211
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!
New
The latest blog posts to take off on Hacker News. 4,333 posts.
212
HDD Firmware Hacking
Do you know how a hard drive works? Come find out with me as I dump, reverse engineer, and modify the firmware on various HDDs and SSDs.
213
Mythos Finds a Curl Vulnerability
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
214
Incident Report: CVE-2024-YIKES
A series of unfortunate events.
215
216
AI is breaking two vulnerability cultures
A week ago the Copy Fail vulnerability came out, and Hyunwoo Kim immediately realized that the fixes were insufficient, sharing a patch the same day. In doing this he followed standard procedure for Linux, especially within networking: share the security impact with a closed list of Linux security engineers, while…
217
The React2Shell Story
The story of CVE-2025-55182 (React2Shell)
218
Podman rootless containers and the Copy Fail exploit
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
219
Stop MitM on the first SSH connection, on any VPS or cloud provider
This little script stops attacks on the first SSH connection to a new VM, even on providers (like Hetzner Cloud ) that don't offer a proprietary solution ; we only need cloud-init , which is widely supported .
220
Google Chrome silently installs a 4 GB AI model on your device without consent
Google Chrome is downloading a 4 GB Gemini Nano model onto users' machines without consent, with no opt-in, no opt-out short of enterprise tooling, and an automatic re-download every time the user deletes it. The pattern is identical to the Anthropic Claude Desktop case I wrote about last month, but the scale is…
221
CVE-2026-31431: Copy Fail vs. rootless containers
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
222
The Car That Watches You Back: The Advertising Infrastructure of Modern Cars
How the connected car became an advertising surface. From Stellantis startup pop-ups to GSTV pumps to Gulp Radio aisles, and the consent infrastructure the automobile never developed.
223
Security through obscurity is not bad
Why security through obscurity still matters: not as your only defence, but as a practical layer that raises attacker cost.
224
Why are neural networks and cryptographic ciphers so similar? (2025)
Several neural network design principles are almost identical to cipher design principles.
225
226
I accidentally made law enforcement shut down their fake honeypot
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
227
Carrot Disclosure: Forgejo
Personal blog of Julien (jvoisin) Voisin
228
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
229
Period tracking app, Flo, found to be selling user data to Meta
What does this vagueness by-design mean for how we choose to self monitor our biological markers?
230
The woes of sanitizing SVGs
Scratch has a long history of SVG-related vulnerabilities. The source of these is that Scratch parses user-generated (ie. attacker-controlled) content into an <svg> element and appends it into the main document for various operations (eg. measuring SVG bounding box in a more reliable way than viewbox or width/height).
231
EU Age Control: The trojan horse for digital IDs
A technical look at the EU age verification reference app — the gap between marketed and shipped cryptography, relay attacks the protocol can't stop, and why the 'privacy-preserving' system is a trojan horse for digital ID infrastructure.
232
My audio interface has SSH enabled by default
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
233
Refuse to let your doctor record you
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
234
Quantum Computers Are Not a Threat to 128-Bit Symmetric Keys
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
235
236
Anthropic installed a spyware bridge on my machine?
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
237
238
Cybersecurity looks like proof of work now
AISI’s tests of Mythos suggest a new security economy: to harden a system you must spend more tokens finding exploits than attackers do.
239
I wrote to Flock's privacy contact to opt out of their domestic spying program
I wrote to Flock’s privacy contact to opt out of their …
240
This year’s insane timeline of hacks
An archive of this year’s insane timeline of hacks few people are talking about