331
New
The latest blog posts to take off on Hacker News. 642 posts.
332
The bait-and-switch hidden in today’s cookie announcement
T oday is going to be the day that you read a lot about the UK’s intention to kill cookie pop-ups as part of its post-Brexit Data Reform Bill. By now you should have somehow realised that there’s a bit more to it than that, and that your work is not set to get any easier.
333
Apple Reneged on OCSP Privacy
In the current version of macOS, Monterey, on every system update on a system containing an M1 chip, such as all the new shiny/fast ARM (“Apple Silicon”) macs, the update process phones home to Apple to obtain a special boot signature, known in Apple jargon as a “ticket”.
334
Exploiting a heap overflow in the FreeBSD wi-fi stack
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by a researcher known as m00nbsd and patched in
335
Protecting Against Browser-Language Fingerprinting
Brave has further strengthened its fingerprinting protections by preventing users from being identified based on preferred browser language. Starting with version 1.39, Brave randomizes how your browser informs sites of what language(s) you’ve set as default, and what fonts you have installed on your system.
336
Retrofitting Temporal Memory Safety on C++
Eliminating use-after-frees vulnerabilities in Chrome with heap scanning.
337
“Crypto drainer” template facilitates theft
Crypto Drainers are phishing pages that lure victims into signing malicious transactions that allow the attacker to siphon their crypto and NFTs.
338
Firefox rolls out Total Cookie Protection by default to all users
Updated Aug. 28, 2024. Take back your privacy Firefox is rolling out Total Cookie Protection by default to more Firefox users worldwide, making Firefox the
339
“Downthem” DDoS-for-hire boss gets 2 years in prison
A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites.
340
Making popular Ruby packages more secure
News and updates from the RubyGems team — releases, security advisories, and project announcements.
341
Developer's Guide to SaaS Compliance
This article reviews what kinds of compliance certifications and regulations exist, what they mean for developers, and how to begin the certification process.
342
Is “acceptably non-dystopian” self-sovereign identity even possible?
In the recent paper about "soulbound" tokens, Vitalik Buterin et al. write that they aim to build technology that is "acceptably non-dystopian". Do any of today's self-sovereign identity projects fit that bill?
343
If OpenSSL were a GUI
What if OpenSSL were a GUI program? Here's what it might look like.
344
Important PostgreSQL 14 update to avoid silent corruption of indexes
Join thousands of people who own a premium domain. Affordable financing available.
345
346
Bluetooth signals can be used to identify and track smartphones
A team of engineers at the University of California San Diego has demonstrated for the first time that the Bluetooth signals emitted constantly by our mobile phones have a unique fingerprint that can be used to track individuals’ movements.
347
Public CDNs Are Useless and Dangerous
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
348
Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards
Today we’re announcing Private Access Tokens, a completely invisible, private way to validate that real users are visiting your site
349
Exploiting the Wii U's USB Descriptor parsing
In this write-up we're going to take a look at exploiting the Wii U's USB Host Stack. Over the past few months I spent a lot of time reverse...
350
MongoDB Releases Queryable Encryption Preview
Today we are announcing the preview release of Queryable Encryption which allows customers to encrypt sensitive data from the client side, store it as fully randomized encrypted data on the database server side, and run expressive queries on the encrypted data. Learn more.
351
I've locked myself out of my digital life
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital…
352
Norway to track all supermarket purchases?
Statistics Norway wants to receive several million daily receipts from food stores, signalling a new era in state data collection. Privacy advocates and the supermarkets themselves are unhappy. People living in Norway are used to
353
Zero-Day Exploitation of Atlassian Confluence
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]
354
355
Turkish Magician Built a $600M Nasdaq-Listed Scam Based on Lies
Initial Disclosure: After extensive research, we have taken a short position in shares of Enochian Biosciences, Inc. (NASDAQ:ENOB). This report represents our opinion, and we encourage every reader to do their own due diligence. Please see our full disclaimer at the bottom of the report.
356
Tim Hortons app violated laws in collection of ‘vast amounts’ of location data
GATINEAU, QC , June 1, 2022 – People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.
357
High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM
Mutation-based fuzzing is based on the idea that new, bug-triggering inputs can often be created by randomly modifying existing, non-bug-triggering inputs. For example, if we wanted to find bugs in a PDF reader, we could grab a bunch of PDF files off the web, mutate them by flipping a few bits or something, and feed…
358
359
Gmail accepts forged YouTube emails
This morning I woke up to an official-looking email from YouTube in my inbox, addressed to an address that isn't mine.
360
Top-500 NPM package maintainers now require 2FA
Two-Factored Authentication (2FA) is now enforced for maintainers of the top-500 packages, by dependents, on the npm registry. To learn more about configuring 2FA, see Configuring two-factor authentication. To learn…