The latest blog posts to take off on Hacker News. 8,770 posts.
Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried out in a variety of ways. The majority of these attacks originated via…
Documentation and guides from the team at Fly.io.
The key question is: Can you detect AI agent traffic on your application today? We tested multiple AI agent toolkits across high-traffic consumer sites, and the results were clear—legacy detection techniques (CAPTCHAs, IP blocking, user-agent filtering) are largely ineffective. Here’s what we found.
Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. Our...
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national…
Cryptographic schemes are based on the computational difficulty of solving some ‘hard’ problem. For example, RSA (specifically, RSA-2048) is based on the difficulty of a problem like this:
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
Some people who had previously disabled Apple Intelligence in macOS 15.3 and iOS 18.3 saw it re-enabled after updating to macOS 15.3.1 and iOS 18.3.1 today. In fact I personally have two different Apple silicon Macs running macOS Sequoia, and after I updated both Macs to 15.3.1, Apple Intelligence was re-enabled on my…
Today I want to share a great story about why many NVIDIA products are now running formally verified SPARK code. This blog post is in part a teaser for…
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
IDO based smart watches are a security nightmare, and there's likely millions of them out there
An Open Letter To JD Vance From A Former CIA Officer On The Counterintelligence Risks Of Smartwatches Mr. Vice President, Congratulations on your ascendancy to the Vice President of the United States of America. While we are an apolitical platform, we wish you nothing but success, the country depends on you. In a rec
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
Shipping large software to end-user devices is a complicated process. Shipping large software securely to end-user devices is even more complicated. Signing the things that ship to end-user devices is
The Mend research team uncovered a fake VS-code extension—truffelvscode—typosquatting the popular truffle for VS-code extension. Read the post for more details.
If you’re fed up with Meta right now, you’re not alone. Meta tracks you across millions of websites and apps and its business model relies on your data. If you want to limit Meta’s ability to collect and profit from your personal data, here’s what you need to know.
What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report,
Trump paralysed the "Privacy and Civil Liberties Oversight Board" (PCLOB), a key element of the EU-US data transfer deal that allows EU-US data flows.
Hello there! If you follow tech news, you might have heard about the Okta security incident that was reported on 1st of November. The TLDR of the incident was …
A list of OWASP's Non-Human Identities Top 10 risks for 2025
Reverse Engineering: I discovered a serious Remote Code Execution (RCE) vulnerability in a popular game that could let attackers run code on your PC. Watch how I found it, reported it, and what you can do to stay safe.
imessage-exporter ’s goal is to provide the most comprehensive representation of iMessage data available. Message data is stored in a legacy format that appears to be a stream that represents objects.
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
As seen on Hackaday! TL;DR – The SanDisk High Endurance cards use SanDisk/Toshiba 3D TLC Flash. It took way, way more work than it should have to figure this out (thanks for nothing, SanDisk!…
Avoid ISP routers
Learn how to turn off Apple Intelligence on iPhone, iPad, or Mac. Asurion Experts show you step-by-step how to manage your Apple devices’ smart features.
Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn’t inhe…
The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here…
