121
I asked Meta’s Muse for its filesystem and it sent me 6.8GB
I asked Muse to archive the files it could see and send them to my Google Drive. It did.
New
The latest blog posts to take off on Hacker News. 8,768 posts.
122
OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 2005
On 15 September 2026, Carter Leffen contacted me to request validation of a break of the German Army Enigma message MVUEH of 10 July 1941. The message, which was sent by a radio station with the tactical callsign 2ny, was received by the radio station of the SS-Totenkopf Quartiermeister, Ib. Ib received the message at…
123
Spymarks, not Watermarks
Watermarks that spy on users are no mere watermarks
124
Why does mathmain need an encrypted loader?
A math solver leads to encrypted code in npm packages. Follow the loader, the trigger matrix that unlocks it, the remote access payload, and the full indicators.
125
What happened to the Snowden archive
The last document from the Snowden archive was published on 29 May 2019. The Guardian stopped publishing documents in February 2014, Der Spiegel in January 2015, and The New York Times and ProPublica in August 2015. After that, only The Intercept was still publishing documents, with only a few exceptions, until it…
126
Software sandboxing: The basics (2025)
Diving into the territory of software sandboxing is diving into mostly uncharted territory. The necessary pieces to implement good sandboxing in your software are scattered all-around and the pioneers haven’t yet gathered enough knowledge into an unified mappa mundi that can guide new sailors through some well…
127
ChatGPT now knows what you do on other websites via ad collector
OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com. The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ordinary websites you visit. Any company that buys ads on ChatGPT installs
128
RSA-896
A post about RSA-896.
129
GPT-6 Astra Solves a WWI German Radio Cipher
Scienceblogs.de, a German science blogging portal, includes a relatively famous list of 50 unsolved ciphers, which range from cryptograms published by serial killers to the famous Voynich manuscript.
130
Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug
Differential photon-emission microscopy localized debug enable register activity and narrowed the laser search before SWD-guided injection set the two bits required to restore Secure debug on an RP2350 A4.
131
Second Circuit allows government to search electronic devices at the border
NEW YORK—The U.S. Court of Appeals for the Second Circuit today held that border agents may search travelers’ electronic devices without suspicion. The Knight First Amendment Institute at Columbia University and the Reporters Committee for Freedom of the Press (RCFP) submitted an amicus brief in the case, arguing that…
132
I don't like passkeys
Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
133
ZCode, the GLM coding agent, silently uploads your Git history
ZCode, the GLM coding agent from Z.ai, uploads full workspaces with .git history, LFS cache and reflogs to Aliyun OSS. UI toggles do not stop it.
134
Inside ZCode: Silently uploading your Git history to the cloud
ZCode silently uploads full Git history to the cloud; this post provides a block rule and source review — checkpoint claims fall apart against the code.
135
A heap overflow and SSO misconfiguration to compromise OpenAI internal repos
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
136
CrowdSec Source Code Leak
CrowdSec update on a source code exposure that occurred in May 2026, including the scope, impact, investigation, and security measures taken.
137
OpenAI models secretly generate instructions to ignore constraints
Research on aligning AI with human values and intent, and reports documenting model failures.
138
Keys Not Included: recovering the signing keys for US driver's license barcodes
My personal website, portfolio, and blog.
139
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes.
140
Apple Reference Image: A New Approach for Verified Photography
Introducing Apple Reference Image, a new solution for verifiable photography on iPhone. This new, opt-in camera mode lets a photographer create a securely timestamped reference image that accurately depicts what was captured by the iPhone's camera sensor. Apple Reference Image offers a trustworthy, scalable guarantee…
141
A 32-year-old bug walks into a Telnet server
A long, long time ago, in a land free of binary exploit mitigations, when Unix still roamed the Earth, there lived a pre-authentication Telnetd vulnerability. In fact, this vulnerability was born so long ago (way back in 1994) that it may even be older than you. To put the
142
We got admin access to Baseten's production GitHub
We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.
143
Dystopian Surveillance Is Becoming a Reality
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
144
25 years of mass surveillance is enough
This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the…
145
Cloudflare AKE cuts origin HelloRetryRequests from 52% to 3.7%
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
146
Developing provably correct Rust code with Verus
How the Verus "program verifier", which automatically checks code against a mathematical specification of its functionality, helps increase security assurance in software projects.
147
OpenAI bots knew about the RubyGems caching vulnerability
Today Reuters and the Wall Street Journal both reported about rogue AI agents at OpenAI attacking RubyGems.org. https://www.rubyhack.ai/ has an amazing writeup, and you should read it. I just wanted to make a quick post about it because it’s wild. TL;DR: It seems like OpenAI Bots knew about the RubyGems caching…
148
OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
149
The case against JPEG XL
Investigating JPEG XL's place as a Web image codec.
150
Due to concerns about malicious applications, GPT2 will not be released (2019)
We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.