Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
There are a couple of issues with OpenSSL’s BIO_*printf() functions, defined in crypto/bio/b_print.c, that are set to be fixed in the forthcoming security release. The function that is primar…
This little script stops attacks on the first SSH connection to a new VM, even on providers (like Hetzner Cloud ) that don't offer a proprietary solution ; we only need cloud-init , which is widely supported .
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Continuing the Chrome extension hacking (see part 1 and 2), this time I'd like to draw you attention to the oh-so-popular AdBlock extension. It has over a million users, is being actively maintained and is a piece of a great software (heck, even I use it!). However - due to how Chrome extensions work in general it is…
No organization has fully implemented zero trust architecture. Many advocates, including the US government, overlook devices as a key BeyondCorp component.
Find bugs faster with ScanSearch. Discover forgotten assets, shadow IT, and expanded attack surfaces for bug bounty hunting.
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.
how to hide juicy data in plain sight
Over the past six months, “fans” of this Web site and its author have shown their affection in some curious ways. One called in a phony hostage situation that resulted in a dozen heavily armed police surrounding my home . Another opened a $20,000 new line of credit in my name. Others sent more than $1,000 in bogus…
My list of “Probably Are Gonna Need It” security features for your web app – things that you should build up-front, not wait until you need them (when it’s already too late).
Craig Gentry on board the mothership. (credit) A couple of weeks ago I polled readers for the subjects that they were interested in. You gave me some excellent responses, and I promise they’r…
David Schütz's bug bounty writeups
Lineage OS is based on the Android Open-Source Project, whose primary maintainer is Google. To what extent can it be considered Google-free?
Cybersecurity is hard enough. Doing it across federal agencies is a mammoth task.
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your…
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
Robert O'Callahan. Christian. Kiwi. Software guy. All content human-authored unless otherwise noted.
Why the Sanitizer API is just <code>setHTML()</code>
Sometimes, you don’t necessarily need to hack a system to exploit it.
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.
“Sunburst” was the most sophisticated hack the world has ever seen. One of the most urgent lessons so far learned from the attack: we need…
Mozilla forcing llm features and providing no gui for users to disable them
