481
New
The latest blog posts to take off on Hacker News. 556 posts.
482
Qubes Air: Generalizing the Qubes Architecture
The Qubes OS project has been around for nearly 8 years now, since its original announcement back in April 2010 (and the actual origin date can be traced back to November 11th, 2009, when an initial email introducing this project was sent within ITL internally). Over these years Qubes h...
483
‘Jackpotting’ Attacks Hit U.S. ATMs
ATM “ jackpotting ” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this…
484
Terraforming 1Password
We are excited to finally have all our development, test, staging, and production environments managed with Terraform.
485
Uncovering 2017’s Largest Malvertising Operation
The Zirconium group successfully created and operated 28 fake ad agencies to distribute malvertising campaigns through 2017, buying an estimate of 1 billion ad views throughout the year, and reaching
486
Ransomware as a Service
Ransomware as a Service, Author: Xavier Mertens
487
488
Tinder's lack of encryption allows spying
The Sophos Blog
489
About rel=noopener (2016)
2021 update: Browsers now implicitly set rel=noopener for any target=_blank link, following a spec change . If the demo on this page no longer seems scary, congratulations — you’re using a modern browser!
490
491
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
492
DuckDuckGo moves beyond search to also protect you while browsing
We're excited to launch a new browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.
493
Root Cause of Reboot Issue Identified; Updated Guidance
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
494
Mobile Device Management invades privacy
With BYOD, companies are more than ever keen on protecting their data. MDM tools, like Google Apps, do more than that; they invade your privacy.
495
496
Mobile Devices Compromised by Fake Secure Messaging Clients
San Francisco – The Electronic Frontier Foundation (EFF) and mobile security company Lookout have uncovered a new malware espionage campaign infecting thousands of people in more than 20 countries. Hundreds of gigabytes of data has been stolen, primarily through mobile devices compromised by fake...
497
Meltdown and Spectre Linux Kernel Status
I keep getting a lot of private emails about my previous post about the latest status of the Linux kernel patches to resolve both the Meltdown and …
498
499
It is not possible to detect and block Chrome headless
An updated example of techniques to avoid detection.
500
CloudFlair: Bypassing CloudFlare using Internet-wide scan data
Cloudflare is a service that acts as a middleman between a website and its end users, protecting it from various attacks. Unfortunately, those websites are often poorly configured, allowing an attacker to entirely bypass Cloudflare and run DDoS attacks or exploit web-based vulnerabilities that would otherwise be…
501
502
Cloudflare Access: Like BeyondCorp, but You Don’t Have to Be at Google to Use It
Tell me if this sounds familiar: any connection from inside the corporate network is trusted and any connection from the outside is not. This is the security strategy used by most enterprises today. The problem is that security is breached, the attacker has access to everything.
503
Some thoughts on security after ten years of Qmail 1.0
Some thoughts on security after ten years of qmail 1.0 Bernstein, 2007 I find security much more important than speed. We need invulnerable software systems, and we need them today, even if they ar…
504
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
505
Long-Term Consequences of Spectre and Its Mitigations
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
506
Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past
Let's solve application security at an ecosystem level by updating outdated and/or insecure blog posts to refer developers to better practices.
507
Requiring secure contexts for all new features
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG ...
508
Using a Yubikey for GPG and SSH
It’s been a long time since my last blogpost, but I’m back with a post about how to use your Yubikey 4 for GPG and SSH keys.\n
509
LinkedIn is ignoring user settings
Logged out users are prevented from reaching LinkedIn profiles set to complete public visibility
510
Things you must know before you can understand Meltdown as a developer
Meltdown is a cache-timing attack on Intel CPUs that allows all memory to be read by any process because of how they do Speculative Execution.