Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was…
A few years ago when I was into reverse engineering and binary analysis (and game modding), I did a lot of research into anticheats work. I was curious about tracking their updates, since that would allow me to:
Who actually checks the permissions of applications they’re installing? A little while ago a Paypal update stalled because it required extra permissions. This is what happens if an app you have already installed wants more power. I was more than a little surprised with what I found.
[NOTE: See updates below and here .] I'm working on an application that requires a secure password hash. The state of the art is Colin Perc...
OK, rebuild bash and deploy Florian's unofficial patch or its now-upstream version now. If you're a distro maintainer, please consider doi...
I screwed up. Big time. Not just with Adblock Plus users but with the Mozilla community at large.
Before I got into reverse engineering, executables always seemed like black magic to me. I always wondered how stuff worked under the hood, and how binary code is represented inside .exe files, and how hard it is to modify this ‘compiled code’ without access to the original source code.
I am a big fan of my Kindle. This is the device I’d bring over to a desert island. I am also a fairly frequent user of the highlight feature where you can select a bit of text you like and save it. One thing is bothering me though: the lack of open API on the Kindle to retrieve the data about me. Amazon provides the…
The title kind of says it all. How do I know? Because of this photo : That's a picture of the logic board of an iPhone 5C, the same mod...
In the current version of macOS, Monterey, on every system update on a system containing an M1 chip, such as all the new shiny/fast ARM (“Apple Silicon”) macs, the update process phones home to Apple to obtain a special boot signature, known in Apple jargon as a “ticket”.
I found the creator of Rainbow Table's paper, aimed at cryptanalysts, was pretty inaccessible considering the simplicity and elegance of Rainbow Tables, so this is an overview of it for a layman.
Figure from our paper: given any waveform, we can modify it slightly to produce another (similar) waveform that transcribes as any different target phrase.
Much has been written about fuzzing compilers already, but there is not a lot that I could find about fuzzing compilers using more modern ...
Usual Mandatory Disclaimer: IANAC (I am not a cryptographer) so I might likely end up writing a bunch of mistakes in this blog post... ...
(.. Tactics, Techniques, and Procedures)
Let's talk about the "Windows Baseline Security Mode," too.
The following research outlines a vulnerability discovered in netmask npm package that is currently used by 278,722+ other projects. The vulnerability has been present for 9 years. Since this package is so incredibly widespread, I would suggest every nodejs developer to check their package.jsons to see if they use…
You receive a message. Now either you will be victim or not. Your knowledge, attention and moral compass will decide where you will end up.
The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven’t changed since 2009.
New paper: “Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust, by Yevgeniy Dodis, David Pointcheval, Sylvain Ruhault, Damien Vergnaud, and Daniel Wichs. Abstract: A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is…
An essential part of being able to say "I told you so" is in fact having told you so. Well, here we are. For those living under a rock (lucky
A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites.
I hadn't been paying much attention to the Google "Real Names" clusterfuck, because it was so obvious to me that they were going to lose this one in the press that it would all be over soon. But it's still not over, and the Google brass appear to be digging in their heels, despite the universally bad press they're…
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
New directive targets “anti-Christian,” “anti-American,” and “anti-capitalism” opinions
Web developer and cybersecurity researcher
