91
Omarchy development practices lead to predictable security issues
First, a PSA: Do NOT use Omarchy if you care about security of your machine even a little bit. You can't polish a turd Omarchy 4.0 shipped with a collec...
New
The latest blog posts to take off on Hacker News. 4,333 posts.
92
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
93
C2PA Cameras Do Not Survive Contact with Reality
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
94
France's tax agency got hacked (in French)
Après l'ANTS, le piratage de la DGFiP marque un nouveau palier. Experts de l'État numérique, de la cybersécurité et du politique décryptent cet incident.
95
LLMs could control their host machines by exploiting inference engines
| Read on LessWrong | Comment on HN | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access.
96
A Blackstone real estate company exposed SSN digits, DOBs, addresses and more
Update: This post received some attention on Hacker News — see the discussion thread.
97
MS Paint and Photos inivisibly watermark even locally generated output with GUID
Reverse engineering reveals how Paint and Photos embed a server-issued GUID into the pixels of locally generated AI images.
98
I accidentally logged hundreds of thousands of phone calls to military bases
How an expired nameserver let me take over e164.arpa zones for multiple territories, and why I probably should have checked my logs sooner.
99
Aaron Swartz was prosecuted for scraping, while Meta does it without consequence
Also here's a cool unrelated photo of a chipmunk because I need some chill
100
How to compromise your system with a job interview
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match for a new position based on your prior experience. It might not be what it seems at a first glance.
101
AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my ...
102
Unlocking a locked/deactivated e-waste Cricut Maker
How I returned a Cricut Maker back to service after Cricut remotely bricked the unit
103
Civic Hygiene – avoid building technologies that could be used by a police state (2013)
Imagine, just for a moment, that the Government wanted to keep a record of everyone's sexuality. They need to know this detailed demographic data because it will be highly useful in civic planning. It will help them work out what provision needs to be made for sexual health services, how many children are likely to be…
104
105
Cloudflare's AI Psychosis
There was a time Cloudflare just made the internet better by staying hidden like Batman’s identity: protect & fight the bad people, for the sake of the global city of the Gotham… err I mean the in
106
Going Dark, and the era of law enforcement hacking
I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
107
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
108
Text AI watermarks will always be trivial to remove
The European Union AI Act will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is Article 50, which requires all…
109
License plate reader searches should require a warrant
So while I work with police departments regularly, I think it is critically important that technology be used reasonably. While this may be off-putting to some of my clients, I worked with the Inst…
110
Tl;dv: Over 180k meetings left wide open
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.
111
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
112
Timeline of the OpenAI accidental attack against Hugging Face
OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about “the Hugging Face Incident” (previously on this blog). The video was published yesterday. It’s short and information …
113
Welcoming the Nepalese Government to Have I Been Pwned
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
114
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic…
115
Web Security is Too Hard
It started innocently enough. I saw a tweet about a new product offering from one of my favorite companies, Cloudflare. Neat! I clicked through to the site and there it is: And huzzah!, my preferre…
116
Online ad giant Adform was hacked, proving once again why ad blockers are needed
The hacked digital advertiser was caught serving malicious ads that allowed hackers to steal a victim's cryptocurrency.
117
Rooting, firmware analysis and persistent credentials of TP-Link TL-841N
round 2: rooting & analysing firmware of the TP-Link TL-WR841N
118
A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention
Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an…
119
Authorize, don't authenticate
Hold on to your data by keeping it in your own database
120
Read this before you buy that TV streaming stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof…