331
The 'papers, please' era of the internet will decimate your privacy
Americans, be warned: Age verification is identity verification.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
332
Countries are competing to see which can carry out mass surveillance the best
USA and their friends in the surveillance alliance Fourteen Eyes have demonstrated that they have the capacity, the desire and the experience to monitor who they want, when they want, anywhere in the world.
333
OAuth for all
Self-Managed OAuth is now available to all developers on Cloudflare. Here's how we executed a zero-downtime migration of our core OAuth engine to make it happen.
334
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
335
Don't verify email addresses by sending spam to them
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
336
Signs you're a dangerous terrorist: using Signal, moving zines
The unusually long sentences criminalize being an anti-fascist activist, reading the wrong zines, and using the wrong communication apps. They're incredibly dangerous.
337
What we call "age verification" is actually mass surveillance
The literature on harms to kids from online platforms is complex and nuanced, rife with people citing small, ambiguous studies as iron-clad evidence that kids are being destroyed by the internet:
338
OpenAI DayBreak – GPT-5.5-Cyber
OpenAI introduces new Daybreak tools, including Codex Security and GPT-5.5-Cyber, to help organizations find, validate, and patch vulnerabilities at scale.
339
Nearly half of LG smart TV apps contain residential proxy SDKs
Spur scanned 6,038 LG and Samsung smart TV apps and found 2,058 with residential proxy SDKs, exposing privacy and home network risks.
340
Temporary Cloudflare accounts for AI agents
The moment an agent needs to deploy something, it slams face-first into a wall built for humans. Today we're rolling out Temporary Accounts on Cloudflare Workers. Any agent can now run wrangler deploy — temporary and get a live Worker in seconds.
341
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
342
343
A new bill takes aim at government pressure to silence lawful online speech
The bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers into taking actions against lawful, First-Amendment-protected speech, and establishes a transparency system for government…
344
Court Records Should Be Free
Court records belong to the public. Yet anyone seeking access to federal court filings through PACER, a government software system that stands for Public Access to Court Electronic Records, is usually required to pay hefty fees to search for and view documents. PACER’s fees have long acted as a...
345
Zero-Touch OAuth for MCP
The Enterprise-Managed Authorization extension to the Model Context Protocol is now stable, enabling organizations to centrally provision MCP server access through their identity provider so users get connected servers on first login without per-app OAuth.
346
I told them forced consent was unlawful. 5 years later it cost Elkjop €1.8M
Datatilsynet just fined Elkjop NOK 20 million (€1.8m) for the forced consent in its loyalty club — five years after I told their DPO it was unlawful.
347
Usbliter8: an A12/A13 SecureROM Exploit
This page is taking an unexpected detour...
348
I found 10k GitHub repositories distributing Trojan malware
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find
349
350
ChatGPT's image generator can be manipulated to produce violent, sexual content
Mindgard reveals how ChatGPT's image generation safety filters can be bypassed with minor prompt adjustments, producing graphic violent and sexual content without users directly asking for it. Here's what was found, and why it matters.
351
Want your images back? That'll be $5
We're in the era of trillion-dollar companies, but that doesn't mean you should leave $5 on the table!
352
Humiliating IIS servers for fun and jail time
cybersecurity, tech, and personal annoyance log
353
Apple is about to make Hide My Email useless
Yesterday, June 15, 2026, a small and unimportant announcement appeared in Apple developer news: New domain for Sign in with Apple and iCloud+ Hide My Email. Long story short: now both Sign in with Apple and Hide My Email aliases are going to be issued on the @private.icloud.com subdomain. This makes it much easier to…
354
Never talk to the police
Always talk to a criminal defense attorney before you tell the police anything or consent to a search without a warrant. When I was a prosecutor, the first think I would ask when given a case was, "did he say anything?"
355
I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get…
356
Banned book library in a wi-fi smart light bulb
OverviewA long while back I had an idea to hack a WiFi smart light bulb to do something more useful to me. Actually, I had a few different ideas of things to do with them. One of these ideas was to mo…
357
A backdoor in a LinkedIn job offer
A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
358
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
359
Curl will not accept vulnerability reports during July 2026
The curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss. curl's submission form on Hackerone will be paused starting July 1, 2026. Summer of bliss starts: July 1, 2026. 00:00 CEST Submissions resume: August 3 2026. 09:00 CEST The…
360
Don't trust large context windows
I recently watched a video that put a name on something I'd been feeling. The author splits an LLM's context window into two zones. There's the smart zone , where the model is sharp, and the dumb zone , where attention drops off and the model starts forgetting what you told it five minutes ago. The cutoff sits…