811
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
New
The latest blog posts to take off on Hacker News. 8,769 posts.
812
I caught Google Gemini using my data and then covering it up
I asked Google Gemini a pretty basic developer question. The answer was unremarkable, apart from it mentioning in conclusion that it knows I previously used ...
813
Cities panic over having to release mass surveillance recordings
Flock's 'licence plate readers' read much more than license plates. A judge says what they record must be released.
814
I have recordings proving Coinbase knew about breach months before disclosure
I have recordings and emails showing attacks months before Coinbase's 'discovery'. Timeline, headers, and audio evidence.
815
Our investigation into the suspicious pressure on Archive.today
Some time ago, we were contacted by a group fighting against online CSAM, demanding that AdGuard DNS blocks the Archive.today website. This was only the beginning of a much larger story…
816
No Leak, No Problem – Bypassing ASLR with a ROP Chain to Gain RCE
After my previous post on ARM exploitation, where we crafted an exploit for a known vulnerability, I decided to continue the research on a more modern IoT target. In this follow-up post, I will take you through building a considerably more complex binary exploit. We will explore the path from firmware extraction and…
817
Mullvad VPN present And Then? (Chat Control is back on the menu)
Chat Control is back on the menu. To highlight the corruption behind the proposal, Mullvad VPN now presents "And Then?"
818
Lawmakers want to ban VPNs
It's unfortunately no longer enough to force websites to check your government-issued ID before you can access certain content, because politicians have now discovered that people are using Virtual Private Networks (VPNs) to protect their privacy and bypass these invasive laws. Their solution? Entirely ban the use of…
819
Disrupting the first reported AI-orchestrated cyber espionage campaign
A report describing a highly sophisticated AI-led cyberattack and how we disrupted it.
820
Rust in Android: move fast and fix things
Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we lo…
821
Checkout.com hacked, refuses ransom payment, donates to security labs
Our statement detailing an incident concerning a legacy system. We outline our commitment to transparency, accountability, and planned investment in cyber security research.
822
Reverse Engineering Yaesu FT-70D Firmware Encryption
This article dives into my full methodology for reverse engineering the tool mentioned in this article. It's a bit longer but is intended to be accessible to folks who aren't necessarily advanced reverse-engineers.
823
Bitcoin's big secret: How cryptocurrency became law enforcement's secret weapon
WIRED's Andy Greenberg discusses a revelation that turned his decades-long reporting on its head: Bitcoin became a criminal's worst nightmare.
824
Android developer verification: Early access starts
News and insights on the Android platform, developer tools, and events.
825
826
Digital ID, a new way to create and present an ID in Apple Wallet
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
827
Fighting the New York Times' invasion of user privacy
OpenAI is fighting the New York Times’ demand for 20 million private ChatGPT conversations and accelerating new security and privacy protections to protect your data.
828
Chat Control 2.0 through the back door
Just before a decisive meeting in Brussels, digital rights expert and former Member of the European Parliament Dr. Patrick Breyer is sounding the alarm. Using a "deceptive sleight of hand," a mandatory and expanded Chat Control is being pushed through the back door, in a form even more intrusive tha
829
I didn't reverse-engineer the protocol for my blood pressure monitor in 24 hours
The personal website of James Belchamber.
830
Firefox expands fingerprint protections
With Firefox 145, we’re rolling out major privacy upgrades that take on browser fingerprinting — a pervasive and hidden tracking technique that lets we
831
Benchmarking leading AI agents against Google reCAPTCHA v2
We evaluate three leading AI models—Claude Sonnet 4.5, Gemini 2.5 Pro, and GPT-5—on their ability to solve Google reCAPTCHA v2 challenges and find significant performance differences, with success rates ranging from 28% to 60%.
832
How cops can get your private online data
Can the cops get your online data? In short, yes. There are a variety of US federal and state laws which give law enforcement powers to obtain information that you provided to online services. But, there are steps you as a user and/or as a service provider can take to improve online privacy.Law...
833
Drilling down on Uncle Sam's proposed TP-Link ban
The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems , a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China…
834
About KeePassXC's Code Quality Control
KeePassXC Password Manager
835
Using bubblewrap to add sandboxing to NetBSD
As of the time of writing, there is no real sandboxing technique available to NetBSD. There is chroot , which can be considered a weak sandbox because it modifies the root directory of the process, effectively restricting the process' view of the file system, but it doesn't isolate anything else, so all networking…
836
IP blocking the UK is not enough to comply with the Online Safety Act
A follow up to The Ofcom Files. Some notes on Ofcom’s strategy to date. As many of you know, I represent the U.S. website 4chan, pro bono, in its U.S. federal lawsuit against the UK…
837
Firefox Forcing LLM Features
Mozilla forcing llm features and providing no gui for users to disable them
838
Cloudflare scrubs Aisuru botnet from top domains list
For the past week, domains associated with the massive Aisuru botnet have repeatedly usurped Amazon , Apple , Google and Microsoft in Cloudflare’s public ranking of the most frequently requested websites. Cloudflare responded by redacting Aisuru domain names from their top websites list. The chief executive at…
839
Two billion email addresses were exposed
I hate hyperbolic news headlines about data breaches, but for the "2 Billion Email Addresses" headline to be hyperbolic, it'd need to be exaggerated or overstated - and it isn't. It's rounded up from the more precise number of 1,957,476,021 unique email addresses, but other
840
Removing XSLT for a more secure browser
Prepare for Chrome deprecating and removing XSLT from the browser.