5551
New
The latest blog posts to take off on Hacker News. 8,772 posts.
5552
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
5553
DuckDuckGo moves beyond search to also protect you while browsing
We're excited to launch a new browser extension and mobile app, extending DuckDuckGo's protection beyond the search box to wherever the Internet takes you.
5554
Root Cause of Reboot Issue Identified; Updated Guidance
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
5555
Mobile Device Management invades privacy
With BYOD, companies are more than ever keen on protecting their data. MDM tools, like Google Apps, do more than that; they invade your privacy.
5556
5557
Mobile Devices Compromised by Fake Secure Messaging Clients
San Francisco – The Electronic Frontier Foundation (EFF) and mobile security company Lookout have uncovered a new malware espionage campaign infecting thousands of people in more than 20 countries. Hundreds of gigabytes of data has been stolen, primarily through mobile devices compromised by fake...
5558
Meltdown and Spectre Linux Kernel Status
I keep getting a lot of private emails about my previous post about the latest status of the Linux kernel patches to resolve both the Meltdown and …
5559
5560
It is not possible to detect and block Chrome headless
An updated example of techniques to avoid detection.
5561
CloudFlair: Bypassing CloudFlare using Internet-wide scan data
Cloudflare is a service that acts as a middleman between a website and its end users, protecting it from various attacks. Unfortunately, those websites are often poorly configured, allowing an attacker to entirely bypass Cloudflare and run DDoS attacks or exploit web-based vulnerabilities that would otherwise be…
5562
5563
Cloudflare Access: Like BeyondCorp, but You Don’t Have to Be at Google to Use It
Tell me if this sounds familiar: any connection from inside the corporate network is trusted and any connection from the outside is not. This is the security strategy used by most enterprises today. The problem is that security is breached, the attacker has access to everything.
5564
Some thoughts on security after ten years of Qmail 1.0
Some thoughts on security after ten years of qmail 1.0 Bernstein, 2007 I find security much more important than speed. We need invulnerable software systems, and we need them today, even if they ar…
5565
Some thoughts on Spectre and Meltdown
The story of these attacks starts in late 2004. I had submitted my doctoral thesis and had a few months before flying back to Oxford for my defense, so I turned to some light reading: Intel's latest "Optimization Manual", full of tips on how to write faster code. (Eking out every last nanosecond of performance has…
5566
Long-Term Consequences of Spectre and Its Mitigations
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
5567
Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past
Let's solve application security at an ecosystem level by updating outdated and/or insecure blog posts to refer developers to better practices.
5568
Requiring secure contexts for all new features
Since Let’s Encrypt launched, secure contexts have become much more mature. We have witnessed the successful restriction of existing, as well as new features to secure contexts. The W3C TAG ...
5569
Using a Yubikey for GPG and SSH
It’s been a long time since my last blogpost, but I’m back with a post about how to use your Yubikey 4 for GPG and SSH keys.\n
5570
LinkedIn is ignoring user settings
Logged out users are prevented from reaching LinkedIn profiles set to complete public visibility
5571
Things you must know before you can understand Meltdown as a developer
Meltdown is a cache-timing attack on Intel CPUs that allows all memory to be read by any process because of how they do Speculative Execution.
5572
5573
New DHS policy on demands for passwords to travelers’ electronic devices
US Customs and Border Protection, a component of the Department of Homeland Security, today posted a revised policy on Border Searches of Electronic Devices and a Privacy Impact Assessment of some of the changes made by the new policy.
5574
Intel Security Issue Update: Addressing Reboot Issues
Intel Newsroom delivers the latest news, announcements, and updates. Stay informed on Intel innovations.
5575
Government Communication
When legally forced to provide information to government or law enforcement agencies, we'll disclose the transcripts of that communication here.
5576
Protecting Google Cloud customers without impacting performance
If you’ve been keeping up on the latest tech news, you’ve undoubtedly heard about the CPU security flaw that Google’s Project Zero disclosed last Wednesday. On Friday, w…
5577
Post-mortem of this weekend's NPM incident
npm Blog (Archive); updates from the npm team are now published on the GitHub Blog and the GitHub Changelog
5578
Signal partners with Microsoft to bring end-to-end encryption to Skype
In collaboration with Signal, Microsoft is introducing a Private Conversations feature in Skype, powered by Signal Protocol.
5579
Spectre and the end of langsec
wingolog: article: spectre and the end of langsec
5580
Website Glitch Let Me Overstock My Coinbase
Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders.