511
My university uses prompt injection to catch cheaters
Web developer and cybersecurity researcher
New
The latest blog posts to take off on Hacker News. 8,768 posts.
512
UK intelligence censored report on global warming and homeland security
Series: I read it so you don't have to
513
514
Someone at BrowserStack is leaking users' email addresses
Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. A few weeks ago I signed up…
515
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
516
The FAA’s flight restriction for drones is an attempt to criminalize filming ICE
Legal intern Raj Gambhir was the principal author of this post.Update: On April 15, 2026 the FAA rescinded the TFR (FDC 6/4375) and instead issued an advisory (FDC 6/2824), which states: [Drone] operators are advised to avoid flying in proximity to: Department of War (DOW), Department of Energy (...
517
Claude Code Found a Linux Vulnerability Hidden for 23 Years
Claude Code has gotten extremely good at finding security vulnerabilities, and this is only the beginning.
518
Age verification on Systemd and Flatpak
How will this work, I wonder
519
SSH certificates: the better SSH experience
When I ssh into a server for the first time, I’m confronted with a dialog which asks me to verify I’m actually talking to the machine I expect to be talking to. $ ssh -l jp 192.0.2.65 The authenti...
520
521
Slightly safer vibecoding by adopting old hacker habits
I have seen a lot of public discussion around supply-chain attacks on the Python ecosystem, prompt injection risks when using coding agents,...
522
Subscription bombing and how to mitigate it
How bots used our sign-up and forgot password pages to bomb real people's inboxes, and what we did to stop it. A practical guide to subscription bombing for founders and developers who think CAPTCHA is an "I'll do it later" task.
523
Email obfuscation: What works in 2026?
Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken.
524
The Claude Code Leak
What the accidental Claude Code source code leak tells us about the real value of code, product market fit, and why integration is what actually makes software great.
525
Signing data structures the wrong way
Domain separation bugs have bitten Bitcoin, Ethereum, TLS, and AWS. Snowpack solves this by embedding random domain separators directly in the IDL.
526
EmDash – A spiritual successor to WordPress that solves plugin security
Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.
527
We intercepted the White House app's network traffic
We set up a MITM proxy and captured the decrypted HTTPS traffic from the official White House iOS app. On a single browsing session it contacts multiple Elfsight domains, sends your device fingerprint to OneSignal, and loads Google DoubleClick ad tracking. The privacy manifest says it collects nothing.
528
The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
Anthropic accidentally shipped a source map in their npm package, exposing the full Claude Code source. Here's what I found inside.
529
Gone (Almost) Phishin'
This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes. One evening last month, my Apple Watch, iPhone, and Mac …
530
Axios compromised on NPM – Malicious versions drop remote access trojan
Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis.
531
Android Developer Verification
News and insights on the Android platform, developer tools, and events.
532
Vulnerability research is cooked
Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?
533
534
Recover Apple Keychain
Yes, I do—and probably more than I should admit. But a few things led to this situation. For one, I’d gotten too used to relying on Touch ID. As a result, if my muscle memory failed me, I was stuck. On top of that, I kept entering my office Active Directory (AD) password instead of my Mac password—again, muscle memory…
535
An NSFW filter for Marginalia search
… optional, that is. I’ve been working on an NSFW filter for Marginalia Search, as that is something some people have asked for, primarily API consumers. The search engine has had some domain based filtering for a while, based on the UT1 lists, but that isn’t a very comprehensive approach. We’ll land on a single…
536
ChatGPT won't let you type until Cloudflare reads your React state
Edit April 2, 2026: I've been getting inbound interest from researchers wanting to run their own queries. The MCP integration I use for my own research lets you analyze live mobile telemetry continuously collected from real devices in the wild, directly from Claude. To access it reach out at
537
The bot situation on the internet is worse than you could imagine
As you may know, on Glade Art we tend to take anti-bot measures very seriously; it is one of our topmost priorities to protect our fellow users from having t...
538
A Recipe for Steganogravy
how to hide juicy data in plain sight
539
I decompiled the White House's new app
The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages.
540
