661
New
The latest blog posts to take off on Hacker News. 4,333 posts.
662
Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit
Finding and exploiting bugs in the Xbox 360 hypervisor to create the "Bad Update" exploit.
663
664
Towards a test suite for TOTP codes
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
665
What, if anything, should I do about using Mozilla's Firefox
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
666
Why can't we screenshot frames from DRM-protected video on Apple devices?
This “feature” accomplishes nothing of value for anyone, including the streaming services, but imposes a massive (and for most people, confusing and frustrating) hindrance on honest people simply trying to easily capture high-quality (as opposed to, say, using their damn phone to take a photograph of their reflective…
667
Xcode constantly phones home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
668
Google does not want rights to things you do using Chrome (2008)
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
669
How to gain code execution on hundreds of millions of people and popular apps
how to gain code execution on millions of people and hundreds of popular apps
670
Another Conflict Between Privacy Laws and Age Authentication–Murphy v Confirm ID
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
671
Turning my ESP32 into a DNS sinkhole to fight doomscrolling
A fun project that I learned a lot from.
672
Github scam investigation: Thousands of “mods” and “cracks” stealing data
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
673
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
674
Xcode Constantly Phones Home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
675
676
'Impossible-to-hack' security turns out to be no security
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
677
It is no longer safe to move our governments and societies to US clouds
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
678
An inside look at NSA tactics, techniques and procedures from China's lens
Since I reside in a Five Eyes country (Australia) and have publicly presented four cases I led on China’s APT41 attacking organisations in ASEAN , particularly concerning China’s cyber and political strategies, I was curious to explore what China publishes about Five Eyes operations. This led me down a rabbit hole of…
679
Reviewing the cryptography used by Signal
Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
680
Setting up a trusted, self-signed SSL/TLS certificate authority in Linux
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
681
Open source projects could sell SBOM fragments
Musings on SBOMs and licensing woes.
682
Court Documents Shed New Light on DOGE Activity at Treasury Department
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
683
DOGE as a National Cyberattack
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
684
Why cryptography is not based on NP-complete problems
Cryptographic schemes are based on the computational difficulty of solving some ‘hard’ problem. For example, RSA (specifically, RSA-2048) is based on the difficulty of a problem like this:
685
Leaking the email of any YouTube user for $10k
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
686
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
687
Apple software update “bug” enables Apple Intelligence
Some people who had previously disabled Apple Intelligence in macOS 15.3 and iOS 18.3 saw it re-enabled after updating to macOS 15.3.1 and iOS 18.3.1 today. In fact I personally have two different Apple silicon Macs running macOS Sequoia, and after I updated both Macs to 15.3.1, Apple Intelligence was re-enabled on my…
688
How does Ada's memory safety compare against Rust?
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
689
Bad Smart Watch Authentication
IDO based smart watches are a security nightmare, and there's likely millions of them out there
690
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…