Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 456 posts.
At Open Whisper Systems, we’ve been developing open source “consumer-facing” software for the past four years. We want to share some of the things we’ve learned while doing it. As a software developer, I envy writers, musicians, and filmmakers. Unlike software, when they create something, it is...
At Signal, we’ve been thinking about the difficulty of private contact discovery for a long time. We’ve been working on strategies to improve our current design, and today we’ve published a new private contact discovery service. Using this service, Signal clients will be able to efficiently and s...
Learn how NAT traversal works, how Tailscale can get through and securely connect your devices directly to each other.
It's time for web servers to handle ten thousand clients simultaneously, don't you think? After all, the web is a big place now.
In addition to the end-to-end encryption that protects every Signal message, the Signal service is designed to minimize the data that is retained about Signal users. By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, ...
Each computer on the Internet has its own public IPv4 address, similar to a phone number: for example, 131.193.178.181. The target of each packet of data is identified by a public IPv4 address.
Short answer: no. Quite the opposite, actually — Archive.is is intentionally blocking 1.1.1.1 users. Here's why.
10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.
For decades, municipal broadband operations have been subject to a minefield of restrictions and barriers designed to make the prospect of establishing or maintaining a community broadband network costly, difficult, and unsustainable. The Biden administration initially pledged that the Broadband Equity, Access, and…
(This is a write up of the talk that I gave at Velocity 2010 last Thursday. This is a joint work of myself, Nagendra Modadugu and Wan-Teh Chang.)
Cloudflare's mission is to help build a better Internet. We're excited today to take another step toward that mission with the launch of 1.1.1.1 — the Internet's fastest, privacy-first consumer DNS service. This post will talk a little about what that is and a lot about why we decided to do it.
This report examines the encryption that protects meetings in Zoom and finds that they have made their own encryption scheme and has significant weaknesses.
Last November I went to an IETF meeting for the first time. The IETF is an interesting place; it seems to be about 1/3 maintenance grunt wo...
No ads, no tracking. Ever.<br/> <strong>blog.stribik.technology</strong> is completely static, without cookies or javascript.<br/> <strong>comments.stribik.technology</strong> uses javascript and local storage, it's loaded when you click
Understand the entire Tailscale system, how it works, how we built it, and its benefits compared to legacy VPNs. Use this article as a guide to quickly build your own Tailscale replacement.
The sender's ISP, rather than the receiver's ISP, is the always-online post office from which the receiver picks up the message.
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russi...
TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were…
OpenSSH release notes
Major DNSSEC Outages and Validation Failures
Secure DNS Transport using DoH (DNS over HTTPS) or DoT (DNS over TLS) and SNI with ECH
As part of the "Let's make the web faster" initiative, we are experimenting with alternative protocols to help reduce the latency of web pages. One of these experiments is SPDY (pronounced "SPeeDY"), an application-layer protocol for transporting content over the web, designed specifically for minimal latency. In…
A deep dive into the Encrypted Client Hello, a standard that encrypts privacy-sensitive parameters sent by the client, as part of the TLS handshake.
Over the last few months, there’s been increased attention on networks and how they interconnect. CloudFlare runs a large network that interconnects with many others around the world.
Researchers have exploited bit-errors before in amazing ways . But bit-errors can be detected and exploited in new ways on an Internet-wide scale. One of these means is by bitsquatting, or registering domain names one bit different than frequently resolved domains.
Today we announced support for encrypted SNI, an extension to the TLS 1.3 protocol that improves privacy of Internet users.
Like all Linux network interfaces, WireGuard integrates into the network namespace infrastructure. This means an administrator can have several entirely different networking subsystems and choose which interfaces live in each.
