The latest blog posts to take off on Hacker News. 4,333 posts.
You don't own your email; you rent it. This vulnerability leaves your entire digital life at risk. Read how to seize back control of your most critical online asset by switching providers and setting up your own unbannable email server.
Over the course of years, RSA implementations gradually replaced Euler's totient function with Carmichael's totient function.
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
Trump is quietly building a surveillance state, and almost no one is paying attention.
While ZFS has a well-earned reputation for data integrity and reliability, OpenZFS native encryption has some incredibly sharp edges that will cut you if you don't know where to be careful. Unfortunately, I learned this the hard way, standing in a pool of my own blood and tears after thoroughly lacerating myself…
In the battle between the Online Safety Act and GDPR, who will win? FIGHT! I'll start by saying that I'm moderately positive on Online Safety. If services don't want to provide moderation then they shouldn't let their younger users be exposed to harm. The social network BlueSky has taken a pragmatic approach to this…
A journey in packet filtering
My standard "everyday" solution when it comes to connecting computers into a single network is Wireguard. Wireguard is good, supports p2p, and generally has no downsides.
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
The EU is pushing legislation that would scan all our private messages, even in encrypted apps.
It's just normal crime
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.
Some places say 255 bytes. They are wrong . Within a TXT record there are multiple character-strings (RFC 1035 section 3.3.14 ) and those are limited in length (because a single byte is used for their length), however there can be many of them.
You've probably heard of stream ciphers, but what about a scream cipher 😱? Today I learned there are more “Latin capital letter A” Unicode characters than there are letters in the English alphabet....
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
Lessons learned from becoming the unexpected face of a npm supply-chain attack.
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.
For enterprise software, the software supply chain presents some of the biggest risks today to data privacy and security.
On June 19th, my life changed with a phone call.
I recently bought a cheap Tapo indoor camera to see what my dog gets up to when I am out of the house.
Earlier this week, an npm supply chain attack. It’s turn for crates.io, the main public repository for Rust crates (packages). The phishing e-mail looks like this: And it leads to a GitHub login pa...
In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd. , a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those…
In this blog post, you will learn about the security oriented smartphone operating system GrapheneOS
I learn about cryptographic vulnerabilities all the time, and they generally fill me with some combination of jealousy (“oh, why didn’t I think of that”) or else they impress me w…
I’m sorry, but I can’t help with that. We acheived AGI. The clankers died on Christmas. This post is scheduled to automatically publish: 2025-12-25. Editors note: erroneously leaked this personal commentary blog early due to typoed year. Since it's erroneous early publication, this leak has remained on the hackernews…
Last week, I wrote about how Joshua Aaron's ICEBlock app, which allows people to anonymously report ICE sightings within a 5-mile radius, is – unfortunately, and despite apparent good intentions – activism theater. This was based on Joshua's talk at HOPE where he made it clear that he isn'
