271
I decompiled the White House's new app
The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
272
End of "Chat Control": EU parliament stops mass surveillance
The controversial mass surveillance of private messages in Europe is coming to an end. After the European Parliament had already rejected the indiscriminate and blanket Chat Control by US tech companies on 13 March, conservative forces attempted a democratically highly questionable maneuver yesterda
273
“Disregard That” Attacks
Why you shouldn't share your context window with others
274
275
Delve – Fake Compliance as a Service
How Delve managed to falsely convince hundreds of customers they were compliant and then lied about it when exposed and called out
276
Cert Authorities Check for DNSSEC from Today
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
277
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
278
A most elegant TCP hole punching algorithm
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
279
How kernel anti-cheats work
Modern kernel anti-cheat systems are, without exaggeration, among the most sophisticated pieces of software running on consumer Windows machines. They operate at the highest privilege level available to software, they intercept kernel callbacks that were designed for legitimate security products, they scan memory…
280
I found 39 Algolia admin keys exposed across open source documentation sites
A systematic audit of Algolia DocSearch found 39 admin API keys exposed across projects like Home Assistant, KEDA, and vcluster.
281
Bucketsquatting is finally dead
For a decade, I have been working with AWS and third-party security teams to resolve bucketsquatting / bucketsniping issues in AWS S3. Finally, I am happy to say AWS now has a solution to the problem, and it changes the way you should name your buckets.
282
Document poisoning in RAG systems: How attackers corrupt AI's sources
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
283
Iran-backed hackers claim wiper attack on medtech firm Stryker
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
284
Ad-tech is fascist tech
A core tenet of the enshittification hypothesis is that all the terrible stuff we're subjected to in our digital lives today is the result of foreseeable (and foreseen) policy choices, which created the enshittogenic policy environment in which the worst people's worst ideas make the most money:
285
We are building data breach machines and nobody cares
A few weeks ago, my longstanding friend and colleague Curt Cunning mentioned to me that he was slogging through Nietzsche, which bespeaks his incredible will to power through things that are unpleasant (one of the many things that makes him an exceptional engineer). In any case, it lead me to revisit some of his work…
286
287
Linux Internals: How /proc/self/mem writes to unwritable memory (2021)
Introduction An obscure quirk of the /proc/*/mem pseudofile is its “punch through” semantics. Writes performed through this file will succeed even if the destination virtual memory is marked unwritable. In fact, this behavior is intentional and actively used by projects such as the Julia JIT compiler and rr debugger…
288
The shady world of IP leasing
The IPv4 "exhaustion" is not real. The addresses got hoarded and the market devolved into a wild sub-leasing economy where anyone can choose where their IPs appear from, who owns them on paper, and scrub them clean of any history.
289
Dumping Lego NXT firmware off of an existing brick (2025)
Catgirls can have little a RCE, as a treat
290
Remotely unlocking an encrypted hard disk
what's a few systemd services in initramfs between friends?
291
Cameras built to police Iranians became the regime's Achilles' heel
On the irony of cameras built to police Iranians becoming the regime’s Achilles’ heel
292
macOS code injection for fun and no profit (2024)
Fun little vacation project for fun and zero profit.
293
I'm reluctant to verify my identity or age for any online services
Identity verification and age verification is an increasinly common policy conversation at the moment, in numerous countries.
294
The beauty and terror of modding Windows
Let's talk about the "Windows Baseline Security Mode," too.
295
Daily Driving GrapheneOS
I've been running GrapheneOS on my Pixel Fold for over half a year now and can finally provide some experience on what it's like. Also, the official hardware partnership was announced!
296
An interactive intro to Elliptic Curve Cryptography
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
297
Disable Your SSH access accidentally with scp
Here's an interesting bug I ran into recently: After transferring some files to my server via scp, I couldn't log in via SSH anymore - my key was rejected by sshd.
298
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
299
Let's discuss sandbox isolation
A dive into the spectrum of sandboxing and isolation, from Linux namespaces and gVisor to hardware-enforced microVMs and WebAssembly, and why picking the right boundary matters for multi-tenant workloads.
300
You Want to Visit the UK? You Better Have a Google Play or App Store Account
New immigration rules for the UK are being enforced starting February 2026. This means citizens of 85 additional countries (including the USA and European countries) will need an Electronic Travel Authorisation (ETA) to visit, even for tourism. Luckily, you can apply (and pay) digitally. Unfortunately, the government…