541
Apple vs the Law
Apple & Google at the EU DMA compliance workshops, June 2025.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
542
Why you should delete WhatsApp and install Signal
WhatsApp is not private or secure. Please consider using Signal instead.
543
Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications
When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We discovered a vulnerability that could allow an attacker to access more than 64 million job applications. This data includes applicants' names, resumes, email addresses, phone numbers, and personality test results.
544
Evolution Mail Users Easily Trackable
A dns-prefetch tag in an HTML email makes Evolution Mail do a DNS lookup on open, even with remote content blocked. The developers blame WebKitGTK.
545
Parse, Don’t Validate – Some C Safety Tips
“A good programmer is someone who looks both ways before crossing a one-way street.” – Doug Linder
546
Breaking Git with a carriage return and cloning RCE
tl;dr: On Unix-like platforms, if you use git clone --recursive on an untrusted repo, it could achieve remote code execution. Update to a fixed version of Git and other software that embeds Git (including GitHub Desktop).
547
Running a Certificate Transparency log
Maybe you, yes you, should run a Certificate Transparency log. It’s cheaper, easier, and more important than ever.
548
Belgium Is Unsafe for CVD
This post is about the reason I will probably never try to warn any organisation in Belgium about any vulnerability again. Recently I have been dealing with an attempt at coordinated vulnerability disclosure (CVD) with an organisation in Belgium. This post is not about that, because I’m not allowed to write about it…
549
Incapacitating Google Tag Manager (2022)
Drilling beneath the hype to expose the truth
550
Taking over 60k spyware user accounts with SQL injection
Serverless means it's secure, right?
551
Exploiting the IKKO Activebuds “AI powered” earbuds (2024)
So my journey with these earbuds started after I saw them on this Mrwhosetheboss video about pointless tech. This device seems to be also popular on TikTok. My suspicions were confirmed, this runs android. So of course i went ahead and bought them. 245 euros later... and they finally arrived!
552
Reverse Engineering Vercel's BotID
Vercel recently announced BotID, an anti-bot meant to protect against bots without requiring manual intervention. This post reverse-engineers the script and takes a peek inside.
553
Anticheat Update Tracking
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
554
Implementing fast TCP fingerprinting with eBPF
In this article I want to document my journey implementing fast TCP fingerprinting in a golang webserver, using eBPF.
555
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
556
Reading NFC Passport Chips in Linux
For boring and totally not nefarious reasons, I want to read all the data contained in my passport's NFC chip using Linux. After a long and annoying search, I settled on roeften's pypassport. I can now read all the passport information, including biometrics. Table of ContentsBackgroundRecreating the MRZPython code to…
557
YouTube's new anti-adblock measures
How I wrote filter rules for YouTube
558
559
Homomorphically Encrypting CRDTs
Homomorphic encryption allows a computer to run programs on encrypted data. Learn how homomorphic encryption works through interactive examples, build a homomorphically encrypted CRDT and see whether it has promise for local-first software.
560
Why SSL was renamed to TLS in late 90s (2014)
The Netscape/Microsoft browser wars in the mid-90's were really vicious and competitive. They really had it out for each other. Netscape had...
561
Design Patterns for Securing LLM Agents Against Prompt Injections
This new paper by 11 authors from organizations including IBM, Invariant Labs, ETH Zurich, Google and Microsoft is an excellent addition to the literature on prompt injection and LLM security. …
562
A dark adtech empire fed by fake CAPTCHAs
Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout…
563
How much EU is in DNS4EU?
This is another post that started after several toots on mastodon. Most of the things presented here were already tooted by other people, but I think this is a good chance to write a mini tutorial about what to look at. We’ll use DNS, whois, BGP and your favourite search engine. What is DNS4EU? To quote the web page…
564
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
565
"Localhost tracking" explained. It could cost Meta €32B
You just can't finish off Zuckerberg.
566
A bit more on Twitter/X's new encrypted messaging
Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about T…
567
Denuvo Analysis
This post is intended for educational purposes only. Denuvo is arguably the most successful digital rights management solution to have ever existed, and is therefore an interest to many. This blog contains a large amount of my personal notes and correspondence with other reverse engineers (see kudos ) which contains…
568
Bruteforcing the phone number of any Google user
From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable
569
A look at Cloudflare's AI-coded OAuth library
I decided today to take a look at CloudFlare’s new OAuth provider library, which they apparently coded almost entirely with Anthropic’s Claude LLM: This library (including the schema do…
570
Why not use DNS over HTTPS (DoH)?
DoH is not about protecting your DNS queries from peepers. That is a big lie. It is about making sure only one peeper can see all of your queries.