The latest blog posts to take off on Hacker News. 8,770 posts.
Because I'm a massive nerd, I actually try to read specification documents. As I've ranted ad nauseam before, the current TOTP spec is irresponsibly obsolete. The three major implementations of the spec - Google, Apple, and Yubico - all subtly disagree on how it should be implemented. Every other MFA app has their own…
I have used it for a long time - 20 years now, including for a while the IceWeasel variant - and I like it as a browser.
This “feature” accomplishes nothing of value for anyone, including the streaming services, but imposes a massive (and for most people, confusing and frustrating) hindrance on honest people simply trying to easily capture high-quality (as opposed to, say, using their damn phone to take a photograph of their reflective…
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
On Wednesday we shared that we’re introducing a new terms of use (TOU) and privacy notice for Firefox. Since then, we’ve been listening to some of our
how to gain code execution on millions of people and hundreds of popular apps
This opinion is a routine ruling over TOS formation and whether disputes must go to arbitration. However, before I dig into that question, I need to note the case’s chilling implications. * * * This case involves the Adult Friend...
Kaspersky Global Research & Analysis Team (GReAT) discovered hundreds of open source repositories with multistaged malware targeting gamers and cryptoinvestors within a new campaign that was dubbed by Kaspersky as GitVenom. The infected projects include an automation instrument for interacting with Instagram accounts…
A fun project that I learned a lot from.
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
Big Tech companies - Apple, Google, and Meta - have built a mass surveillance machine that the government can easily tap into.
For decades, memory safety vulnerabilities have been at the center of various security incidents across the industry, eroding trust in technology and costing billions. T…
UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of t
Certificate Transparency (CT) has been one of the biggest advancements in web security, keeping users safe from threats such as certificate fraud and…
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
Teammate App had a publicly exposed database and told me to stop harassing them after I emailed them about it.
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
The $1.5B Bybit Hack demonstrates how the Era of Operational Security Failures has arrived, and most cryptocurrency companies are not prepared for its implications.
Eight Sleep smart bed found to contain an exposed AWS key and a likely backdoor that allowed engineers to remotely access users' beds
Since I reside in a Five Eyes country (Australia) and have publicly presented four cases I led on China’s APT41 attacking organisations in ASEAN , particularly concerning China’s cyber and political strategies, I was curious to explore what China publishes about Five Eyes operations. This led me down a rabbit hole of…
Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.
We’ve integrated a new REST API and embedded web server directly into the pihole-FTL binary. This eliminates the need for lighttpd and PHP , reducing the installation footprint and boosting performance. The new API also offers server-side pagination for the query log, ensuring a faster and more responsive interface.
Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
Privacy is only dead if we let it die. Be careful about the all-or-nothing mindset in data privacy, it can do more damage than good to the cause. While striving for improvements, do not forget to cheer and celebrate each small win.
Musings on SBOMs and licensing woes.
