1801
SeL4 on RISC-V Verified to Binary Code
… and seL4 and RISC-V Foundations form an alliance In June 2020 we announced that the seL4 microkernel, the world’s first operating system (OS) kernel with a machine-checked proof of implemen…
New
The latest blog posts to take off on Hacker News. 4,334 posts.
1802
1803
What3Words – The Algorithm
What3Words is a widely promoted system that is used for sharing a location using just three words. For example, ///wedge.drill.mess is located in Hyde Park.The globe is divided into 3m squares, eac…
1804
1805
Experian’s credit freeze security is still a joke
In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian , one of the big three consumer credit bureaus in the United States. Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s…
1806
1807
Remote code execution in Homebrew by compromising the official Cask repository
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…
1808
Tracking the WhatsApp habits of random smartphones
Scaling the WhatsApp online-status hack from a single contact to 5000 random phone numbers — what the data says about phone usage habits.
1809
Reading the AGPL
a guided introduction for first-timers
1810
Bug in Notepad Involving Asterisk in Title Bar
Back in May 27, 2020 Microsoft published a blog post describing a new feature in Notepad:
1811
Remote Code Execution Found in CocoaPods
tl;dr CocoaPods is a popular package manager used by lots of iOS apps (among other Swift and Objective-C Cocoa applications). I found a remote code execution...
1812
Representing SHA-256 Hashes as Avatars
How to turn 256 bits of entropy into a beautiful, avatar-friendly circular SVG: the Hashvatar.
1813
1814
Opting Your Website Out of Google's FLoC Network
Google recently announced the rollout of their Federated Learning of Cohorts (FLoC), a new advertising-surveillance initiative that seeks to replace third-party cookies with a new user profiling technique that garners data generated by the browser itself.
1815
1816
The patent troll that won a $308M jury trial against Apple
*If you’re the owner of this website and have questions, reach out to Bluehost. We’re happy to help.
1817
1818
Signal Adds Cryptocurrency Support
According to Wired, Signal is adding support for the cryptocurrency MobileCoin, “a form of digital cash designed to work efficiently on mobile devices while protecting users’ privacy and even their anonymity.” Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describes the new payments…
1819
The Facebook phone numbers are now searchable in Have I Been Pwned
The headline is pretty self-explanatory so in the interest of time, let me just jump directly into the details of how this all works. There's been huge interest in this incident, and I've seen near-unprecedented traffic to Have I Been Pwned [https://twitter.com/troyhunt/status/
1820
Breaking GitHub Private Pages for $35k
Abusing CRLF, cache poisoning, and other misconfigurations for a no-interaction XSS against GitHub Private Pages.
1821
Ubiquiti all but confirms breach response iniquity
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
1822
1823
My NAS exposes itself over the internet without permission
The Terramaster NAS decided to expose itself to the public internet without asking. Let's see what we can do about it.
1824
Distributing unnotarized Mac apps in a text file
This isn't a late April Fools joke. (My April Fools joke that I got hired by Apple as a Swift Evangelist backfired with a profusion of congratulations.) This blog post is a kind of follow-up to some previous blog posts. Last month I wondered what's the best way to distribute Mac apps without notarization , and I…
1825
Man who thought opening a TXT file is fine thought wrong
data:blog.metaDescription
1826
Zero click vulnerability in Apple’s macOS Mail
Zero-Click Zip TL;DR
1827
1828
Fighting cryptojacking and doing good things with content security policies
If you've landed on this page because you saw a strange message on a completely different website then followed a link to here, drop a note to the site owner and let them know what happened. If, on the other hand, you're on this page because you're
1829
Whistleblower: Ubiquiti Breach “Catastrophic”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
1830
VPN over SSH? The Socks Proxy
Some resources on the internet might be only accessible from clients with particular IP addresses. For example, suppose you want to…