The latest blog posts to take off on Hacker News. 617 posts.
Are you a young person fighting back against bad bills like KOSA? Become an EFF member at a new, discounted Neon membership level specifically for you--stickers included! Congress has resurrected the Kids Online Safety Act (KOSA), a bill that would increase surveillance and restrict access to...
Experts warn that ISPs would use black-box AI to comply Like our piece on Canada's Cyber-Security Bill earlier this year, this item was flagged in my work for the Internet Society, Canada Chapter, but this post does not necessarily reflect the opinion of the ISCC. It concerns a legal opinion…
Why Vivaldi browser thinks Google’s new proposal, the Web-Environment-Integrity spec, is a major threat to the open web and should be pushed back.
There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being...
If you remove the first word from the string "hello world" , what should the result be? This is the story of how we discovered that the answer could be your root password!
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
How to have fun with the world’s most important free software project "Functional, free and secure by default", OpenBSD remains a crucial yet largely unacknowledged player in the open source field. This talk aims to highlight the project's signature security features and development practices -- razor sharp focus on…
Today we seem to be living through a war on passwords. This is manifested in various ways; in its most passive form, it takes the form of people blogging about how passwords are bad. The more material changes are the general trend towards no longer treating passwords as a sufficient condition for access in favour of…
Our investigation of the security incident disclosed by Microsoft and CISA and attributed to Chinese threat actor Storm-0558, found that this incident seems to have a broader scope than originally assumed. Organizations using Microsoft and Azure services should take steps to assess potential impact.
Messaging Layer Security has been published. MLS is the first standardized, fully specified, freely accessible end-to-end encryption protocol.
I've removed my website from indexing by Google . The proximate cause is Google's new effort to DRM the web ( archive ) but there is of course so much more.
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.
CVE-2023-38408 is a remote code execution flaw in OpenSSH’s forwarded ssh-agent. Get full exploit details, impact analysis, and Qualys detection guidance.
An article by Anonymous : Target's patented EasySweep device protects guests' data from skimmers.
"Infosec Twitter," a vibrant community of security practitioners, known for its insight, inspiration, and entertainment, is coming to an end.
DA was a part of our KPH project from the beginning. She learned her trade at US Coast Guard master station NMC, adjacent to KPH. At NMC she earned the coveted gold lightning bolt radnoman’s insignia (there was no such thing as a radiowoman in the Coast Guard). She also acquired the salty vocabulary she needed to hold…
Deeper analysis of Storm-0558 techniques for obtaining unauthorized access to email data, tools, and unique infrastructure characteristics.
Skyrocketing vehicle theft rates in some U.S. cities have drawn attention to an inconvenient truth: the increasing amount of technology in our vehicles can make them increasingly vulnerable to hacking or theft.
The Norwegian Data Protection Authority imposes a ban on Meta carrying out behavioural advertising based on the surveillance and profiling of users in Norway. The ban will initially apply until October
Apart from leaking everything, there's been "no breech". Avoid Tiffin Tom.
I work in a company that uses custom electronic boards, so there are plenty of instruments floating around that electrical engineers employ to debug faulty connections and solderings. One kind of tools used are the oscilloscopes, tools that measure signals and plot them in a graphically understandable way. We have a…
Protect sensitive data from phishing and social engineering with Varonis Interceptor, AI-native email security with 99.9% detection and real-time response.
Tech, Pets, and Vettes
The Data Protection Authority of Lower Saxony (LfD) decided that the “Pay or Okay” solution used by heise.de was unlawful
Exploring potential privacy vulnerabilities in Apple devices. This article discusses revealing a user's first name without permissions using the mDNS protocol.
Firstyear's blog
Documentation and guides from the team at Fly.io.
Users can now block poorly behaving third-party DLLs in Firefox to improve stability and performance.
When Let’s Encrypt first launched, we needed to ensure that our certificates were widely trusted. To that end, we arranged to have our intermediate certificates cross-signed by IdenTrust’s DST Root CA X3. This meant that all certificates issued by those intermediates would be trusted, even while our own ISRG Root X1…
