The latest blog posts to take off on Hacker News. 617 posts.
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
On 4 October 2023, Cloudflare experienced DNS resolution problems. Some users may have received SERVFAIL DNS responses to valid queries. In this blog, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again
[Sidney Harris cartoon used with permission. Copyright holder: ScienceCartoonsPlus.com .]
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
Years ago, I was active in the iOS tweak development scene. I made many products and tools, distributed on Cydia, that modified iOS system behavior and added new functionality to SpringBoard. This was a really fun time, and gave me valuable early career exposure to reverse engineering closed-source binaries…
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
The first in a series of posts on the Post Office Horizon prosecutions scandal
We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
sysclean(8) is a system tool designed for help system administrator to keep their OpenBSD clean after upgrade.
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
the quality of the music is not exactly what you are used to :-) but at least it works!
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
Last week Google’s Threat Analysis Group (TAG), in partnership with The Citizen Lab, discovered an in-the-wild 0-day exploit chain for iPhones. Developed by the commerci…
Let’s say you’re on a fresh machine. Maybe you’ve just started a new job or you’ve wiped your machine. You’re about to push some code you’ve written and you get this: $ git push The authenticity of host 'github.com (140.82.121.4)' can't be established. ED25519 key fingerprint is…
Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar
On a Saturday night, a security engineer at Equifax was updating an SSL certificate on a Network Intrusion Detection System (NIDS). Immediately after, suspicious connections were detected. After a more in-depth investigation, it became evident that the situation was far graver than anticipated. A service had to be…
The U.K. Parliament has passed the Online Safety Bill (OSB), which says it will make the U.K. “the safest place” in the world to be online. In reality, the OSB will lead to a much more censored, locked-down internet for British users. The bill could empower the government to undermine not just the privacy and security…
Today we announce that we have completely removed all traces of disks being used by our VPN infrastructure!
For too long, web race condition attacks have focused on a tiny handful of scenarios. Their true potential has been masked thanks to tricky workflows, missing tooling, and simple network jitter hiding
The Signal Protocol is a set of cryptographic specifications that provides end-to-end encryption for private communications exchanged daily by billions of people around the world. After its publication in 2013, the Signal Protocol was adopted not only by Signal but well beyond. Technical informat...
Ten years ago, after it became clear to almost everyone that all our online activity was being tracked and stored, I wrote a blog post about simple steps a person could take to improve their privacy online .
And it's so much worse than you think
A weblog about Signals Intelligence, Communications Security and top level telecommunications equipment
