91
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
92
DOGE worker’s code supports NLRB whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code…
93
GitHub Source Code Leak
Straight talk on Canadian online privacy, open-source software, PIPEDA, browser extension security, and practical tools to protect your personal data.
94
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
95
Android may soon restrict on-device ADB
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.
96
Yahoo installed a backdoor for the NSA behind the back of the security team
[Update (12/14/16): Reuters has specified that the rootkit was implemented as a Linux kernel module. Wow.]
97
Mastercard DNS error went unnoticed for years
The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to…
98
Bill C-22, the Lawful Access Act: Dangerous backdoor surveillance risks remain
The decades-long battle over lawful access entered a new phase yesterday with the introduction of Bill C-22, the Lawful Access Act. This bill follows the attempt last spring to bury lawful access provisions in Bill C-2, a border measures bill that was the new government’s first piece of substantive legislation. The…
99
PIA VPN to be acquired by malware company founded by former Israeli spy
telegra.ph/private-internet-access-vpn-acquired-by-malware-business-founded-by-former-israeli-spies-12-0120191,004 points359 commentsSecurity & Privacy details
arccompute.com/blog The following article contains quotes and links meant to inform VPN consumers concerning the ownership, affiliations, and past business practices of Kape Technologies (formerly known as Crossrider) in light of their acquisition of Private Internet Access VPN. I'd like to start by giving credit…
100
How we recovered $300k of Bitcoin
Story time! Around twenty years ago, I was working as a reverse-engineer and cryptanalyst for AccessData while getting my Physics degree at BYU. It was the late 90s and early 2000s. The US governme…
101
102
Emailing a one-time code is worse than passwords
where my words occasionally escape /dev/null
103
YouTube's new anti-adblock measures
How I wrote filter rules for YouTube
104
Who’s behind the “reopen” domain surge?
The past few weeks have seen a large number of new domain registrations beginning with the word “reopen” and ending with U.S. city or state names. The largest number of them were created just hours after President Trump sent a series of all-caps tweets urging citizens to “liberate” themselves from new gun control…
105
106
I found 10k GitHub repositories distributing Trojan malware
This is the story of how I found 10,000 repositories on GitHub that distribute Trojan malware. They are all from different contributors, have different names, and are not forks of other repositories. But they share a common pattern, which is what allowed me to write a script to find
107
ChatGPT won't let you type until Cloudflare reads your React state
Edit April 2, 2026: I've been getting inbound interest from researchers wanting to run their own queries. The MCP integration I use for my own research lets you analyze live mobile telemetry continuously collected from real devices in the wild, directly from Claude. To access it reach out at
108
Man who thought opening a TXT file is fine thought wrong
data:blog.metaDescription
109
I'm reluctant to verify my identity or age for any online services
Identity verification and age verification is an increasinly common policy conversation at the moment, in numerous countries.
110
NSA, NIST, and post-quantum crypto: my second lawsuit against the US government
The Black Chamber was founded by the U.S. Army and the U.S. State Department in 1919. The Secretary of State terminated funding in 1929, famously writing that "Gentlemen do not read each other's mail."
111
Controlling the Taylor Swift Eras Tour wristbands with Flipper Zero
Many large concerts feature wristbands that light up on command. They are used to produce varied visual effects across a stadium. One compan...
112
Passkeys: A shattered dream
Firstyear's blog
113
I noticed some disturbing privacy defaults in Windows 10
Adventures in diy, electronics, programming, remote control and anything else.
114
25 years of mass surveillance is enough
This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the…
115
116
Google Chrome to remove detailed cookie and site data controls
A month ago I ran into an obscure Google Chrome bug on macOS that caused the "All cookies and site data" page in Chrome settings ( chrome://settings/siteData ) to load very slowly. You can see this page if you open Preferences, select "Privacy and security", "Cookies and other site data", and then "See all cookies and…
117
On Apple’s “Expanded Protections for Children” – A Personal Story
These efforts will evolve and expand over time. – Apple on their “Expanded Protections for Children” I am broke “non-liquid” right now. Normally, that sentence doesn&#…
118
119
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
120
Jailbreaking my car's navigation system just so I can change the time
I shouldn't have to be doing any of this, but at least it's fun.