The latest blog posts to take off on Hacker News. 8,770 posts.
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
HAProxy products are unaffected by CVE-2023-44487, which could allow a DoS attack against web servers, reverse proxies, and more. Stay tuned for updates.
Google is making it even easier to get started with passkeys by offering the ability to set them up for all users — by default.
Google Cloud stopped the largest known DDoS attack to date, which exploited HTTP/2 stream multiplexing using the new “Rapid Reset” technique.
This post dives into the details of the HTTP/2 protocol, the feature that attackers exploited to generate the massive Rapid Reset attacks
The “HTTP/2 Rapid Reset” attack exploits a weakness in the HTTP/2 protocol to generate enormous, hyper-volumetric DDoS attacks. Cloudflare has mitigated a barrage of these attacks in recent months, including an attack three times larger than any previous attack we’ve observed
Learn how the new DDoS attack technique Rapid Reset works, and how to mitigate it
Now that we’ve eliminated CAPTCHAs at Cloudflare, we want to hasten the demise of CAPTCHAs across the internet. We’re thrilled to announce that Turnstile is generally available, and Turnstile’s ‘Managed’ mode is now completely free to everyone for unlimited use.
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone, and when should you upgrade?
-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide mo...
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
On 4 October 2023, Cloudflare experienced DNS resolution problems. Some users may have received SERVFAIL DNS responses to valid queries. In this blog, we’re going to talk about what the failure was, why it occurred, and what we’re doing to make sure this doesn’t happen again
[Sidney Harris cartoon used with permission. Copyright holder: ScienceCartoonsPlus.com .]
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
Years ago, I was active in the iOS tweak development scene. I made many products and tools, distributed on Cydia, that modified iOS system behavior and added new functionality to SpringBoard. This was a really fun time, and gave me valuable early career exposure to reverse engineering closed-source binaries…
ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.
The first in a series of posts on the Post Office Horizon prosecutions scandal
We're excited to announce a contribution to improving privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans.
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
One of the great thing about C are the many fairly mature tools in the ecosystem. The bad news however is that most educational materials don't teach them and thus many beginners (and sometimes even experienced) developers have absolutely no awareness that these tools even exists.
sysclean(8) is a system tool designed for help system administrator to keep their OpenBSD clean after upgrade.
On the Side-Channel Implications of Hardware-Based Graphical Data Compression
The firewall bug in macOS 14 Sonoma betas and release candidates that we blogged about last week has been fixed by Apple.
Last December, we attended and reported on oral argument before the 9th Circuit Court of Appeals in a case in which the Transportation Security Administration (TSA) argued that TSA checkpoint staff have absolute immunity from lawsuits for assault, even sexual assault or rape, committed against travelers they are…
the quality of the music is not exactly what you are used to :-) but at least it works!
The first time it happened, I was writing a paper. The paragraphs I had just typed vanished into thin air, faster than Time Machine or Backblaze could save them. Gone. The next occurrence was during app development; Xcode suddenly flagged numerous errors in previously error-free code. My recent changes to several…
Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …
Last week Google’s Threat Analysis Group (TAG), in partnership with The Citizen Lab, discovered an in-the-wild 0-day exploit chain for iPhones. Developed by the commerci…
