The latest blog posts to take off on Hacker News. 4,439 posts.
Moving from WhatsApp to Signal is an important action, right now. WhatsApp’s parent company, Meta, has been involved in several cases of election interference: America in 2016, Trinidad and Tobago …
In recent months, we have received numerous reports from users across West Asia and North Africa (WANA) expressing alarm over a little-known but deeply intrusive bloatware application—AppCloud—pre-installed on Samsung’s A and M series smartphones. Without users’ knowledge or consent, this bloatware collects sensitive…
In mid-May 2025, blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps).
New research provides first evidence of the use of browser fingerprints for online tracking.
File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production systems. We explore three real-world attack scenarios…
Securely connect to anything on the internet with Tailscale. Built on WireGuard®️, Tailscale enables you to make finely configurable connections, secured end-to-end according to zero trust principles, between any resources on any infrastructure.
During a one hour period today, my computer contacted 63 different Apple domains while i was not logged on and using it. I have been trying to minimize to the extent possible the reach of big tech into my life. A full 25% of the DNS queries from one of my computers (M2 MBA with macOS 15.4) are to Apple owned domains …
The Open Source Technology Improvement Fund is proud to share the results of our security audit of Ruby on Rails . Ruby on Rails (or “Rails”) is an open source full stack web-application framework. Thanks to the help of X41 D-Sec , GitLab , and the Sovereign Tech Agency , Rails can provide more secure versions of the…
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.
Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.
I have for you a bizarre tale of scrapers, feds, data poisoning, Torswats, and everyone's favorite fedi instance. It veers technical, because I suspect it will be of interest to other people running servers with UGC (i.e., every fedi instance), and also because the mechanics of how I figured out what I figured out…
Protect your organization with Idira®. Modernize identity governance, automate access reviews, and secure every identity across your hybrid cloud environment.
Your trusty Dependabot (and other GitHub bots) might be an unwitting accomplice. Through "Confused Deputy" attacks, they can be tricked into merging malicious code. This doesn't stop here. It can escalate to full command injection via crafted branch names and even bypass branch protection rules. Plus, we disclose two…
OpenAI is fighting a court order at the demands of The New York Times and plaintiffs, which involves retention of consumer ChatGPT and API user data indefinitely. Learn how we’re working to uphold user privacy, address legal requirements, and stay true to our data protection commitments.
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
The free DNS4EU resolver, for everyone in Europe. Get the addresses, set it up in minutes, and block malware and phishing with no tracking.
Every night, right around midnight (mainly UTC), a horde of zombies wakes up and clamors for … digital certificates! The zombies in question are abandoned or misconfigured Internet servers and ACME clients that have been set to request certificates from Let’s Encrypt. As our certificates last for at most 90 days…
Introducing oniux: Kernel-level Tor isolation for any Linux app. This torsocks alternative uses namespaces to isolate Linux applications over the Tor network and eliminate data leaks.
Grants are Tailscale’s next generation of access controls that combine network and application capabilities into a single syntax.
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
Explore the surprisingly different security standards we apply to webhooks versus traditional API requests.
Behind the scenes blog of pretix, your friendly ticketing system from next door.
The Legit research team unearthed vulnerabilities in GitLab Duo.
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows. This setting is automatically enabled by default in Signal Desktop on Windows 11. If you’re wondering why we’re on...
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
John L. Young, who died March 28 at age 89 in New York City, was among the first people to see the need for an online library of official secrets, a place where the public could find out things that governments and corporations didn’t want them to know. He made real the idea – revolutionary in its...
Landmark court decision against “TCF” consent pop ups on 80% of the internet
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
