31
Apple Exclaves
Enhancing kernel isolation, one step at a time.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 83 posts.
32
Six day and IP address certificate options in 2025
Update: January 15, 2026 Six-day and IP address certificates are now generally available. See 6-day and IP Address Certificates are Generally Available for details. This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day…
33
Google Wallet launches new age and identity verification features (ZK proofs)
Learn more about new Google Wallet updates, including new ways to use your digital ID for age and identity verification.
34
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
35
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
36
I used o3 to find a remote zeroday in the Linux SMB implementation
In this post I’ll show you how I found a zeroday vulnerability in the Linux kernel using OpenAI’s o3 model. I found the vulnerability with nothing more complicated than the o3 API ̵…
37
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
38
How Cops Are Using Flock's ALPR Network to Surveil Protesters and Activists
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
39
Answering questions about Android developer verification
News and insights on the Android platform, developer tools, and events.
40
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
41
Exposed DeepSeek database leaking sensitive information, including chat history
A publicly accessible database belonging to DeepSeek allowed full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams with highly sensitive information.
42
Lawmakers want to ban VPNs
It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of…
43
Introducing a terms of use and updated privacy notice for Firefox
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t
44
Build a tiny CA for your homelab with a Raspberry Pi
Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.
45
A Sneaky Phish Just Grabbed My Mailchimp Mailing List
You know when you're really jet lagged and really tired and the cogs in your head are just moving that little bit too slow? That's me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported
46
DNS4EU for Public Is Available
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
47
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
48
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
49
Supabase MCP can leak your entire SQL database
Indirect prompt injection through support-ticket data lets an MCP-enabled assistant cross trust boundaries and query private tables with Supabase’s privileged service role.
50
DOGE as a National Cyberattack
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
51
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
52
A look at Cloudflare's AI-coded OAuth library
I decided today to take a look at CloudFlare’s new OAuth provider library, which they apparently coded almost entirely with Anthropic’s Claude LLM: This library (including the schema do…
53
Lumo: Privacy-first AI assistant
Lumo gives you the power to solve problems big and small, while keeping your personal data confidential. Try it now.
54
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
55
Digital ID, a new way to create and present an ID in Apple Wallet
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
56
57
Detecting and countering misuse of AI
Anthropic's August 2025 threat intelligence report on AI cybercrime and other abuses.
58
NSPM-7 labels common beliefs as terrorism 'indicators'
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
59
New prompt injection papers: Agents rule of two and the attacker moves second
Two interesting new papers regarding LLM security and prompt injection came to my attention this weekend. Agents Rule of Two: A Practical Approach to AI Agent Security The first is …
60
Pizlix: Memory Safe Linux from Scratch
Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available.