2461
New
The latest blog posts to take off on Hacker News. 8,770 posts.
2462
Curl audit: How a joke led to significant findings
In fall 2022, Trail of Bits audited cURL, a widely-used command-line utility that transfers data between a server and supports various protocols. The project coincided with a Trail of Bits maker week, which meant that we had more manpower than we usually do, allowing us to take a nonstandard approach to the […]
2463
Cloudflare mitigates record-breaking 71M request-per-second DDoS attack
This was a weekend of record-breaking DDoS attacks. Over the weekend, Cloudflare detected and mitigated dozens of hyper-volumetric DDoS attacks. The majority of attacks peaked in the ballpark of 50-70 million requests per second (rps) with the largest exceeding 71 million rps
2464
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…
2465
The retaliation: Pranking my roommate with targeted Facebook ads (2014)
Ghost Influence by Brian Swichkow2023335 points75 commentscited by 37Society, Policy & Culture details
This is the chronicle of the most epic retaliation and how I pranked my roommate with targeted Facebook Ads to the point of complete paranoia and delusion.
2466
How to get a heart attack while using JEB decompiler (2022)
Finding RCE during deobfuscation in JEB decompiler running on Java 18.
2467
2468
The Online Safety Bill: An attack on encryption
The Online Safety Bill has some genuinely good intentions, but the proposed legislation is remarkably poor.
2469
OpenSSH Pre-Auth Double Free – Writeup and Proof-of-Concept
Understanding the OpenSSH CVE-2023-25136 high vulnerability. Read our analysis with Proof-of-Concept, learn what's vulnerable, and discover remediations.
2470
Can sanitizers find the two bugs I wrote in C++?
A few days ago I published a short post about two bugs I wrote while developing the C++ external scanner for my TLA⁺ tree-sitter grammar. Reactions were mixed! Many people were supportive, but there were of course the usual drive-by claims by developers that the bugs were trivial, they would’ve found & fixed them…
2471
2472
Hardware trojans under a microscope (2022)
Table of Contents
2473
Voice.ai: GPL Violations with a Side of DRM
the one good use of copyright is prying things open
2474
Weakening TLS protection, South Korean style
TLS protocol is fundamental to internet security. All South Korean security applications add their own “trusted” Certificate Authorities however, weakening this protocol severely.
2475
Finland’s most-wanted hacker nabbed in France
Julius “Zeekill” Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding…
2476
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
2477
Reverse-Engineering YouTube: Revisited
Back in 2017 I wrote an article in which I attempted to explain how YouTube works under the hood, how it serves streams to the client, and also how you can exploit that knowledge to download videos from the site. The primary goal of that write-up was to…
2478
Want anonymity? Make a persona not a mystery
Derek Sivers official site. Thoughts on philosophy, culture, self-improvement. Author of Useful Not True, How to Live, Hell Yeah or No, Anything You Want.
2479
Reversing UK mobile rail tickets
The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...
2480
Against risk-based authentication (or, why I wouldn't trust Google Cloud)
If you were deciding on whether to use AWS, Azure or Google Cloud for a production application, what factors would you use to make the decision? There are probably many such factors you might think of, but I'd like to point out one that probably isn't commonly considered: the relative trustworthiness of Google's…
2481
Stop the proposal on mass surveillance of the EU
The European Commission is currently in the process of enacting a law called Chat control. If the law goes into effect, it will mean that all EU citizens' communications will be monitored and listened to.
2482
Google's OSS-Fuzz expands fuzz-reward program
Posted by Oliver Chang, OSS-Fuzz team Since launching in 2016 , Google's free OSS-Fuzz code testing service has helped get over 8800 vul...
2483
Ronin 2.0 – open-source Ruby toolkit for security research and development
After nearly a full year of non-stop development since the initial announcement of The Big Refactor , 4153 commits made, 700 issues closed , and a month of beta testing, Ronin 2.0.0 has finally been released!
2484
A novel PayPal scam
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
2485
Data-Free Disneyland
(Note: This is the companion post to my article at Public Books about evading data detection at Disneyland. For the…
2486
Operation Luigi: How I hacked my friend without her noticing (2017)
My friend gave me permission to hack her, here's how I did it and how to stop it happening to you.
2487
EU chat control law will ban open source operating systems
Update: Open source OSes might be saved from being covered depending on the interpretation of EU regulation 2019/1150 2.2.c.
2488
Modernizing C arrays for greater memory safety: a case study in the Linux kernel
How to modernize C arrays for greater memory safety: a case-study in refactoring the Linux kernel and a look to the future Kees Cook C i...
2489
How likely is losing a Google account?
Let's say you use a Google account as the root of your online identity: Gmail, Fi, "Sign in with Google", Google's password manager, etc. How much should you be worried that you'll suddenly find yourself unable to get into everything? Should you do something else instead? To get a sense of how common lockouts are and…
2490
UK Online Safety Bill threatens encryption, secure communication, and reporting
Does the image above, depicting the rescue of a child who attempted to reach the U.K. by sea, present the act of immigration in “a positive light”? It’s an absurd question, of course. It’s journalism – an effort to convey in visual terms the stark truth that tens of thousands of migrants and asylum-seekers try to…