3601
On VBScript
Posted by Ivan Fratric, Google Project ZeroIntroductionVulnerabilities in the VBScript scripting ...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,441 posts.
3602
Nobody Cares About Security
Nobody cares about security. There. I said it. I said the thing everyone feels, some people think, but very few have the temerity to say out loud. But before you call me...
3603
Top-500 NPM package maintainers now require 2FA
Two-Factored Authentication (2FA) is now enforced for maintainers of the top-500 packages, by dependents, on the npm registry. To learn more about configuring 2FA, see Configuring two-factor authentication. To learn…
3604
About Gatekeeper
Today’s Mountain Lion announcement introduces an important new security feature, called Gatekeeper, in addition to the “sandboxing” feature that premiered in Lion. I’d like to talk a little bit about it, and why it’s important to all Mac users.
3605
iPhone and iPad approved to handle classified NATO information
Today, Apple announced iPhone and iPad are the first and only consumer devices in compliance with information assurance requirements of NATO nations.
3606
Judge to DOJ: Not All Writs
A federal magistrate judge in Brooklyn took an admirable stand last week when he questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act. That’s a general-purpose law passed in 1789 that allows a court to require third parties’ assistance to...
3607
Security vulnerabilities fixed in Firefox 72.0.1 and ESR 68.4.1
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw.
3608
Public hacker test on Swiss Post’s e-voting system
Die Post unterstützt mit ihren Dienstleistungen den Alltag der Menschen in der Schweiz, in der physischen und in der virtuellen Welt. Beim E-Voting digitalisiert sie, was sie bereits am besten kann: den sicheren Transport vertraulicher Informationen.
3609
Oblivious DNS: Plugging the Internet’s Biggest Privacy Hole
by Annie Edmundson, Paul Schmitt, Nick Feamster The recent news that Cloudflare is deploying their own DNS recursive resolver has once again raised hopes that users will enjoy improved privacy, since they can send DNS traffic encrypted to Cloudflare, rather than to their ISP. In this post, we explain why this approach…
3610
What every IT person needs to know about OpenBSD Part 3: That packet filter
Useful and fun features related to the OpenBSD packet filter.
3611
3612
Exploiting Android Messengers with WebRTC
Posted by Natalie Silvanovich, Project ZeroThis is a three-part series on exploiting messenger ap...
3613
Reliability via Automated Renewal Information
The Let’s Encrypt team is excited to announce that ACME Renewal Information (ARI) is live in production! ARI makes it possible for our subscribers to handle certificate revocation and renewal as easily and automatically as the process of getting a certificate in the first place. With ARI, Let’s Encrypt can signal to…
3614
Scientific notation bug in MySQL left AWS WAF vulnerable to SQL injection
We provide around-the-clock threat detection and incident response, backed by expert consulting to keep your organization secure.
3615
3616
Improving on Tor .onion Address Usability
Hello again, this blog post is the second issue of the Cooking with Onions series which aims to...
3617
Steps You Can Take Right Now Against Internet Surveillance
One of the trends we've seen is how, as the word of the NSA's spying has spread, more and more ordinary people want to know how (or if) they can defend themselves from surveillance online. But where to start? The bad news is: if you're being personally targeted by a powerful intelligence agency...
3618
French Constitutional Council Widely Approves Surveillance Law
Update (24 July 2015): The French Constitutional Council shows again its disregard for fundamental rights. This morning, after approving almost all dispositions in the Surveillance law, the Constitutional Council builds momentum by rejecting the Question Prioritaire de ConstitutionalitéThe QPC is a
3619
Modernizing Transport Security
Posted by David Benjamin, Chrome networking *Updated on October 17, 2018 with details about changes in other browsers TLS (Transport Lay...
3620
EFF Pries More Information on Zero Days from the Government
Until just last week, the U.S. government kept up the charade that its use of a stockpile of security vulnerabilities for hacking was a closely held secret.[fn]For what it's worth, the government denies having a “Raiders of the Lost Ark style” stockpile of zero days.[/fn] In fact, in response to...
3621
Lessons from the History of Attacks on Secure Hash Functions
This document is a work-in-progress. Please contact the author if you see errors or omissions. Most of the secure hash functions ever designed have turned out to be vulnerable to collision attacks.
3622
How to build your own public key infrastructure
A major part of securing a network as geographically diverse as CloudFlare’s is protecting data as it travels between datacenters. Customer data and logs are important to protect but so is all the control data that our applications use to communicate with each other.
3623
OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass
Last week, Intego researchers discovered new Mac malware, OSX/Linker, that attempts to leverage a recently disclosed zero-day flaw in macOS' Gatekeeper protection. Let's examine what we know about this latest Mac malware campaign. What is the back story? Before digging into the OSX/Linker malware, it would be helpful…
3624
Microsoft’s Revocation of the Verisign Class 3 Public Primary G5 Root Cert
Microsoft has rolled back the revocation of the Verisign Class 3 Public Primary Certification Authority - G5 Root Certificate.
3625
User Privacy Isn't Solely a Facebook Issue
During Congressional hearings about Facebook’s data practices in the wake of the Cambridge Analytica fiasco, Mark Zuckerberg drew an important distinction between what we expect from our Internet service providers (ISPs, such as Comcast or Verizon) as opposed to platforms like Facebook that operate...
3626
SSO should be table stakes
Withholding security for money feels a little gray-hat.
3627
Europe's Digital Sovereignty Paradox – "Chat Control" Update
Can you build tech independence while breaking encryption?
3628
Is regulated BGP security coming?
What impact would regulating BGP routing security have on the global Internet?
3629
METR Report on OpenAI / Hugging Face Hacking Incident
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
3630
