421
You Don't Need Anubis
don't use anubis just to block llm scrapers
New
The latest blog posts to take off on Hacker News. 4,333 posts.
422
Claude Code can debug low-level cryptography
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
423
Chat Control proposal fails again after public opposition
The European Union’s controversial Chat Control proposal has been withdrawn once again following intense public pressure. This marks another defeat for legislation that would have mandated scanning of encrypted messages across the EU.
424
425
Hacking India's largest automaker: Tata Motors
Tata Motors gave away the keys to their infrastructure and customer data on their public websites.
426
Understanding the Worst .NET Vulnerability
In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it
427
Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
428
FBI Agents Visit Anti-ICE Protester: "Your name was brought up."
“Your name was brought up.”
429
Disable AI in Firefox
Quick reference for how to turn off AI features in Firefox
430
Unlocking free WiFi on British Airways
Personal website talking about some stuff I've made and technology
431
Spinning Up an Onion Mirror Is Stupid Easy
I recently spun up a .onion mirror of this website.
432
Accessing Max Verstappen's passport and PII through FIA bugs
We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.
433
Linux Capabilities Revisited
Technical blog by Stephan Berger (@malmoeb)
434
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
435
Could the XZ backdoor been detected with better Git/Deb packaging practices?
The discovery of a backdoor in XZ Utils in the spring of 2024 shocked the open source community, raising critical questions about software supply chain security. This post explores whether better Debian packaging practices could have detected this threat, offering a guide to auditing packages and suggesting future…
436
Improving PixelMelt's Kindle Web Deobfuscator
A few days ago, someone called PixelMelt published a way for Amazon's customers to download their purchased books without DRM. Well… sort of. In their post "How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked" they describe the process of spoofing a web browser, downloading a bunch of JSON files…
437
4Chan Lawyer publishes Ofcom correspondence
Ofcom — driven by the letter of British law that they are bound to follow, but still Ofcom — are quietly making Britain look (a) very silly and (b) as if we haven’t yet shucked-off the Americ…
438
How I bypassed Amazon's Kindle web DRM
As it turns out they don't actually want you to do this (and have some interesting ways to stop you)
439
440
Pwning the Nix ecosystem
ptrpaws's blog on reverse engineering, programming, vr finds and miscellaneous stuff.
441
I almost got hacked by a 'job interview'
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
442
AppLovin nonconsensual installs
Mobile adtech juggernaut AppLovin recently faced multiple allegations of misconduct . Allegations run the gamut—privacy, ad targeting, even national security and ties to China. I was among the researchers consulted by skeptical investors this spring, and I was quoted in one of their reports, explaining my concerns…
443
A modern approach to preventing CSRF in Go
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
444
Let's Not Encrypt (2019)
Let's Discuss the organization providing a false sense of security at an unbeatable price.
445
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T , Comcast and Verizon , new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is…
446
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
447
GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
448
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
449
A story about bypassing air Canada's in-flight network restrictions
1 Prologue A while ago, I took a flight from Canada back to Hong Kong - about 12 hours in total with Air Canada. Interestingly, the plane actually had WiFi: However, the WiFi had restrictions. For Aeroplan members who hadn’t paid, it only offered Free Texting, meaning you could only use messaging apps like WhatsApp…
450
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…