6361
New
The latest blog posts to take off on Hacker News. 8,773 posts.
6362
Implementing a Tor relay from scratch in golang (2015)
Update from the author, over a decade later: Go has improved and so have my own skills. The conclusion of this article was that Go isn't the right language for the task I gave it, and that's no longer true today, but also wasn't true when I wrote the article. This article is user error, not a language issue.
6363
6364
6365
6366
6367
A single byte write opened a root execution exploit
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
6368
Certificate Revocation Issue
We're experts in automated, Scalable, Integrated Digital Certificates Solutions, SSLs/TLSs, managed PKI, IoT, authentication & email security. Learn more about our identity management services.
6369
Analyzing the Patterns of Numbers in 10M Passwords (2015)
There are many patterns for numbers in passwords, which involve surprising yet intuitive logic.
6370
What are malicious USB keys and how to create a realistic one?
This blog post shows how to create a reliable and realistic-looking malicious USB key that can be used in a drop attack.
6371
6372
Disappearing messages for Signal
The latest Signal release for iPhone, Android, and Desktop now includes support for disappearing messages. The timer has come With this update, any conversation can be configured to delete sent and received messages after a specified interval. The configuration applies to all parties of a convers...
6373
Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras
Over the last few weeks we've seen DDoS attacks hitting our systems that show that attackers have switched to new, large methods of bringing down web applications.
6374
EC2's most dangerous feature
A review for readers unfamiliar with this feature: Amazon IAM ( Identity and Access Management ) is a service which allows for the creation of access credentials which are limited in scope; for example, you can have keys which can read objects from Amazon S3 but cannot write any objects. IAM Roles for EC2 are a…
6375
IP Spoofing
The recording and slides are available, but for easier consumption here's a transcript.
6376
6377
Industry Concerns about TLS 1.3
Search IETF mail list archives
6378
Guccifer 2.0 Hacked Clinton Foundation
Many of you have been waiting for this, some even asked me to do it. So, this is the moment. I hacked the Clinton Foundation server and downloaded hundreds of thousands of docs and donors’ da…
6379
Grand jury subpoena for Signal user data
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation. We’ve designed the Signal service to minimize the dat...
6380
NoScript is harmful and promotes malware
NoScript proudly calls itself a security extension advertising itself as an extension with “whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known and even not known yet!) with no loss of functionality…”
6381
Dropbox Hasn't Learned Their Lesson
You would think less than a month after a very popular HackerNews article on how Dropbox hacks your Mac, the file sharing company would be careful about their software distribution. They just distributed an update that hacks your UI and presents a Yahoo-like banner from 2004.
6382
“Why do you work in security instead of something more lasting?”
This post grew out of a friend on Facebook asking (I paraphrase) "why do you spend your time on security instead of using your brainpower f...
6383
Inside Arizona’s Pump Skimmer Scourge
Crooks who deploy skimming devices made to steal payment card details from fuel station pumps don’t just target filling stations at random: They tend to focus on those that neglect to deploy various tools designed to minimize such scams, including security cameras, non-standard pump locks and tamper-proof security…
6384
Qubes OS 3.2 has been released
I’m happy to announce that today we’re releasing Qubes OS 3.2! This is an incremental improvement over the 3.1 version that we released earlier this year. A lot of work went into making this release more polished, more stable and easier to use than our previous releases. One major featu...
6385
How to Crash Systemd in One Command
After running this command, PID 1 is hung in the pause system call. You can no longer start and stop daemons. inetd-style services no longer accept connections. You cannot cleanly reboot the system. The system feels generally unstable (e.g. ssh and su hang for 30 seconds since systemd is now integrated with the login…
6386
What’s the matter with PGP?
Last Thursday, Yahoo announced their plans to support end-to-end encryption using a fork of Google’s end-to-end email extension. This is a Big Deal. With providers like Google and Yahoo onboa…
6387
6388
6389
Two years spent spamming spammers back
I created a bot to respond to these types of emails…
6390
The Democratization of Censorship
John Gilmore , an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech.