91
Tracking One Year of Malicious Tor Exit Relay Activities (Part II)
>25% of the Tor network’s exit capacity has been attacking Tor users
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 138 posts.
92
uBlock, I exfiltrate: exploiting ad blockers with CSS
Ad blockers like uBlock Origin are extremely popular, and typically have access to every page a user visits. Behind the scenes, they're powered by community-provided filter lists - CSS selectors that
93
An EPYC escape: Case-study of a KVM breakout
Posted by Felix Wilhelm, Project ZeroIntroduction KVM (for Kernel-based Virtual Machine) is the ...
94
A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
95
Codecov Bash Uploader compromised
Update 4/29/2021 3PM PT : Through our investigation, we now have additional information concerning what environment variables may have been obtained without authorization and how they may have been used. Affected users can view details within the Codecov application. Additionally, we have posted our most up-to-date…
96
An Update on SolarWinds
We’d like to provide a further update to our customers in regards to the SolarWinds breach. At this point we reiterate the message we posted yesterday – we have not played any role in this breach, nor are we aware of any vulnerabilities in TeamCity that may have led to this breach, as we are also not aware of any…
97
98
YouTube starts to require a credit card or ID to verify the age in EU (2020)
We’ve taken important steps to make YouTube a safer place for families. We’re announcing a continuation of these efforts.
99
Unusual login activity was due to bug
As part of our commitment to security, we regularly monitor our services for actual, suspected, or attempted malicious or unusual activity. We recently investigated reports of an uptick of users recei[..]
100
AuthZ: Scalable permissions system
How we built an authorization system based on Google Zanzibar
101
Privilege escalation with polkit: How to get root on Linux with a seven-year-ol
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
102
EFF sues Proctorio on behalf of student falsely DMCA'd
Phoenix, Arizona—The Electronic Frontier Foundation (EFF) filed a lawsuit today against Proctorio Inc. on behalf of college student Erik Johnson, seeking a judgment that he didn’t infringe the company’s copyrights when he linked to excerpts of its software code in tweets criticizing the software...
103
The All-Seeing “i”: Apple Just Declared War on Your Privacy
“Under His Eye,” she says. The right farewell. “Under His Eye,” I reply, and she gives a little nod.
104
The Insecurity Industry
The greatest danger to national security has become the companies claiming to protect it
105
The Problem with Perceptual Hashes
Apple just announced that they will use “perceptual hashing” to detect illegal photos on iPhones. I have some experience to share on this technology.
106
Security issue related to the NPM registry
We're sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
107
Sign arbitrary data with your SSH keys
ssh-keygen can sign and verify signatures, and it's way better than PGP
108
What Happened to Facebook, Instagram, and WhatsApp?
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to…
109
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database
tl;dr: A vandal deleted NewsBlur’s MongoDB database during a migration. No data was stolen or lost.
110
CCPA Scam – Human subject research study conducted by Princeton University
Get ready for the CCPA compliance scams from Princeton.
111
112
The SaaS CTO Security Checklist Redux
Learn how to protect your SaaS applications with the SaaS CTO security checklist. Doing the basics goes a long way in keeping your company and product secure.
113
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
114
The Microsoft MFA system almost brought me to a nervous breakdown
Update 12/10/21, 10:15 UTC: I never imagined this post would reach the front page on Hacker News and gather so much support. Thank you all…
115
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
116
State Partitioning
State Partitioning is the new privacy feature called Total Cookie Protection, which will be available in ETP Strict Mode in Firefox 86.
117
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
118
What is BGP? – BGP routing explained
Border Gateway Protocol (BGP) is the routing protocol for the Internet. Much like the post office processing mail, BGP picks the most effecient routes for delivering Internet traffic.
119
120
Private censorship is not the best way to fight hate or defend democracy (2018)
From Cloudflare’s headline-making takedown of the Daily Stormer last autumn to YouTube’s summer restrictions on LGBTQ content, there's been a surge in “voluntary” platform censorship. Companies—under pressure from lawmakers, shareholders, and the public alike—have ramped up restrictions on speech,...