ / ‘LLM Security Scanners’ for Penetration Testers and Security Teams
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.
297
Huawei and Cisco's Source Code: Correcting the Record
Last week, I wrote about statements made by Charles Ding, Huawei’s Senior Vice President and Chief Representative in the U.S., Mr. Ding explained the
298
Apple's plan to “think different” about encryption opens a backdoor to your life
Apple has announced impending changes to its operating systems that include new “protections for children” features in iCloud and iMessage. If you’ve spent any time following the Crypto Wars, you know what this means: Apple is planning to build a backdoor into its data storage system and its messaging system.
299
Keep your phone number private with Signal usernames
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your...
300
NSO Group's iPhone Zero-Days used against a UAE Human Rights Defender
Ahmed Mansoor was targeted by NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product.