91
Fingerprints are the new cookies
Now open it on your phone or some other device and your nickname will be different and just as consistent.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
92
Passkeys are a trap
Intended audience: non-technical citizens of the web
93
Telegram Desktop vulnerability allowed any user's file to be stolen
An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.
94
A statement on the Tor Project's relationship with Mullvad
Recent concerns about a political donation by a Mullvad co-founder have raised questions about the Tor Project's funding relationship with the company. We are not terminating the relationship but are setting clear boundaries on our relationship with Mullvad.
95
Eye of Sauron: Long-Range Hidden Spy Camera Detection (2024)
Qibo Zhang and Daibo Liu, Hunan University; Xinyu Zhang, University of California San Diego; Zhichao Cao, Michigan State University; Fanzi Zeng, Hongbo Jiang, and Wenqiang Jin, Hunan University
96
OpenAI "rogue" agent activities found on Wikimedia projects
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s enviro…
97
Apple and a hacker's future
I was happy for years in Apple’s walled garden; with AI, however, their protections feel like limitations.
98
Denmark data breach exposes 8.8M people's personal data
Det Centrale Personregister (CPR) har konstateret en alvorlig sikkerhedshændelse. Ved at misbruge en dansk virksomheds lovlige adgang til at søge...
99
An algorithmic failure beneath the secret ballot
The secret ballot is one of the load-bearing walls of democracy. In Georgia, as in most states, this allows you to know whether your neighbor voted, but never who they voted for. Yet, in multiple states including Georgia, that guarantee is actively at risk.
100
Cloudflare OHTTP gateway
We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.
101
Court agrees with EFF: Utah's VPN law demands a technical impossibility
In a win for digital rights, a federal judge has issued a preliminary injunction blocking Utah’s SB 73, the state’s draconian anti-VPN age verification law. The decision comes as EFF submitted our comments to the Utah Department of Commerce, detailing how forcing platforms to detect and block privacy-preserving tools…
102
Git 3.0's upcoming SHA-256 default will be a costly mistake
Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
103
GLM-5.3 and the spread of advanced cyber capabilities
GLM-5.3 can autonomously build end-to-end cyber exploits, but unlike other frontier models, it was released without meaningful safeguards to limit misuse.
104
I could've accessed 17T Microsoft records
How one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.
105
Hijacking the PS5's RTMP stream
The long way around to screen sharing.
106
I switched to Brave
I've been using Brave for a couple months now after using Firefox for around 25 years. I think Brave will be a permanent change.
107
Self-Hosting on the Dark Web
This site is now reachable over Tor as a hidden service, at a .onion address that resolves only inside the Tor network. Tor relays and encrypts your traffic as …
108
On caring for user data: NeoVim caused Vim undo files to be deleted
A blog about software craft and quality
109
An agent used DNS to reach an external chatbot
Research on aligning AI with human values and intent, and reports documenting model failures.
110
Meta's Muse appears to use an OpenAI model labeled muse-special
While Muse was building my website, one subagent ran on a model called azure/muse-special. So I dug through the filesystem again.
111
Entering and Breaking the Avast Antivirus Sandbox Part 2
SAFA details the full exploitation of CVE-2025-13032, turning a double-fetch vulnerability in Avast's kernel driver into a local privilege escalation to SYSTEM on Windows 11.
112
Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
113
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
114
Hackers influence ChatGPT and Gemini to direct users to scam centers
Think you can trust AI to give you correct answer? Think again.
115
Two-tier encryption in the UK
Alice and Bill have identical Apple devices. Only one gets Apple’s strongest iCloud protection.
116
Early rogue AI agent activity and attempts to hack found on urlquery.net
We found evidence on urlquery that AI agents were active earlier than previously reported and attempted hacks against public data providers.
117
Radicle: Disclosure of Vulnerability in the Network Protocol
Sovereign code infrastructure.
118
Claude Code reads AGENTS.md only when telemetry is on [fixed]
Claude Code 2.1.277 added AGENTS.md support, but the loader sits behind a remote feature flag. With telemetry or nonessential traffic turned off, a local AGENTS.md is skipped without a warning. This is what I measured and the one-line CLAUDE.md I use instead.
119
Data-only attacks are easier than you think (2024)
Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein…
120
SAML: A fractal of bad design
SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness…