361
Understanding and avoiding visually ambiguous characters in IDs
Designing a dictionary of visually unambiguous characters for IDs.
New
The latest blog posts to take off on Hacker News. 536 posts.
362
Some Fritz!Box modems might have been hijacked
TL;DR: Fritz!Box devices using custom DNS resolution services like Pihole or Adguard might have been compromised by DNS hijacking and using those Fritz!Box devices might be unsafe, especially for Windows users. Update: I updated the article to downscale the severity of the situation. After posting the article on HN, I…
363
Dnsmasq wins the first BlueHats Prize
BlueHats prizes is an initiative by the French Interministerial Digital Directorate. They are awarded to maintainers of critical free and open source projects. In 2024 four prizes of € 10 000 each will be given out. We are happy to announce the winner of the first 2024 BlueHats prize is Simon Kelley, maintainer of the…
364
I can't use my number pad for 2FA codes
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…
365
366
Security Vulnerability in Browser Interface Allows Computer Access via GPU
Researchers at TU Graz were successful with three different side-channel attacks on graphics cards via the ... » Computer science and IT » Read more ▸
367
Tailscale SSH is now Generally Available
Tailscale SSH is now generally available, offering seamless SSH authentication and authorization with SSO, MFA, and ACLs. Enjoy robust security, zero trust remote access, and tools like session recording and VS Code integration.
368
Distributed Authorization
Using local data to answer authorization questions with Oso Cloud
369
PuTTY vulnerability vuln-p521-bias
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
370
My cat alerted me to a DDoS attack
A few years ago, my cat gave me my most memorable middle of the night software engineering incident. I was working at a startup, and we didn’t have a formal on-call rotation yet. That was a deliberate decision, since being on-call is painful, and the team was good about just collectively keeping an eye out for urgent…
371
372
Sandboxing all the things with Flatpak and BubbleBox
A few years ago, I have blogged about my approach to sandboxing less-trusted applications that I have to or want to run on my main machine. The approach has changed since then, so it is tim...
373
Making Truth Social Comply with the AGPL
Defending Mastodon from Donald Trump's social media
374
XZ backdoor story – Initial analysis
Kaspersky analysis of the backdoor recently found in XZ, which is used in many popular Linux distributions and in OpenSSH server process.
375
Why CISA Is Warning CISOs About a Breach at Sisense
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today it is investigating a breach at business intelligence company Sisense , whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset…
376
Twitter's pivot to x.com is a gift to phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com , which until very…
377
Verified curl
Don't trust. Verify. I could not resist making a fake book cover Here follows a brief description on how you can detect if the curl package would ever make an xz. xz (and its library liblzma) was presumably selected as a target because it is an often used component and by extension via systemd it … Continue reading…
378
How I tripped over the Debian weak keys vulnerability
Those of you who haven’t been in IT for far, far too long might not know that next month will be the 16th(!) anniversary of the disclosure of what was, at the time, a fairly earth-shattering revelation: that for about 18 months, the Debian OpenSSL package was generating entirely predictable private keys .
379
I discovered a critical exploit in ZeroMQ with mostly pure luck
Fang-Pen Lin's blog about programming
380
Notepad++: Help us to take down the parasite website
I’ve received numerous complaints via email, social media, and forums regarding a website that poses a significant threat to our community. The copycat site in question is https://notepad.plus/ which appears prominently when users google for “download Notepad++”.
381
Google Public DNS's approach to fight against cache poisoning attacks
Tianhao Chi and Puneet Sood, Google Public DNS The Domain Name System (DNS) is a fundamental protocol used on the Internet to translate hum...
382
The V8 Sandbox
V8 features a lightweight, in-process sandbox to limit the impact of memory corruption bugs
383
Kobold letters: HTML emails are a risk
Anyone who has had to deal with HTML emails on a technical level has probably reached the point where they wanted to quit their job or just set fire to all the mail clients due to their inconsistent implementations. But HTML emails are not just a source of frustration, they can also be a serious security risk.
384
Tips for linking shell companies to their secret owners
At a recent panel at the 2024 NICAR conference, Karrie Kehoe, deputy head of data and research at ICIJ, offered a series of tips for investigating the true owners of shell companies.
385
Reflections on Distrusting xz
Was the ssh backdoor the only goal that "Jia Tan" was pursuing with their multi-year operation against xz?
386
Full EU chat control proposal attack on digital privacy and encryption
The French news service contexte.com has today published the latest Belgian Presidency's proposal for introducing indiscriminate chat control scanning of private messages for illegal content. The proposal covers the entire regulation and is therefore ready for endorsement. The proposal is to be disc
387
The xz attack shell script
Andres Freund published the existence of the xz attack on 2024-03-29 to the public oss-security@openwall mailing list. The day before, he alerted Debian security and the (private) distros@openwall list. In his mail, he says that he dug into this after “observing a few odd symptoms around liblzma (part of the xz…
388
Timeline of the xz open source attack
Over a period of over two years, an attacker using the name “Jia Tan” worked as a diligent, effective contributor to the xz compression library, eventually being granted commit access and maintainership. Using that access, they installed a very subtle, carefully hidden backdoor into liblzma, a part of xz that also…
389
OWASP Data Breach Notification
OWASP Data Leak Notification on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
390
Bypassing Denuvo in Hogwarts Legacy
When I announced my Black Ops 3 integrity bypass, someone commented that my research was not impressive and I should try analyzing Denuvo instead. That kinda stuck with me, so I did what everyone would do and spent the last 5 months of my free time reverse engineering and bypassing the Denuvo DRM in Hogwarts Legacy. I…