4171
Mitigations are attack surface, too
Posted by Jann Horn, Project ZeroIntroductionThis blog post discusses a bug leading to memory cor...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,441 posts.
4172
Google Cloud to acquire Mandiant for $5.4B
MOUNTAIN VIEW, Calif. (March 8, 2022)—Google LLC today announced that it has signed a definitive agreement to acquire Mandiant, Inc., a leader in dynamic cyber defense and response, for $23.00 per share, in an all-cash transaction valued at approximately $5.4 billion, inclusive of Mandiant’s net cash. Upon the close…
4173
4174
Vulnerabilities in the TPM 2.0 reference implementation code
In this blog post we discuss the details of two vulnerabilities we discovered in the Trusted Platform Module (TPM) 2.0 reference implementation code. These two vulnerabilities, an out-of-bounds write (CVE-2023-1017) and an out-of-bounds read (CVE-2023-1018), affected several TPM 2.0 software implementations (such as…
4175
EFF Year in Review: Google's Corporate Paternalism in the Browser
It’s a big year for the oozing creep of corporate paternalism and ad-tracking technology online. Google and its subsidiary companies have tightened their grips on the throat of internet innovation, all while employing the now familiar tactic of marketing these things as beneficial for users. Here...
4176
A few of my favourite things about the OpenBSD Packet Filter tools
Guest Post: How to use PF features and tools.
4177
Where did all the “reject” buttons come from?
More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where did this trend come from?
4178
Can I remove my personal data from GenAI training datasets?
Short answer: Practically-speaking, probably not.
4179
4180
How Cloudflare responded to the “Copy Fail” Linux vulnerability
When a critical Linux kernel privilege escalation was publicly disclosed, Cloudflare's security and engineering teams detected, investigated, and mitigated the threat across our global fleet, confirming zero customer impact and no malicious exploitation.
4181
4182
Don't Panic: Seeking Points of Agreement on the “Going Dark” Debate
Don't Panic: Seeking Points of Agreement on the
4183
Most dating apps sell and share users' personal data
Privacy Not Included was launched in 2017 to help you understand the privacy risks of tech products that connect to the internet. We are continuing that work in the form of Product Reviews at our magazine Nothing Personal, where our privacy experts do hours of hands-on testing and research on the most popular consumer…
4184
An investigation into Apple’s new Relay network
Guest Post: Analysing Apple Private Relay’s effects on the Internet and future measurement-based research.
4185
4186
4187
Quad9 DOH HTTP/1.1 Retirement, December 15, 2025
A public and free DNS service for a better security and privacy
4188
There are too many damn honeypots
VulnCheck faces a horde of honeypots while assessing the potential impact of Atlassian Confluence's CVE-2023-22527. This blog delves into Shodan queries to filter out honeypots and uncover the actual on-premise Confluence install base.
4189
California’s DNA Law Violates Privacy Protections Guaranteed by State
San Francisco—Californians who’ve merely been arrested and not charged, much less convicted of a crime, have a right to privacy when it comes to their genetic material, EFF said in an amicus brief filed Nov. 13 with the state’s highest court. EFF is urging the California Supreme Court to hold that...
4190
4191
The harmful consequences of the robustness principle
The robustness principle, often phrased as "be conservative in what you send, and liberal in what you accept", has long guided the design and implementation of Internet protocols. The posture this statement advocates promotes interoperability in the short term, but can negatively affect the protocol ecosystem over…
4192
Letting users block injected third-party DLLs in Firefox
Users can now block poorly behaving third-party DLLs in Firefox to improve stability and performance.
4193
Building a backdoor with Node.js
A backdoor in our code that can perform OS injection is a considerable threat.
4194
Fuzzing FFmpeg for fun and profit
One of the great things about having rack-space in our new office is that we can now support open source projects using our equipment such as FFmpeg and Libav. They are critical parts of our software as well as underpin much of multimedia processing in the world today.
4195
Viking Horde: A New Type of Android Malware on Google Play
Viking Horde Android malware conducts ad fraud, but can also be used for other attack purposes such as DDoS attacks, spam messages, and more.
4196
Windows Hello face recognition is vulnerable to the Jedi mind trick
Practical development throughout the evolution of Windows.
4197
Using bubblewrap to add sandboxing to NetBSD
As of the time of writing, there is no real sandboxing technique available to NetBSD. There is chroot , which can be considered a weak sandbox because it modifies the root directory of the process, effectively restricting the process' view of the file system, but it doesn't isolate anything else, so all networking…
4198
OpenSSL Heartbleed Security Update
Yesterday the OpenSSL Project released an update to address the CVE-2014-0160 vulnerability, nicknamed “Heartbleed.” This serious vulnerability affects a..
4199
A Statement from The Tor Project on Software Integrity and Apple
The Tor Project exists to provide privacy and anonymity for millions of people, including human...
4200
Mozilla launches massive campaign on digital surveillance
Additional Perspectives from Mozilla: Mitchell Baker’s post, “Total Surveillance” Ben Adida’s post, “No User is an IslandR