151
Soatok's Informal Guide to Threat Models
After a long day of exhausting conversations about Hybrid Post-Quantum Cryptography, random jackasses trying to play gotcha with endpoint attacks against end-to-end encrypted messaging apps, and me…
New
The latest blog posts to take off on Hacker News. 4,333 posts.
152
An American Privacy Emergency
Scott’s foreword: Cynthia Dwork is Gordon McKay Professor of Computer Science at Harvard, and a pioneer in the fields of differential privacy and algorithmic fairness. On my recent travels to…
153
154
Claude Code is steganographically marking requests
I inspected Claude Code for privacy reasons and found hidden system prompt markers based on API base URL and timezone.
155
Age verification is just a precursor to automated attribution of speech
Lots of US states, European countries, and Australia have introduced "age verification" regulations. They present it as the classic "save the children" talking ...
156
Dissecting Apple's Sparse Image Format (ASIF)
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
157
EU to legislate about Chat Control behind closed doors
Civil rights activist Dr. Patrick Breyer warns of an unprecedented "double-attack" on secure messaging ahead of critical Friday and Monday EU meetings. Ahead of a highly critical weekend for digital civil rights in Europe, former Member of the European Parliament Dr. Patrick Breyer is sounding th
158
Choosing a Public DNS Resolver
Compare 30 global public DNS resolvers by privacy, filtering, DNSSEC, DoH, DoT, DoQ, IPv6, and jurisdiction, and benchmark DoH speed from your browser.
159
A peek into Reddit's anti-spam internals
How Reddit accidentally leaked its spamurai system.
160
Anatomy of a Failed (Nation-State?) Attack
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
161
Incident CVE-2026-LGTM
A series of unfortunate agents.
162
What happened after 2k people tried to hack my AI assistant
I built hackmyclaw.com , where anyone could email Fiu, my OpenClaw assistant, and try to make it leak the contents of a secrets.env file.
163
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
164
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
165
Don't verify email addresses by sending spam to them
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
166
Signs you're a dangerous terrorist: using Signal, moving zines
The unusually long sentences criminalize being an anti-fascist activist, reading the wrong zines, and using the wrong communication apps. They're incredibly dangerous.
167
What we call "age verification" is actually mass surveillance
The literature on harms to kids from online platforms is complex and nuanced, rife with people citing small, ambiguous studies as iron-clad evidence that kids are being destroyed by the internet:
168
169
I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.
170
Usbliter8: an A12/A13 SecureROM Exploit
This page is taking an unexpected detour...
171
I found 10k GitHub repositories distributing Trojan malware
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find
172
Want your images back? That'll be $5
We're in the era of trillion-dollar companies, but that doesn't mean you should leave $5 on the table!
173
Humiliating IIS servers for fun and jail time
cybersecurity, tech, and personal annoyance log
174
Apple is about to make Hide My Email useless
Yesterday, June 15, 2026, a small and unimportant announcement appeared in Apple developer news: New domain for Sign in with Apple and iCloud+ Hide My Email. Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to…
175
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get…
176
Banned book library in a wi-fi smart light bulb
OverviewA long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to mo…
177
A backdoor in a LinkedIn job offer
A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
178
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
179
Curl will not accept vulnerability reports during July 2026
The curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss. curl's submission form on Hackerone will be paused starting July 1, 2026. Summer of bliss starts: July 1, 2026. 00:00 CEST Submissions resume: August 3 2026. 09:00 CEST The…
180
Don't trust large context windows
I recently watched a video that put a name on something I'd been feeling. The author splits an LLM's context window into two zones. There's the smart zone , where the model is sharp, and the dumb zone , where attention drops off and the model starts forgetting what you told it five minutes ago. The cutoff sits…