The latest blog posts to take off on Hacker News. 4,333 posts.
As well as the collection and distribution of compromised keys , the pwnedkeys project also matches those pwned keys against issued SSL certificates. I’m excited to announce that, as of the beginning of 2024, all matched certificates are now being published on the Fediverse , thanks to the botsin.space Mastodon server.
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
It’s been a while since I wrote an “attack of the week” post, and the fault for this is entirely mine. I’ve been much too busy writing boring posts about Schnorr signatures!…
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved…
Dmitry.GR: Creating BTLE-compliant advertisement packets, so that iOS and android devices can see and parse them.
HN discussion
Much like a previous talk of mine at Chaos Computer Congress this blog post is a direct write-up of a talk, if you prefer to consume this kind of content in video form you can watch the video here:
The recent move among U.S. states to add digital “age verification” to websites which serve adult content is a troubling one. Digital age verification systems are rife with privacy concerns, many requiring you to upload your government ID to third-party vendors or even directly to the website in question. Privacy…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Recently I came across a puzzling fact: the International Criminal Court hashes electronic evidence with MD5, even though MD5 is badly broken. So, why are lawyers using broken, outdated technology? The answer involves the common law system, cultural isolation, and a single man named Don L. Lewis.
Ah. Orange Spain has had their /12 (and likely others) broken by (what appears to be) someone breaking into their RIPE account and making RPKI ROA's to somewher...
In this blog post, you will learn different methods to harden your OpenBSD system, and in which situation they are useful
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
In 2019, Google and Cloudflare ran an experiment where they upgraded HTTPS for many "real users’ connections" to use post-quantum encryption. They then reported statistics on how affordable this was. Google had also run a similar experiment in 2016: "While it's still very early days for quantum computers, we're…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
This December, if there's one tech New Year's resolution I'd encourage you to have, it's switching to the only remaining ethical web browser, Firefox. According to recent posts on social media, Firefox's market share is slipping. We should not let that happen. There are two main reasons why switching is important…
I'm joev, a security engineer 👋 You may know me from my work at Apple or on Metasploit, or from my CVEs.
A look at the messy reality of iOS vulnerabilities: which bugs get patched, which quietly linger, and the challenges of tracking real device risk over time.
TL;DR: I think that a focus on memory safe languages (MSLs) versus non memory-safe languages is a bit of a red herring. The actual distinction is slightly…
Tl;DR: to pass SSH through HTTPS you need to tweak client and server sides as the following:
苹果公司自诩为用户隐私的捍卫者，然而这并非事实。 在近十年的时间里，苹果允许应用程序具备跟踪用户位置的能力，而不提供关闭此功能或引起用户对此的关注的选项。 而且这是「只有苹果可以做到的」（Only Apple Can Do）！
With the end of Google's Stadia platform on January 18, 2023, Google published a website allowing people to "Switch the Stadia Controller ...
OpenAI seems to have implemented some mitigation steps for a well-known data exfiltration vulnerability in ChatGPT. Attackers can use image markdown rendering …
What is the point of a public key fingerprint? What does it do that the public key itself doesn't do. This post explains.
master's thesis research into subjective, trust-based moderation systems
Unfortunately, in the tech sector, just like many other sectors, there are scammers around. When you are dealing with electronics this is typically in the form of chips that have had their markings…
An occasional blog about OpenPGP keyservers and related issues
