991
EU Chat Control Bill Postponed
The EU Regulation to Prevent and Combat Child Sexual Abuse, first published in May 2022, has become the "most criticized law of all time". Here's how to stop it now!
New
The latest blog posts to take off on Hacker News. 4,440 posts.
992
Global Encryption Day: Encryption's Critical Role in Safeguarding Human Rights
Today is the third annual Global Encryption Day, a day to highlight why encryption is critical for a safe, private internet.
993
Beginners guide to building a hardware hacking lab
VSS Hardware Hacking Wiki and Blog Entries
994
Adtech surveillance and government surveillance are often the same
In the absence of comprehensive federal privacy legislation in the United States, the targeted advertising industry, fueled by personal information harvested from our cell phone applications, has run roughshod over our privacy. Worse, the boundaries between corporate surveillance and government...
995
Cloudflare mitigated yet another Okta compromise
On Wednesday, October 18, 2023, we discovered attacks on our system that we were able to trace back to Okta. We have verified that no Cloudflare customer information or systems were impacted by this event because of our rapid response.
996
Colorado Supreme Court Upholds Keyword Search Warrant
Today, the Colorado Supreme Court became the first state supreme court in the country to address the constitutionality of a keyword warrant—a digital dragnet tool that allows law enforcement to identify everyone who searched the internet for a specific term or phrase. In a weak and ultimately...
997
GPT-4 vision prompt injection
Learn what GPT-4 Vision Prompt Injection is, and discover effective strategies to protect your models and data from vulnerabilities.
998
EU member states still cannot agree about end-to-end encryption
Stanford Center for Internet and Society2023119 points147 commentscited by 3Society, Policy & Culture details
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
999
Mastercard Should Stop Selling Our Data
We trust companies with our information every day. But many companies—even those that hold our most revealing information—are using it not just to provide the services we ask for, but to amp up their profits at the cost of our privacy.That's why EFF has joined a campaign, led by the U.S. Public...
1000
HTTP/2 rapid reset attack impacting Nginx products
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
1001
Slack's Google Drive App can share your private Docs and Drive files
In 2017, Slack launched a popular Google Drive integration that makes it easy to embed, share, and get notified about new items added to Google Drive, including files, images, docs, and more. We use it daily here at Kapwing, an online video editing startup, since we run internally on top
1002
HAProxy is not affected by the HTTP/2 Rapid Reset Attack
HAProxy products are unaffected by CVE-2023-44487, which could allow a DoS attack against web servers, reverse proxies, and more. Stay tuned for updates.
1003
Passkeys are now enabled by default for Google users
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
1004
The largest DDoS attack to date, peaking above 398M rps
Google Cloud stopped the largest known DDoS attack to date, which exploited HTTP/2 stream multiplexing using the new “Rapid Reset” technique.
1005
HTTP/2 Rapid Reset: deconstructing the record-breaking attack
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
1006
HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
The “HTTP/2 Rapid Reset” attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric DDoS attacks. Cloudflare has mitigated a barrage of these attacks in recent months, including an attack three times larger than any previous attack we’ve observed
1007
The novel HTTP/2 'Rapid Reset' DDoS attack
Learn how the new DDoS attack technique Rapid Reset works, and how to mitigate it
1008
Cloudflare is free of CAPTCHAs; Turnstile is free for everyone
Now that we’ve eliminated CAPTCHAs at Cloudflare, we want to hasten the demise of CAPTCHAs across the internet. We’re thrilled to announce that Turnstile is generally available, and Turnstile’s ‘Managed’ mode is now completely free to everyone for unlimited use.
1009
When does an old iPhone become unsafe to use?
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
1010
1.1.1.1 lookup failures on October 4th, 2023
On 4 October 2023, Cloudflare experienced DNS resolution problems. Some users may have received SERVFAIL DNS responses to valid queries. In this blog, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again
1011
Fake recruiter lured aerospace employee with trojanized coding challenge
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
1012
Encrypted Client Hello
We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
1013
GPU.zip: side channel attack that exposes visual data processed on the GPU
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
1014
macOS 14 Sonoma firewall bug fixed
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
1015
9th Circuit rejects TSA claim of impunity for checkpoint staff who rape traveler
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
1016
0-days exploited by commercial surveillance vendor in Egypt
Last week Google’s Threat Analysis Group (TAG), in partnership with The Citizen Lab, discovered an in-the-wild 0-day exploit chain for iPhones. Developed by the commerci…
1017
The WebP 0day
Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar
1018
UK Parliament undermined the privacy, security, freedom of all internet users
The U.K. Parliament has passed the Online Safety Bill (OSB), which says it will make the U.K. “the safest place” in the world to be online. In reality, the OSB will lead to a much more censored, locked-down internet for British users. The bill could empower the government to undermine not just the privacy and security…
1019
We have successfully completed our migration to RAM-only VPN infrastructure
Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!
1020
Smashing the state machine: the true potential of web race conditions
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding