211
Why Xen Wasn't Hit by RETBleed on Intel CPUs
An article explaining why Xen wasn't affected by the recent RETBleed security issue on Intel CPUs.
New
The latest blog posts to take off on Hacker News. 642 posts.
212
LastPass: Notice of Security Incident
Please refer to the latest article for updated information.nbs[..]
213
DuckDuckGo email protection beta now open
DuckDuckGo Email Protection is a free email forwarding service that removes multiple kinds of trackers and lets you create unique private email addresses.
214
SSH commit verification now supported
GitHub now supports SSH commit verification, so you can sign commits and tags locally using a self-generated SSH public key, which will give others confidence about the origin of a…
215
Class action against Oracle’s worldwide surveillance machine
Oracle claims to have amassed dossiers on 5 billion people, and generates $42.4 billion in annual revenue. ICCL's Dr Johnny Ryan is a lead plaintiff in a new U.S. class action to stop its global surveillance machine.
216
VS Code – What's the deal with the telemetry?
VS Code collects telemetry data to help understand Microsoft how to improve the product. Is it above board? Can I turn it off completely?
217
Your online identity is owned by your email provider (2019)
Your email provider owns your online identity by controlling your email address. You can’t port your email address to another provider as with phone numbers.
218
Should notes be end-to-end encrypted?
A comprehensive guide about the different types of encryption, the upsides and downsides, and how to make decisions about how much encryption you need for note-taking, passwords, or anything else.
219
Gmail will call the cops on you based on the content of your emails
Correction: An earlier draft of this story misstated a technical detail; Mark didn’t email his photo to his doctor; rather, he took the photo with his phone and the image was automatically synched to his Google Photos account, triggering a scan .
220
221
Why don’t we do email verification in reverse?
Just about everybody who has ever used a service on the web has experienced the following account creation follow:
222
Supabase Vault
Today we're announcing Vault, a Postgres extension for managing secrets and encryption inside your database.
223
See what JavaScript commands get injected through an in-app browser
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
224
But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1)
Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues. Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. One way to eliminate such memory safety issues is to use
225
PayPal phishing scam uses invoices sent via PayPal
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge. The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of…
226
227
Requiring MFA on popular gem maintainers
News and updates from the RubyGems team — releases, security advisories, and project announcements.
228
T-Mobile USA doesn't comply with its German parent company’s GDPR policies
The Practical Nomad: Edward Hasbrouck's blog
229
Impact to DigitalOcean customers resulting from Mailchimp security incident
Today, we wanted to share an update about how DigitalOcean and our customers were impacted by a recent security incident disclosed by Mailchimp.
230
Process behaviour anomaly detection using eBPF and unsupervised learning
Hello everybody, I hope you’ve been enjoying this summer after two years of Covid and lockdowns :D In this post I’m going to describe how to use eBPF syscall t…
231
Attacking Titan M with Only One Byte
Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.
232
233
234
I hacked my car
Note: As of 2022/10/25 the information in this series is slightly outdated. See Part 5 for more up to date information. The Car Last summer I bought a 2021 Hyundai Ioniq SEL. It is a nice fuel-efficient hybrid with a decent amount of features like wireless Android Auto/Apple CarPlay, wireless phone charging, heated…
235
NSA's Warrantless Wiretaps (2012)
ACKNOWLEDGMENTS I thank Kent Gladstone, Science Applications International Corporation (SAIC), for a critical reading of both manuscripts. Many critical comments and corrections from Brad Howard have made the Mini-Tutorial a better adventure for anyone who follows his path.
236
PyPI package 'secretslib' drops fileless Linux malware to mine Monero
Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.
237
Locking down your GitHub-hosted Domains
The other day someone claimed a hostname on a domain I own and it took me a while to track down how. Turns out it was via GitHub pages.
238
PGPP (Pretty Good Phone Privacy) Beta Launch
We are excited to announce that PGPP (Pretty Good Phone Privacy) is now in Beta.
239
Instagram can track anything you do on any website in their in-app browser
I work with U.S. law firms as a non-testifying technical consulting expert on matters involving the Apple platform and iOS apps. Learn more about my litigation consulting.
240
Review of /e/ – Android-based alternative for mobile phones
A review of the /e/ OS Android-alternative operating system for mobile devices, as used on the Teracube 2e smartphone.