91
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
92
Open Whisper Systems partners with WhatsApp to provide end-to-end encryption
At Open Whisper Systems, our goal is to make private communication simple. For the past three years, we’ve been developing a modern, open source, strong encryption protocol for asynchronous messaging systems, designed to make seamless end-to-end encrypted messaging possible. Today we’re excited ...
93
Nikola: How to Parlay an Ocean of Lies into a Partnership with GM
Initial Disclosure: After extensive research, we have taken a short position in shares of Nikola Corp. This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
94
95
Tarsnap critical security bug
There's a lot to say about this, and it's entirely possible that I'll miss covering some important points in this post; if I've missed something, please email me or post a comment below and I'll do my best to add the necessary information.
96
97
The Security Mindset
Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that…
98
Why ninety-day lifetimes for certificates?
This is a historic blog post at this point. Please see our certificate lifetime documentation for the current status of certificate lifetimes. We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer…
99
A deep dive into iOS Exploit chains found in the wild
Posted by Ian Beer, Project ZeroProject Zero’s mission is to make 0-day hard. We often work...
100
101
Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now.
102
103
Errata: Steve Gibson
a summary of Steven Gibson events and quotes demonstrating charlatan status
104
How Plex is doing HTTPS for all its users
This week Plex , a self-hosted media server, announced that they now offer TLS to secure all connections, including those to the user’s servers. This is actually pretty interesting.
105
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
106
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.
107
ImperialViolet
When a browser connects to an HTTPS site it receives signed certificates which allow it to verify that it's really connecting to the domain that it should be connecting to. In those certificates are pointers to services, run by the Certificate Authorities (CAs) that issued the certificate, that allow the browser to…
108
Good-bye ESNI, hello ECH!
A deep dive into the Encrypted Client Hello, a standard that encrypts privacy-sensitive parameters sent by the client, as part of the TLS handshake.
109
110
Digital Privacy at the U.S. Border: Protecting the Data On Your Devices
by Sophia Cope, Amul Kalia, Seth Schoen, and Adam SchwartzDownload the report as a PDF.EXECUTIVE SUMMARYThe U.S. government reported a five-fold increase in the number of electronic media searches at the border in a single year, from 4,764 in 2015 to 23,877 in 2016.[fn] Gillian Flaccus, Electronic...
111
OpenAI and Hugging Face address security incident during model evaluation
OpenAI and Hugging Face share early findings from a security incident during AI model evaluation, highlighting advanced cyber capabilities and lessons for defenders.
112
Project Glasswing: Securing critical software for the AI era
A new initiative to secure the world’s most critical software and give defenders a durable advantage in the coming AI-driven era of cybersecurity.
113
Apple already shipped attestation on the web, and we barely noticed
There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being...
114
JSON Web Tokens should be avoided
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
115
Eliminating Memory Safety Vulnerabilities at the Source
Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...
116
117
Analysis of bank PIN numbers
Is your PIN number too predictable? Detailed analysis on PIN number databases.
118
Securing Firefox with WebAssembly
Protecting the security and privacy of individuals is a central tenet of Mozilla’s mission. While we continue to make extensive use of both sandboxing and Rust in Firefox to address ...
119
Data is a Toxic Asset
Thefts of personal information aren’t unusual. Every week, thieves break into networks and steal data about people, often tens of millions at a time. Most of the time it’s information that’s needed to commit fraud, as happened in 2015 to Experian and the IRS. Sometimes it’s stolen for purposes of embarrassment or…
120