The latest blog posts to take off on Hacker News. 617 posts.
Today, the Colorado Supreme Court became the first state supreme court in the country to address the constitutionality of a keyword warrant—a digital dragnet tool that allows law enforcement to identify everyone who searched the internet for a specific term or phrase. In a weak and ultimately...
One of the oldest malware tricks in the book — hacked websites claiming visitors need to update their Web browser before they can view any content — has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their malware from…
Learn what GPT-4 Vision Prompt Injection is, and discover effective strategies to protect your models and data from vulnerabilities.
Amir Golestan , the 40-year-old CEO of the Charleston, S.C. based technology company Micfo LLC , has been sentenced to five years in prison for wire fraud. Golestan’s sentencing comes nearly two years after he pleaded guilty to using an elaborate network of phony companies to secure more than 735,000 Internet Protocol…
We have come to a point where end-to-end encrypting all your private data and private communications
Stanford Center for Internet and Society2023119 points147 commentscited by 3Society, Policy & Culture details
Recently, Wired reported on documents leaked in May from the Council of the European Union’s ongoing deliberations over the draft Child Sex Abuse Regulation. The proposal is controversial because, as presently written, it would require online service providers to proactively scan their services – including users’…
We trust companies with our information every day. But many companies—even those that hold our most revealing information—are using it not just to provide the services we ask for, but to amp up their profits at the cost of our privacy.That's why EFF has joined a campaign, led by the U.S. Public...
The European Commission wants to turn digital communication apps, such as WhatsApp, iMessage, Instagram, TikTok and X, into mass surveillance tools so that digital communications of all EU citizens, including their live conversations, photos and videos, can be automatically scanned for criminal offences.[1] Even of…
GPT4-V is the new mode of GPT-4 that allows you to upload images as part of your conversations. It’s absolutely brilliant. It also provides a whole new set of vectors …
an unsurprising admission in Conservancy v. Vizio
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
The proposal of the European Commission for a regulation on preventing and combatting the sexual abuse and sexual exploitation of children is currently discussed in Dutch parliament. I recently wrote about some concerns and the risk of a DDoS attack . It turns out it is also possible to taint the database of images of…
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in…
There’s a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A…
Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.
On the 11th of October, Dutch parliament organized a hearing on the EU “Chatcontrol” proposal, with a focus on client side scanning. Dutch parliament had earlier passed two motions calling on the Dutch government not to support this proposal, but our government has declared it will ignore those motions. This hearing…
In 2017, Slack launched a popular Google Drive integration that makes it easy to embed, share, and get notified about new items added to Google Drive, including files, images, docs, and more. We use it daily here at Kapwing, an online video editing startup, since we run internally on top
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
HAProxy products are unaffected by CVE-2023-44487, which could allow a DoS attack against web servers, reverse proxies, and more. Stay tuned for updates.
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
Google Cloud stopped the largest known DDoS attack to date, which exploited HTTP/2 stream multiplexing using the new “Rapid Reset” technique.
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
The “HTTP/2 Rapid Reset” attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric DDoS attacks. Cloudflare has mitigated a barrage of these attacks in recent months, including an attack three times larger than any previous attack we’ve observed
Learn how the new DDoS attack technique Rapid Reset works, and how to mitigate it
Now that we’ve eliminated CAPTCHAs at Cloudflare, we want to hasten the demise of CAPTCHAs across the internet. We’re thrilled to announce that Turnstile is generally available, and Turnstile’s ‘Managed’ mode is now completely free to everyone for unlimited use.
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide mo...
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
