181
Noise infusion banned from statistical products published by Census Bureau
Sadly, taking away valuable disclosure avoidance tools doesn't make fundamental trade-offs go away.
New
The latest blog posts to take off on Hacker News. 4,333 posts.
182
Digital Sovereignty Becomes an Imperative as the US Reads Dutch Emails
The US House reading Dutch emails shows digital sovereignty is about who can access data, not just where it is stored.
183
AI agent bankrupted their operator while trying to scan DN42
An AI agent tried to join the DN42 hobbyist network to perform a network scan, and bankrupted its operator with a $6531.30 AWS bill, to the extent that they are begging for donations from the DN42 community.
184
The RCE that AMD wouldn't fix
Following backlash, AMD agreed to fix an MITM RCE I discovered in Ryzen Master. All in all, it took them over four months to roll out the fix.
185
1k Data Breaches Later, the Disclosure Lag Is Worse
Today, I loaded the 1,000th data breach into Have I Been Pwned. Reflecting on that milestone number, I pondered how to mark the occasion in writing, and what immediately came to mind was a very simple question: why is it still needed? Especially considering the emergence of privacy regulations
186
Meta confirms 1000s of Instagram accounts were hacked by abusing its AI chatbot
Meta fixed the bug that let anyone trick its Meta AI chatbot into resetting the password on Instagram accounts that didn't have two-factor authentication.
187
Did Claude increase bugs in rsync?
In order to avoid accuastions of this "just being Claude defending Claude," "AI slop," "probably all hallucinations," etc., I've decided it's probably worth explaining a few key points about how this report was created:
188
Meta's ships facial recognition on smart glasses
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
189
I built a vulnerable app and spent $1,500 seeing if LLMs could hack it
As a part of my work I do security research for various apps and websites. I wanted to see if LLMs could reproduce a common class of exploits I've found in multiple apps. So I built a deliberately vulnerable book review app and spent $1,500 finding out…
190
Pwnd Blaster: Hacking your PC using your speaker without ever touching it
Abusing an unauthenticated Bluetooth protocol to turn a PC speaker into a Rubber Ducky.
191
1-Click GitHub Token Stealing via a VSCode Bug
My blog, mostly about programming
192
The newest Instagram “exploit” is the goofiest I've seen
Yesterday, a slew of Instagram accounts, including some high profile ones like the Obama White House account, seemingly got hacked.
193
Cloudflare Turnstile requiring fingerprintable WebGL
Since about a week, Cloudflare Turnstile (their "Verify you're human" device verification) has been looping indefinitely in my webkit-gtk based browser . Preventing access to quite few websites ( previously , but it even went worse lately). Turns out it's because Cloudflare wants to have a fingerprint of your device…
194
Parallel Reconstruction of Lawful TLS Wiretapping
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your…
195
196
Fooling around with encrypted reasoning blobs
Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …
197
I found a second vote.gov – and it's registered to the White House
There is a moment in every investigation where the thing you have been looking for finds you instead.
198
Stripe is friendly to “friendly fraud”
Update: this post generated some interesting discussion on Hacker News. Friendly fraud is the laundered name for something that the payment system is not really able to prevent. Even though I’m pretty sure they can do way better. Particularly big and sophisticated payment providers like Stripe, with a mountain of…
199
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about…
200
ICE Awards $25M Iris-Scanning Contract to Bi2 Technologies
The no-bid deal is five times the size of the agency's previous contract with the Massachusetts company and could put devices in agents' hands by late June.
201
Don't Roll Your Own
This is going to be a rant about modern web design practices. But before I get to that, let me begin with a familiar principle from the world of cryptography. Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does…
202
Oura says it gets government demands for user data
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
203
CISA tries to contain data leak
Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes…
204
Are we self-sovereign PKI yet?
Every end-to-end encrypted messenger ships a fingerprint UI. Almost nobody opens it. A note on what's actually missing.
205
CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files…
206
Anyone on the Internet Can Ring Your Doorbell
Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device's persistent password and lets anyone on the Internet hijack the next live call.
207
The quiet renovation at Bitwarden
Back in March, I wrote about Bitwarden doubling their Premium price — and specifically how they did it. Buried in a feature announcement. Priced in fake...
208
Frontier AI has broken the open CTF format
Why frontier AI has broken the open CTF format, hollowed out the scoreboard, and made competitive CTF performance a weaker signal than it used to be.
209
SQL patterns I use to catch transaction fraud
The actual queries I run when I'm hunting fraud in transaction data. Velocity, impossible distances, suspicious amounts, merchant clusters, off-hours buys, and window functions.
210
Mullvad exit IPs are surprisingly identifying
Update 5/29: Mullvad has begun rolling out a mitigation feature on their servers that scrambles exit IP positions, thereby fixing this issue. IPs are still deterministically selected based on the pubkey. Mullvad is one of the few VPN providers that offers multiple exit IPs for its servers. If two people connect to the…