The latest blog posts to take off on Hacker News. 473 posts.
EFF, along with eight other consumer-focused privacy advocacy organizations, has backed out of the National Telecommunications Information Administration’s multi-stakeholder process to develop a privacy-protective code of conduct for companies using face recognition. After 16 months of active...
Let’s Encrypt has reached a point where we’re ready to announce our launch schedule. First certificate: Week of July 27, 2015 General availability: Week of September 14, 2015 We will issue the first end entity certificates under our root under tightly controlled circumstances. No cross-signature will be in place yet…
error
Describing content blocking rules in a structured format ahead-of-time, rather than running extension-provided code.
During the week of June 8th, the Office of Personnel Management (OPM) announced that the records of all current and past US federal employees had been compromised. That includes standard employment information - address, social security numbers, etc - of over 4 million people ranging from a random forest ranger to US…
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
I entered the 2014 Underhanded C Contest last year. Didn't win, but hey-ho what can you do. Still, I thought I'd post my entry and a write-up of it, in case anyone found it interesting.
The Wikimedia Foundation is happy to announce that we are implementing HTTPS to encrypt all traffic on Wikimedia sites. With this change, nearly half a billion monthly visitors on Wikipedia and its…
News that the Transportation Security Administration missed a whopping 95% of guns and bombs in recent airport security “red team” tests was justifiably shocking. It’s clear that we’re not getting value for the $7 billion we’re paying the TSA annually. But there’s another conclusion, inescapable and disturbing to…
Because we can!
Kaspersky Lab uncovers Duqu 2.0 – a highly sophisticated malware platform exploiting up to three zero-day vulnerabilities.
Search IETF mail list archives
The keys and certificates that will underlie Let’s Encrypt have been generated. This was done during a key ceremony at a secure facility today. The following objects were created: Key pair and self-signed cert for the ISRG root Key pair and certificate for the ISRG root’s OCSP Key pairs and certificates for two Let’s…
We do penetration testing, source code auditing and vulnerability assessments
Facebook just announced support for PGP, an encrypted email standard, for email from them to you. It’s an interesting move on many levels, albeit one that raises some interesting questions. The answers, and Facebook’s possible follow-on moves, are even more interesting.
The Senate passed the USA Freedom Act today by 67-32, marking the first time in over thirty years that both houses of Congress have approved a bill placing real restrictions and oversight on the National Security Agency’s surveillance powers. The weakening amendments to the legislation proposed by...
If you have just/as of late gotten an email about your keys being revoked, this is because of me, and if you have, you should really go through and make sure that no one has done anything terrible to you, since you have opened yourself to people doing very mean things to you for what is most likely a very long time.
Senate to Vote on USA FREEDOM Act Later in the WeekSection 215 has expired. At least for now.The law that the NSA used to authorize its collection of vast amounts of information about the telephone calls of ordinary Americans is no more. Even though it’s likely temporary, it’s a good thing and we...
Back in March, I parsed the declaration Nicholas Merrill submitted in his bid to reveal the contents of what he was asked to turn over via an NSL back in 2004. As a reminder, here’s what FBI permitted Merrill to reveal at the beginning of this suit. And here’s Merrill’s description of what kind of […]
We do penetration testing, source code auditing and vulnerability assessments
Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of images in official repositories are highly susceptible to a variety of…
Edited to add: I wrote a followup post to address comments here and elsewhere that advertising is working as intended. This paper has been ...
