The latest blog posts to take off on Hacker News. 8,768 posts.
We discovered that entire sections describing domestic U.S. intelligence facilities were deliberately removed from two published documents, while equivalent foreign facilities remained visible. The evidence exists in an unexpected place - the PDF metadata of documents published by The Intercept in 2016, and by The…
A responsible disclosure write-up on an organization-wide ArcGIS API key embedded across multiple public front-end bundles.
For the past several months, I’ve been receiving and then ignoring a steady stream of concerning emails from Sendgrid, the popular email delivery service owned by Twilio that I use for sendin…
Sometimes, you need to deal with secrets in an interactive shell. Say, for example, you want to do things with the API of a GitLab instance for which you require authentication:
This blog post shows how to fix a buffer overflow in the su progam of UNIX v4
Vulnerabilities in IBMs Bob AI allow attackers to trigger the download and execution of malware via indirect prompt injection if users select auto-approve for even one known trusted command.
There has been speculation about the cause of a BGP anomaly observed in Venezuela on January 2. We take a look at BGP route leaks, and dive into what the data suggests caused the anomaly in question.
What I learned mining 125,000 vulnerabilities from Linux git history. The average kernel bug lives 2.1 years before discovery, but some subsystems are far worse.
We need to have a hard look at the surveillance industry. It is a key enabler of vast and untold violations of human rights and civil liberties, and it continues to be used by aspiring autocrats to threaten our very democracy. As long as it exists, the surveillance industry, and the data it generates, will be an…
View changes to the Tailscale client and service.
Notion AI was susceptible to data exfiltration via indirect prompt injection due to a vulnerability in which AI document edits are saved before user approval.
This is just a short description for your post which you can edit depending on your needs via the Framer CMS.
The Low Orbit Security Radar is a weekly security newsletter from an offensive practitioner's perspective. One idea, curated news, and links worth your time. News: There Were BGP Anomalies During The Venezuela Blackout When watching the situation in Venezuela unfold, the phrase "It was dark, the lights of Caracas
TL;DR Introduction I first encountered the chatbot as a normal Eurostar customer while planning a trip. When it opened, it clearly told me that “the answers in this chatbot are generated by AI”, which is good disclosure but immediately raised my curiosity about how it worked and what its limits were. Eurostar…
A proof of concept demonstrating how to use the Hinge dating app as a C2.
The PGP problem
A small HTTP-header tribute to Sir Terry Pratchett
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the…
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
I found a stranger texting my 12-year-old on a 'kid-safe' Gabb phone. Parental controls are broken.
It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24 hours to do what I always do with any technology we’re […]
Trail of Bits discovered and disclosed two vulnerabilities in the widely used elliptic JavaScript library that could allow signature forgery or prevent valid signature verification, with one vulnerability still unfixed after the 90-day disclosure window.
I have 15+ years of software engineering experience across different parts of the tech stack including networking libraries, congestion control, performance improvements, Backend, and Android development.
If you were an Internet user for a few years on either side of the turn of the millennium, you will remember pop-up advertisements.
Source I find myself in the unusual position of defending Bitcoin from its critics, if only reluctantly. In 2024 Soroush Farokhnia & Amir...
Libsodium is now 13 years old!
