481
How a single line of code could brick your iPhone
Gui Rambo writes about his coding and reverse engineering adventures.
New
The latest blog posts to take off on Hacker News. 679 posts.
482
Did 5G kill the IMSI catcher?
Understand the mechanics, risks, and the future of IMSI catching (a.k.a. stealing your cellular ID) in 2025. Read our primer on this niche form of hacking.
483
The Policy Puppetry Attack: Novel bypass for major LLMs
HiddenLayer’s latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps.
484
Protecting NATS and the integrity of open source
Updated May 1, 2025: CNCF and Synadia have come to an agreement to ensure that NATS continues to thrive as a healthy open source project within CNCF, with Synadia’s continued support and involvement.
485
DOGE worker’s code supports NLRB whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code…
486
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
487
How Thai authorities use online doxxing to suppress dissent
A sustained, coordinated social media harassment and doxxing campaign – which we codenamed JUICYJAM – targeting the pro-democracy movement in Thailand has run uninterrupted, and unchallenged, since at least August 2020. Through our analysis of public social media posts we determined that the campaign was not only…
488
How encryption for Cinema Movies works
The Cinema Industry is using its own standards for creating and distributing movies in a secure way. The DCI (Digital Cinema Initiatives) specification defines everything from file formats and encryption to the projection systems itself.
489
The Web Is Broken – Botnet Part 2
I guess you have all heard about the growing problem of AI companies trying to aggressively collect whatever data they can get their hands on to train their models. This has caused an explosive surge in web crawlers relentlessly hitting servers big and small. But who runs these crawlers? Turns out — it could be you!
490
15,000 lines of verified cryptography now in Python
In November 2022, I opened issue 99108 on Python’s GitHub repository, arguing that after a recent CVE in its implementation of SHA3, Python should embrace verified code for all of its hash-related infrastructure.
491
Everyone knows your location, Part 2: try it yourself and share the results
Learn how to record and analyse your mobile device traffic, take an app from the list of "shady" apps and share the results.
492
Encryption Is Not a Crime
Encryption is not a crime, encryption protects us all. Encryption, and especially end-to-end encryption, is an essential tool to protect everyone online. Attempts to undermine encryption are an attack to our fundamental right to privacy and an attack to our inherent right to security and safety.
493
TLS certificate lifetimes will officially reduce to 47 days
The CA/Browser Forum has officially voted to amend the TLS Baseline Requirements to set a schedule for shortening both the lifetime of TLS certificates.
494
You cannot have our user's data
sourcehut is a network of useful open source tools for software project maintainers and collaborators, including git repos, bug tracking, continuous integration, and mailing lists.
495
Hacking a Smart Home Device (2024)
How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.
496
New Vulnerability in GitHub Copilot, Cursor: Hackers Can Weaponize Code Agents
Pillar Security researchers have uncovered a dangerous new supply chain attack vector we've named "Rules File Backdoor." This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilot—the…
497
498
Anubis Works
Xe Iaso's personal website.
499
Behind the 6-digit code: Building HOTP and TOTP from scratch
Personal website of Doğaç Eldenk.
500
Deno Under TinyKVM in Varnish
Previously, I said that TinyKVM runs regular Linux ELFs and I use this to test my programs on the terminal like a regular program before I load them in Varnish.
501
PHP Core Security Audit Results
The PHP Foundation — Supporting, Advancing, and Developing the PHP Language
502
Hardening the Firefox Front End with Content Security Policies
Most of the Firefox User Interface (UI), including the address bar and the tab strip, are implemented using standard web technologies like HTML, CSS and JavaScript plus some additional custom components like XUL. One of the advantages of using web technologies for the front end is that it allows rendering the frontend…
503
504
Decoding the 90s: Cryptography in Early Software Development (2023)
In August 2020 we were commissioned to recover a cache of locked QText documents from the mid-90s. This is the process of analyzing the encrypted documents and reverse engineering a DOS-era Hebrew-English word processor written in Turbo Pascal.
505
Gmail E2E is as terrible as expected
Recently, Google introduced E2E encryption in Gmail. It went bad.
506
The “S” in MCP Stands for Security
Spoiler: it doesn’t. But it should.
507
Emulating an iPhone in QEMU
From black screens and boot issues to rendering quirks and PAC puzzles, here’s what we learned getting iOS to finally say hello.
508
Google announces Sec-Gemini v1 a new experimental cybersecurity model
Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. As outlined a year ago, defenders face the daunting t…
509
AI cheats: Why you didn't notice your teammate was cheating
For the past few years, cheats have evolved rapidly. First came memory reading aimbots, then colorbots, and now AI aim assist. Cheats have escaped the host PC. How does it affect the players and anti-cheats?
510
The order of files in /etc/ssh/sshd_config.d/ matters
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…