751
“Super secure” messaging app leaks everyone's phone number
You can be, do, and have whatever you want, except for not spilling user information
New
The latest blog posts to take off on Hacker News. 8,768 posts.
752
It seems that OpenAI is scraping [certificate transparency] logs
lol. I minted a new TLS cert and it seems that OpenAI is scraping CT logs for what I assume are things to scrape from, based on the near instant response from ...
753
Price of a bot army revealed across online platforms
The first global index tracking real-time prices for buying fake account verifications on 500+ online platforms in every country has been launched by a team at the University of Cambridge.
754
Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
755
Pizlix: Memory Safe Linux from Scratch
Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available.
756
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
757
VPN location claims don't match real traffic exits
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
758
Guarding My Git Forge Against AI Scrapers
A summary of the techniques in place to protect my git forge
759
Denial of service and source code exposure in React Server Components
The library for web and native user interfaces
760
UK House of Lords attempting to ban use of VPNs by anyone under 16
This is deranged, each nation’s boomers and reactionaries attempting to outdo the others: “Action to prohibit the provision of VPN services to children in the United Kingdom” … th…
761
We built a resource hub to fight back against age verification
Age verification laws are proliferating fast across the United States and around the world, creating a dangerous and confusing tangle of rules about what we’re all allowed to see and do online. That's why today, we're launching EFF.org/Age, a one-stop shop for users seeking to understand what these laws actually do…
762
Going Through Snowden Documents, Part 1
We are building a comprehensive archive and analysis project examining published documents leaked by Edward Snowden. Our methodology involves systematically reviewing each available document with particular attention to small details and information that has received little or no public attention since the initial…
763
EFF launches Age Verification Hub
With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help…
764
Israel used Palantir technologies in pager attack in Lebanon
A New Book Quietly Reveals That Israel Used Palantir In It's Terrorist Attack On Lebanon.
765
COM Like a Bomb: Rust Outlook Add-in
One of legal tech's clichés is that "lawyers live in Word". This is demonstrably incorrect. I, for example, am a lawyer and in fact live in London, England…
766
Stop Breaking TLS
Rant ahead: I hate TLS “Inspection” software with a burning passion and I wish we collectively as an industry would just knock it the fuck off and stop pretending it’s some great security benefit. Every time I encounter it, in whatever form, it’s a gigantic headache that makes everyone’s life worse off and as far as I…
767
Linux CVEs, more than you ever wanted to know
It’s been almost 2 full years since Linux became a CNA (Certificate Numbering Authority) which meant that we (i.e. the kernel.org community) are now responsible for issuing all CVEs for the Linux kernel. During this time, we’ve become one of the largest creators of CVEs by quantity, going from nothing to number 3 in…
768
10 Years of Let's Encrypt
On September 14, 2015, our first publicly-trusted certificate went live. We were proud that we had issued a certificate that a significant majority of clients could accept, and had done it using automated software. Of course, in retrospect this was just the first of billions of certificates. Today, Let’s Encrypt is…
769
Why the Sanitizer API is just `setHTML()`
Why the Sanitizer API is just <code>setHTML()</code>
770
How I discovered a hidden microphone on a Chinese NanoKVM
NanoKVM is a hardware KVM switch developed by the Chinese company Sipeed. Released last year, it enables remote control of a computer or server using a virtu...
771
Trick users and bypass warnings – Modern SVG Clickjacking attacks
A novel and powerful twist on an old classic.
772
Acme, a brief history of one of the protocols which has changed the Internet
ACME, a brief history of one of the protocols which has changed the Internet Security Changelog 03 December 2025: article announced on Mastodon, LinkedIn and X. 03 December 2025: J.C. Jones published his reflections about 10 years of Let’s Encrypt. A must read! 03 December 2025: J.C. has also been kind enough to…
773
Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
774
Critical RCE Vulnerabilities in React and Next.js
React2Shell (CVE-2025-55182) is a critical RCE vulnerability in React Server Components. Learn which versions are impacted and how to mitigate.
775
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
776
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy
777
Understanding ECDSA
Exploring blockchain, math, and smart contracts through a security lens.
778
Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera
Claimed end-to-end privacy doesn’t fully conceal your rear-end data
779
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
780
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…