61
Keys Not Included: recovering the signing keys for US driver's license barcodes
My personal website, portfolio, and blog.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
62
Dystopian Surveillance Is Becoming a Reality
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
63
25 years of mass surveillance is enough
This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the…
64
OpenAI bots knew about the RubyGems caching vulnerability
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching…
65
The case against JPEG XL
Investigating JPEG XL's place as a Web image codec.
66
I'm being cyberattacked by Tesla, Inc
A bungled Assetnote scan
67
Android NAT-T keepalive offload bypasses VPN lockdown
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
68
Reverse-Engineering Claude Web's MicroVM: Uncovering Anthropic's Hidden Antspace
Full stack developer, open sourceror, serial entrepreneur.
69
70
The Deathray: A simple way for an untrusted site to freeze a Mac
A WebGPU shader on an untrusted site can hang a Mac's graphics, making the desktop UI unusable until a restart is forced. All the victim needs to do is click a link. This issue reproduces cross-browser on MacOS, but not other OSes.
71
Reverse engineering my e-scooter and rewriting the firmware in Rust
I reverse engineered the hardware and firmware of my Egret GT E-Scooter. I describe how I got in, analysed communication between components, and reverse engineered firmware. I speak about writing custom firmware for the display unit.
72
How I advertise malicious software on Google Ads
A caller phones Radio Erywan. “Is it true that in Moscow, on Red Square, they give out cars?” “True. Not in Moscow, however, but in St. Petersburg. Not on Red Square, but on Revolution Square. Not cars, but bikes. And they don’t give them out, but steal them”. Edit: Through the apparent magic of Hacker News, my Google…
73
We have a year to fix security everywhere
consumer-grade hardware can run an LLM that hacks the planet. we can stop it, but we don't have much time.
74
75
Chrome again exempts Google from user site data settings
Six years ago I published a blog post Chrome exempts Google sites from user site data settings that received quite a bit of attention: Michael Tsai , Hacker News The Register , The Verge , and Gizmodo , among others. The blog post was about a Google Chrome bug that mysteriously exempted Google-owned sites from the…
76
The NX bit is not just about security
While I’m taking a short break from low-level programming, here’s a story by a friend of mine, Sonya, about debugging a seemingly impossible bug in ARM code. This bug hunting saga started several months ago. While developing a bare-metal hypervisor on ARM64 for postmarketOS, I hit a strange bug: if I enabled the…
77
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by…
78
Google Has Removed MV2 Extensions from the Chrome Web Store, Including UBO
Google today reached the final milestone in a browser-extension transition that has been years in the making, all remaining Manifest V2 extensions were removed from the Chrome Web Store.
79
Reverse Engineering Unknown File Formats with ImHex
An Introduction to File Formats and ImHex by Reverse Engineering FEZ's Save File Format
80
I think the military commissary's freezers were hacked
The frozen pizza aisle has become the national security risk du jour
81
A CVE Dispute
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
82
Breaking Claude Code Opus 5 Auto Mode
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success …
83
Omarchy: Any User Process Can Escalate to Root
A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately…
84
METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
Yesterday I covered the OpenAI technical report on the HuggingFace hack. That report had one key new piece of information, and some good prosaic steps OpenAI will be taking to strengthen its alignm…
85
You Know GDPR Is Good Based on Who Hates It
FDR has always been one of my favorite presidents, second maybe to Lincoln. Both were men the establishment assumed were one of them until, to their horror, they governed like they weren't. Both could trash the opposition in one breath and take the moral high ground in the next.
86
I accidentally turned LLM memory into program analysis
Why I stopped trying to give LLM agents a better memory and instead built Lemmalog, a Datalog engine that maintains an agent's knowledge as analysis state, with provenance, retractions and incremental evaluation, plus what happened when I benchmarked it on LongMemEval and LoCoMo.
87
Stopping the smart TV from being used against you
Smart TVs are everywhere! But who is the master? Amid the electronics boom driven by A.I., one piece of electronics has remained almost unchanged financially. That is the digital display or flat-panel monitor. With good reason! The entire entertainment and streaming industry wants one of these devi
88
Just the rumour of a bug is enough to find an exploit these days
Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
89
I used AWS cognito for a startup. I wouldn't do it again
I let AWS Cognito gaslight me for three weeks so you don't have to. Here's the unfiltered autopsy.
90
Reverse engineering my ADHD test
I decided to get evaluated for ADHD. Curiousity struck, and I had the bright idea to capture the page source and any outbound requests.