Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 76 posts.
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
Yesterday Andres Freund emailed oss-security@ informing the community of the discovery of a backdoor in xz/liblzma, which affected OpenSSH server (huge respect for noticing and investigating this). Andres' email is an amazing summary of the whole drama, so I'll skip that. While admittedly most juicy and interesting…
Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Lin…
We’re excited to announce a new open source Swift package for homomorphic encryption in Swift: swift-homomorphic-encryption.
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
Entropic Engineering was approached in January ‘24 by the DEFCON Badge Team, who were looking for a small company to partner with. They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s…
When it comes to designing secure protocols, I have a principle that goes like this: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom.
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at
On Thanksgiving Day, November 23, 2023, Cloudflare detected a threat actor on our self-hosted Atlassian server. Our security team immediately began an investigation, cut off the threat actor’s access, and no Cloudflare customer data or systems were impacted by this event
The data privacy company Onerep.com bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched…
We’re making updates to show less unoriginal, low-quality content on Search.
noyb has filed a GDPR complaint regarding transparency issues, the right of access and the use of inaccurate information about users
Scope. To talk about C++’s current safety problems and solutions well, I need to include the context of the broad landscape of security and safety threats facing all software. I chair the ISO C++ s…
Anthropic's new system, Clio, analyzes how people use AI while maintaining their privacy.
Arguably one of the biggest challenges for desktop security is how to handle those overly complex PDFs, DOCs, and similar files, that are so often exchange...
Download the Writeup Illustration Romain Flamand – Flamingo Studio – flamandromain@gmail.com Abstract Secure elements are small microcontrollers whose main purpose is to generate/store secrets and then execute cryptographic operations. They undergo the highest level of security evaluations that exists (Common…
The new Outlook now appears to be a data collection service for Microsoft’s 801 external partners for targeted advertising.
900 Sites, 125 million accounts, 1 vulnerability
After Snowden’s whistleblowing in 2013, large parts of the internet became encrypted, enabling private and secure communication. Not everyone has welcomed this change. Most notably, the FBI and other U.S. government agencies have fought what is often called the “crypto wars”, the war on encryption. In recent years…
A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
Update: We are diving deep into the Google API leak and what it means for marketers in our next episode of SparkToro Office Hours on June 27. Join Michael
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep , an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity…
It's not often that you find yourself staring at code that few people have ever seen, code that was an important part in bringing down the a...
