1
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 83 posts.
2
Entropy Attacks
The conventional wisdom is that hashing more entropy sources can't hurt: if H is any modern cryptographic hash function then H(x,y,z) is at least as good a random number as H(x,y), no matter how awful z is. So we pile one source on top of another, hashing them all together and hoping that at least one of them is good.
3
Memory Integrity Enforcement
Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort spanning half a decade that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices …
4
A small number of samples can poison LLMs of any size
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
5
An update on Mozilla's terms of use for Firefox
On Wednesday we shared that we’re introducing a new terms of use (TOU) and privacy notice for Firefox. Since then, we’ve been listening to some of our
6
Rust in Android: move fast and fix things
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
7
Trapping misbehaving bots in an AI Labyrinth
How Cloudflare uses generative AI to slow down, confuse, and waste the resources of AI Crawlers and other bots that don’t respect “no crawl” directives.
8
Agentic Misalignment: How LLMs could be insider threats
New research on simulated blackmail, industrial espionage, and other misaligned behaviors in LLMs.
9
Privacy Pass Authentication for Kagi Search
Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. Our...
10
Subliminal learning: Models transmit behaviors via hidden signals in data
We study subliminal learning , a surprising phenomenon where language models learn traits from model-generated data that is semantically unrelated to those traits. For example, a "student" model learns to prefer owls when trained on sequences of numbers generated by a "teacher" model that prefers owls. This same…
11
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
12
NSA and IETF: Can an attacker purchase standardization of weakened cryptography?
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
13
Android developer verification: Early access starts
News and insights on the Android platform, developer tools, and events.
14
Hacking with AI SASTs: An overview of ‘AI Security Engineers’ / ‘LLM Security Scanners’ for Penetration Testers and Security Teams
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.
15
Nepenthes is a tarpit to catch AI web crawlers
Making web crawlers eat shit since 2023
16
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.
17
A new layer of security for certified Android devices
Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed.
18
How we’re responding to The NYT’s data demands in order to protect user privacy
OpenAI is fighting a court order at the demands of The New York Times and plaintiffs, which involves retention of consumer ChatGPT and API user data indefinitely. Learn how we’re working to uphold user privacy, address legal requirements, and stay true to our data protection commitments.
19
CRLite: Certificate Revocation Checking in Firefox
Firefox is now the first and the only browser to deploy fast and comprehensive certificate revocation checking that does not reveal your browsing activity to anyone (not even to Mozilla). ...
20
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
21
Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation.
New documents and court records obtained by EFF show that Texas deputies queried Flock Safety's surveillance data in an abortion investigation, contradicting the narrative promoted by the company and the Johnson County Sheriff that she was “being searched for as a missing person,” and that “it was about her safety.”…
22
TLS certificate lifetimes will officially reduce to 47 days
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
23
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.
24
Opening up ‘Zero-Knowledge Proof’ technology
Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.
25
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
26
The State of SSL Stacks
The SSL landscape has shifted dramatically. In this paper, we examine OpenSSL 3.x, BoringSSL, LibreSSL, WolfSSL, and AWS-LC with HAProxy.
27
NPM debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
28
Signal Secure Backups
In the past, if you broke or lost your phone, your Signal message history was gone. This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents, or anything else you don’t want to lose forever. This explains wh...
29
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
30
Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.