The latest blog posts to take off on Hacker News. 4,440 posts.
Facial recognition is an invasive and dangerous surveillance technology. When the government moves forward with pilot programs that will, if fully implemented, subject millions of people on a daily basis to the technology that should give us all pause.
Uber has widely adopted Golang (Go for short) as a primary programming language for implementing backend services and libraries due to its high performance. The Go monorepo is the largest codebase at Uber, comprising 90 million lines of code (and growing). This makes tooling for writing reliable Go code a critical…
TAG’s discovery of a 0-day exploit used to steal email data from international government organizations.
A new CPU vulnerability, ‘Reptar,’ found by Google researchers, has been patched by Google and Intel. Here’s what you need to know.
We are proud to announce PyPI's first external security audit.
Section 702 is the controversial and much-abused mass surveillance authority that expires in December unless Congress renews it. EFF and others have been working hard to get real reforms into the law and have opposed a renewal, and now, we’re hearing about a rushed attempt to tie renewal to funding...
This post is a copy of tweets by Zooko Wilcox-O'Hearn . SHA256 was designed by the NSA. BLAKE (the original) and BLAKE3 were designed by Jean-Philippe Aumasson
Today, almost everything about our lives is digitally recorded and stored somewhere. Each credit card purchase, personal medical diagnosis, and preference about music and books is recorded and then used to predict what we like and dislike, and—ultimately—who we are. This often happens without our...
After a year-long inquiry, the EU Ombudsman recommends that the European Commission should monitor stages of progress in every Big Tech case that the Irish Data Protection Commission is responsible for.
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
CT scans of counterfeit AirPods Pro and MagSafe chargers reveal pouch cell batteries in circular cavities, internal weights, and a fake ground pin.
Prossimo is pleased to announce the first stable release of sudo-rs, our Rust rewrite of the critical sudo utility. The sudo utility is one of the most common ways for engineers to cross the privilege boundary between user and administrative accounts in the ubiquitous Linux operating system. As such, its security is…
FOR IMMEDIATE RELEASE: 10/30/2023 CONTACT: Phillip Suderman, psuderman@ij.org, (850) 376-4110 ARLINGTON, VA.—Today, the 4th U.S. Circuit Court of Appeals unanimously ruled in favor of Matthew Gibson […]
We’re piloting an experimental Android WebView Media Integrity API with select embedded media providers early next year.
The proposed EU Digital Identity framework (eIDAS) aims to meddle with the process around internet certificates and will undermine the independence and security assurances of the basis for website security:
Det europeiske personvernrådet har nå bestemt at det norske forbudet mot adferdsbasert markedsføring på Facebook og Instagram skal bli permanent og utvides til å gjelde hele EU/EØS.
Short answer: Practically-speaking, probably not.
Today, we’re announcing new requirements for bulk senders that will help keep Gmail safer and more spam-free.
Recently, YouTube has been ramping up its anti-adblock effort, and I’ve been watching this closely. This blog post is where I write down what I know. Some...
How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules.
After 28 years, SSLv2 is still not gone from the internet... but we're getting there, Author: Jan Kopriva
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
An overview of containers and seccomp as sandboxing primitives
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
Cascade is a RISC-V CPU fuzzer that generates valid , long and complex programs, and relies on a termination cascade-effect for bug detection. It detected 37 new bugs (29 new CVEs) in 5 RISC-V CPUs, which is more than all the existing fuzzers, combined. You can read a paper we wrote on Cascade here and try it out here…
