The latest blog posts to take off on Hacker News. 8,770 posts.
After a year-long inquiry, the EU Ombudsman recommends that the European Commission should monitor stages of progress in every Big Tech case that the Irish Data Protection Commission is responsible for.
Almost 2 years on from the last time I wrote about QWACs, I'm sadly not here to tell you that things have gone well since then. In fact, I'm actually here to tell you that things are not going well at all... QWAC Back in Jan 2022, I
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
CT scans of counterfeit AirPods Pro and MagSafe chargers reveal pouch cell batteries in circular cavities, internal weights, and a fake ground pin.
On an episode of Postgres FM , the hosts had a (very brief) discussion of data encryption in PostgreSQL. While Postgres FM is a podcast well worth a subscribe, the hosts aren’t data security experts, and so as someone who builds a queryable database encryption system , I found the coverage to be somewhat… lacking. I…
I'm organizing a boycott of Apple's Feedback Assistant , starting immediately, and I encourage all Apple developers to join me. Here's how I propose that each of us can effectively participate in the boycott and let Apple know that we're boycotting Feedback Assistant:
Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today’s Part II, we’ll examine clues about the real-life identity of “ Fearlless ,” the nickname…
Prossimo is pleased to announce the first stable release of sudo-rs, our Rust rewrite of the critical sudo utility. The sudo utility is one of the most common ways for engineers to cross the privilege boundary between user and administrative accounts in the ubiquitous Linux operating system. As such, its security is…
FOR IMMEDIATE RELEASE: 10/30/2023 CONTACT: Phillip Suderman, psuderman@ij.org, (850) 376-4110 ARLINGTON, VA.—Today, the 4th U.S. Circuit Court of Appeals unanimously ruled in favor of Matthew Gibson […]
The Pixel 8 hardware ( Tensor G3 ) supports the ARM Memory Tagging Extension (MTE) , and software support is available both in Android userspace and the Linux kernel. This feature is a powerful defense against linear buffer overflows and many types of use-after-free flaws. I’m extremely happy to see this hardware…
We’re piloting an experimental Android WebView Media Integrity API with select embedded media providers early next year.
The proposed EU Digital Identity framework (eIDAS) aims to meddle with the process around internet certificates and will undermine the independence and security assurances of the basis for website security:
Det europeiske personvernrådet har nå bestemt at det norske forbudet mot adferdsbasert markedsføring på Facebook og Instagram skal bli permanent og utvides til å gjelde hele EU/EØS.
Short answer: Practically-speaking, probably not.
Today, we’re announcing new requirements for bulk senders that will help keep Gmail safer and more spam-free.
Recently, YouTube has been ramping up its anti-adblock effort, and I’ve been watching this closely. This blog post is where I write down what I know. Some...
It's annual Wii U exploit time! 😄 Image of the Wii U connection test screen on the GamePad. After reverse engineering parts of the Wii Us' ...
How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules.
This week, the European Parliament's negotiators reached a broad majority agreement on a common position concerning the controversial EU chat control bill. The Commission’s bill proposes bulk scanning and reporting of private messages for allegedly suspicious content by using error-prone algorithms,
After 28 years, SSLv2 is still not gone from the internet... but we're getting there, Author: Jan Kopriva
Supply chain security is a hot topic today, but it is a very old problem. In October 1983, 40 years ago this week, Ken Thompson chose supply chain security as the topic for his Turing award lecture, although the specific term wasn’t used back then. (The field of computer science was still young and small enough that…
Big Brother meets Big Data
OAuth Account Takeover. Salt Labs shows how hackers could abuse OAuth to take over millions of accounts on Grammarly, Vidio, and Bukalapak.
An overview of containers and seccomp as sandboxing primitives
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
Cascade is a RISC-V CPU fuzzer that generates valid , long and complex programs, and relies on a termination cascade-effect for bug detection. It detected 37 new bugs (29 new CVEs) in 5 RISC-V CPUs, which is more than all the existing fuzzers, combined. You can read a paper we wrote on Cascade here and try it out here…
The EU Regulation to Prevent and Combat Child Sexual Abuse, first published in May 2022, has become the "most criticized law of all time". Here's how to stop it now!
