1441
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,333 posts.
1442
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
Only a couple of months ago, I did a talk titled "The Responsibility of Disclosure: Playing Nice and Staying Out of Prison". The basic premise was to illustrate where folks finding security vulnerabilities often go wrong in their handling of the reporting, but I also wanted to show how organisations
1443
1444
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
1445
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
1446
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
1447
1448
Deleting System32\curl.exe
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
1449
NixOS and reproducible builds could have detected the xz backdoor
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...
1450
IPMI
I am making steady progress towards moving the Computers Are Bad enterprise cloud to its new home, here in New Mexico. One of the steps in this process is, of course, purchasing a new server... the current Big Iron is getting rather old (probably about a decade!) and here in town I'll have the rack space for more…
1451
The Vercel plugin on Claude Code wants to read your prompts
09 Apr 2026 The Vercel Plugin on Claude Code wants to read all your prompts!
1452
Apple curl security incident 12604
tldr: Apple thinks it is fine. I do not. On December 28 2023, bugreport 12604 was filed in the curl issue tracker. We get a lot issues filed most days so this fact alone was hardly anything out of the ordinary. We read the reports, investigate, ask follow-up questions to see what we can learn … Continue reading the…
1453
Drilling down on Uncle Sam's proposed TP-Link ban
The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems , a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China…
1454
More Mac malware from Google search
Follow a sponsored result in Google to a page in Medium that provides a Terminal command that you will live to regret. And what is Marek’s disease?
1455
Understanding and avoiding visually ambiguous characters in IDs
Designing a dictionary of visually unambiguous characters for IDs.
1456
An unwanted update to your Google Account
Google sent me an email informing me that they will change the country associated with my account in 30 days. I wanted to know why.
1457
PSA: SQLite WAL checksums fail silently and may lose data
SQLite WAL has checksums, but on corruption it drops all the data and does not raise error
1458
Why the Tor attack matters
Earlier today, Motherboard posted a court document filed in a prosecution against a Silk Road 2.0 user, indicating that the user had been de-anonymized on the Tor network thanks to research conduct…
1459
"<ESC>[31M"? ANSI Terminal security in 2023 and finding 10 CVEs
This paper reflects work done in late 2022 and 2023 to audit for vulnerabilities in terminal emulators, with a focus on open source software. The results of this work were 10 CVEs against terminal emulators that could result in Remote Code Execution (RCE), in addition various other bugs and hardening opportunities…
1460
Even the LastPass Will Be Stolen
How to obtain encryption keys to decrypt the LastPass vault in different scenarios
1461
Breaking Spotify DRM with PANDA
Disclaimer : Although I think DRM is both stupid and evil, I don't advocate pirating music. Therefore, this post will stop short of providi...
1462
My cat alerted me to a DDoS attack
A few years ago, my cat gave me my most memorable middle of the night software engineering incident. I was working at a startup, and we didn’t have a formal on-call rotation yet. That was a deliberate decision, since being on-call is painful, and the team was good about just collectively keeping an eye out for urgent…
1463
Digital signatures and how to avoid them
Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature on a messag…
1464
A pentester gets root - step by step example
DevOops is a retired machine on HackTheBox. This write-up is a walk through the methodology that leads to root shell.
1465
New Site Recovers Files Locked by Cryptolocker Ransomware
Until today, Microsoft Windows users who’ve been unfortunate enough to have the personal files on their computer encrypted and held for ransom by a nasty strain of malware called CryptoLocker have been faced with a tough choice: Pay cybercrooks a ransom of a few hundred to several thousand dollars to unlock the files…
1466
The case against JPEG XL
Investigating JPEG XL's place as a Web image codec.
1467
Misunderstanding about the details of how Apply Pay works
Apple Pay is great, but I think there is some misunderstanding out there about the details of how it works.
1468
The ‘Zelle fraud’ scam: how it works, how to fight back
One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that…
1469
Don't trust large context windows
I recently watched a video that put a name on something I'd been feeling. The author splits an LLM's context window into two zones. There's the smart zone , where the model is sharp, and the dumb zone , where attention drops off and the model starts forgetting what you told it five minutes ago. The cutoff sits…
1470
XZ Backdoor: Times, damned times, and scams
Some timezone observations on the recently discovered backdoor hidden in an xz tarball.