The latest blog posts to take off on Hacker News. 8,769 posts.
A few days ago, someone called PixelMelt published a way for Amazon's customers to download their purchased books without DRM. Well… sort of. In their post "How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked" they describe the process of spoofing a web browser, downloading a bunch of JSON files…
Ofcom — driven by the letter of British law that they are bound to follow, but still Ofcom — are quietly making Britain look (a) very silly and (b) as if we haven’t yet shucked-off the Americ…
This year we are calling to FREE THE INTERNET. Your donation will help break the chains of censorship and surveillance. If you give now during the campaign, your donation will be matched by our supporters at Power Up Privacy. This means a $25 donation will have a $50 impact.
As it turns out they don't actually want you to do this (and have some interesting ways to stop you)
This article details two bugs discovered in the NVIDIA Linux Open GPU Kernel Modules and demonstrates how they can be exploited. The bugs can be triggered by an attacker controlling a local unprivileged process. Their security implications were confirmed via a proof of concept that achieves kernel read and write…
ptrpaws's blog on reverse engineering, programming, vr finds and miscellaneous stuff.
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
Click fraud protection in one tool: DataCops flags bot clicks, blocks repeat bots at your Cloudflare edge, keeps them out of the conversions 8 ad platforms learn from, and exports Google refund evidence.
Can you build tech independence while breaking encryption?
Mobile adtech juggernaut AppLovin recently faced multiple allegations of misconduct . Allegations run the gamut—privacy, ad targeting, even national security and ties to China. I was among the researchers consulted by skeptical investors this spring, and I was quoted in one of their reports, explaining my concerns…
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
Let's Discuss the organization providing a false sense of security at an unbeatable price.
The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T , Comcast and Verizon , new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is…
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
"Correct" doesn't mean "correct" when correctly using "correct"
Get details on our discovery of a critical vulnerability in GitHub Copilot Chat.
For approximately six hours on 25.9.2025, the entire statichost.eu domain was flagged as deceptive by Google Safe Search. This meant that anyone using Google Safe Search was shown a very aggressive warning or outright blocked when trying to access any site on the statichost.eu domain. In some cases even custom domains…
1 Prologue A while ago, I took a flight from Canada back to Hong Kong - about 12 hours in total with Air Canada. Interestingly, the plane actually had WiFi: However, the WiFi had restrictions. For Aeroplan members who hadn’t paid, it only offered Free Texting, meaning you could only use messaging apps like WhatsApp…
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
Anthropic research on data poisoning attacks shows a few hundred malicious documents can "backdoor" large language models of any size.
[A Federal Air Marshal (FAM) tasked with surveillance of an airline passenger targeted by Quiet Skies lists and/or rules followed the traveler out to the curb and recorded the license plate number of the vehicle in which she left the airport, so that her airline reservations could be integrated with license plate…
You don't own your email; you rent it. This vulnerability leaves your entire digital life at risk. Read how to seize back control of your most critical online asset by switching providers and setting up your own unbannable email server.
A 13‑year Redis flaw (CVE‑2025‑49844) allows attackers to escape Lua sandbox and run code on hosts. See Wiz Research’s analysis and mitigations.
Using advanced AI to fix critical software vulnerabilities
Over the course of years, RSA implementations gradually replaced Euler's totient function with Carmichael's totient function.
In the expanding world of AI my heart still lies in AST transforms, browser fingerprinting, and anti-bot circumvention. But my workflow felt... primitive.
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement .
