4231
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,337 posts.
4232
Massive Twitter Cross-Site Scripting Vulnerability
I bet 10 years ago none of us thought that 140 characters would change the landscape of Social Media quite so much. However, with close to 289,000,000 active users sending around 6,000 tweets every second Twitter has proven its critics wrong. Obviously, having gotten over …
4233
4234
Arbitrary code execution via ldd utility
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
4235
Schneier on Security: Technology Shouldn't Give Big Brother a Head Start
China is the world’s most successful Internet censor. While the Great Firewall of China isn’t perfect, it effectively limits information flowing in and out of the country. But now the Chinese government is taking things one step further. Under a requirement taking effect soon, every computer sold in China will have to…
4236
Linux being secure is a common misconception
Linux being secure is a common misconception in the security and privacy realm. Linux is thought to be secure primarily because of its source model, popular usage in servers, small userbase and confusion about its security features. This article is intended to debunk these misunderstandings by demonstrating the lack…
4237
Input type="password" Needs to Grow Up
Thoughts and musings of Dennis Forbes, expert software developer/architect and AI engineer
4238
PDF exploit in iOS 4
Link to: http://www.loopinsight.com/2010/08/01/jailbreakme-returns-offers-jailbreak-for-iphone-4-and-ipad/
4239
4240
Android security model is inadequate, and it needs a firewall
I have an Android phone, and while it’s good that Android does have some sandboxing, permissions and security against rogue apps, I’m not very happy with the security model and how it a…
4241
Schneier on UAE to Ban BlackBerrys
The United Arab Emirates—Dubai, etc.—is threatening to ban BlackBerrys because they can’t eavesdrop on them. At the heart of the battle is access to the data transmitted by BlackBerrys. RIM processes the information through a handful of secure Network Operations Centers around the world, meaning that most governments…
4242
Tempest: Transmit Radio Waves via a PC Video Card with No Extra Hardware
the quality of the music is not exactly what you are used to :-) but at least it works!
4243
Schneier on Filming the Police
In at least three U.S. states, it is illegal to film an active duty policeman: The legal justification for arresting the “shooter” rests on existing wiretapping or eavesdropping laws, with statutes against obstructing law enforcement sometimes cited. Illinois, Massachusetts, and Maryland are among the 12 states in…
4244
Firesheep, a day later
Most importantly, I certainly never expected there would be this much attention all at once, and within the first 24 hours.
4245
Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook
In the past few years it has become common for site owners to run 3rd party tools on their site. A good example would be Wordpress or other ...
4246
Protect Your Site with a Blackhole for Bad Bots
Tutorial shows how to setup a blackhole bot trap using PHP in just a few easy steps.
4247
4248
4249
Bcrypt is now obsolete
I am speaking today at BSDCan'09 about my work on the scrypt key derivation function. In the context of hardware brute-force attacks, scrypt is thousands of times more secure than existing "best practice" solutions such as bcrypt and PBKDF2; in fact, under reasonable assumptions it is provably as strong as possible…
4250
4251
4252
4253
4254
Tracking Down a Stolen iPhone
( Note: some screenshots are quite obviously simulated. ) ( Note 2: this is my first blog post in over three years, feel free to read my ancient history if you like. ) ( Note 3: All said and done, the comments and Internet-fame have been awesome. I'm moving on though. If you're interested, check…
4255
4256
4257
Public key pinning coming in Chrome 13
Starting with Chrome 13, we'll have HTTPS pins for most Google properties. This means that certificate chains for, say, https://www.google.com , must include a whitelisted public key. It's a fatal error otherwise. Credit goes to my colleague, Chris Evans, for much of this.
4258
4259
4260
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.