The latest blog posts to take off on Hacker News. 8,768 posts.
53MB of source code leaked from a government endpoint. 269 verification checks. biometric face databases. SAR filings to FinCEN. and the same company that verifies your ChatGPT account.
We measure the capabilities of LLMs to deanonymize users online.
Mohammed Ketab
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API…
We identified coordinated distillation attacks using ~24,000 fraudulent accounts to extract Claude's capabilities.
After the acquisition by a much larger company, security became a top priority. Our company occupied three tall buildings, each at least 13 stories high. Key card readers were installed next to every
BinaryAudit benchmarks AI agents using Ghidra to find backdoors in compiled binaries of real open-source servers, proxies, and network infrastructure.
A former CIA analyst describes her polygraph experiences with the CIA and as a contractor working for the National Reconnaissance Office (NRO), FBI, and Defense Intelligence Agency (DIA).
AVAILABLE NOW OpenAI, Anthropic, and Chrome ship it. Apple deprecated it. Nobody documented it. Until now. → sandbox-exec: The Miss...
Anger over ICE connections and privacy violations is fueling the sabotage. PLUS: 10,000 drivers call on Uber to repay stolen wages, a man is arrested at a public hearing about a data center and more.
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
What happens when you responsibly disclose a critical vulnerability exposing personal data - including that of minors - and the organization responds with legal threats instead of a thank you?
Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.
When you request a certificate from Let’s Encrypt, our servers validate that you control the hostnames in that certificate using ACME challenges. For subscribers who need wildcard certificates or who prefer not to expose infrastructure to the public Internet, the DNS-01 challenge type has long been the only choice…
The Stable channel has been updated to 145.0.7632.75/76 for Windows/Mac and 145.0.7632.75 for Linux, which will roll out over the coming d...
🇬🇧->🇵🇱 Przejdź do polskiej wersji tego wpisu / Go to polish version of this post
Learn how to run NanoClaw, a Claude-powered WhatsApp assistant, inside a Docker Sandboxes shell sandbox for stronger isolation and proxy-managed API keys.
“The devil is in the details,” they say.
Building Bluehood, a Bluetooth scanner that reveals what information we leak just by having Bluetooth enabled on our devices.
The Billion-Dollar Surveillance Pipeline: From Occupation Technology to Global Control
Just a decade after a global backlash was triggered by Snowden reporting on mass domestic surveillance, the state-corporate dragnet is stronger and more invasive than ever.
I recently got a smart sleep mask from Kickstarter. I was not expecting to end up with the ability to read strangers' brainwaves and send them electric impul...
A convincing lookalike of the popular 7-Zip archiver site has been silently turning victims’ machines into residential proxy nodes.
While exploring the file system on a jailbroken iPhone 6s, I stumbled upon an interesting folder:
OpenSSL sucks. The BoringSSL and AWS-LC forks are Googled and Amazoned to death; they don't care about anyone but their own use cases. I can't remember ever having a good experience with software using GnuTLS. LibreSSL is incomplete... FOREWARD This post is about the experience of taking a leap of …
It finally happened. After months of speculation, Discord dropped the hammer: mandatory age verification for all users is rolling out next month. The era of anonymous gaming chats is officially over.
Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a requirement of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: your account has a verified email, so there's no problem.
CISA lost a third of its staff and its acting leader uploaded sensitive docs to public ChatGPT, while China sits inside U.S. critical infrastructure.
