Every blog post that took off on Hacker News, ranked by the votes of its best submission. 4,335 posts.
I graduated with a Computer Science minor from the University of Virginia in 1992. The reason it’s a minor and not a major is because to major in CS at UVa you had to go through the Engineering School, and I was absolutely not cut out for that kind
I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...
On how the law was taken away from the people of Washington, DC by legal shenanigans
"This Is Not A Film" by Iranian director Jafar Panahi, who is under house arrest in his country for alleged “propaganda against the regime,” will be screened under the Free Jafar Panahi Program of the 13th Cinemanila. The film was smuggled from Iran in a Flash-Drive hidden inside a cake to Cannes for screening a few…
The United Parcel Service (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. “smishing”) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details…
Leading “threat intelligence” firms are creating fake online personas to gain access to every corner of the web.
Security and Programming Blog
13 Jan, 2016 The sponsorship of privacy and human rights conferences by corporations that erode our privacy and human rights is a clear conflict of interests that we must challenge. The revolution will not be sponsored by those we are revolting against.
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
Useful best practices for malware writers, courtesy of the CIA. Seems like a lot of good advice. General: DO obfuscate or encrypt all strings and configuration data that directly relate to tool functionality. Consideration should be made to also only de-obfuscating strings in-memory at the moment the data is needed…
Security Keys are (generally) USB-connected hardware fobs that are capable of key generation and oracle signing. Websites can “enroll” a security key by asking it to generate a public key bound to an “appId” (which is limited by the browser based on the site's origin). Later, when a user wants to log in, the website…
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><br><a href="http://brahmsyellowdots.blogspot.com/2008/10/it-begins.html">About This Blog</a>
When Microsoft 365 Copilot (M365 Copilot) was asked to summarize a specially crafted Microsoft Office document, an indirect prompt injection payload triggered the execution of arbitrary instructions to fetch sensitive tenant data, such as “recent emails” and hex encode the fetched output. M365 Copilot then generated a…
I managed to exploit the Nintendo DSi browser 15 years after it was released in Japan. This post will go over the journey and the technical details.
Hacking, hardware, software, and general curiosities of computing machinery! Docendo discumus.
It's no secret that authenticating into services is an unresolved topic. With time, we have managed
Some of the world’s largest Internet firms have taken steps to crack down on disinformation spread by QAnon conspiracy theorists and the hate-filled anonymous message board 8chan . But according to a California-based security researcher, those seeking to de-platform these communities may have overlooked a simple legal…
I've investigated hundreds of data breaches over the years (there are 514 of them in Have I Been Pwned [https://haveibeenpwned.com/] as I write this), and for the most part, the situation with Gab is just another day on the internet. But Gab is also different, having grown
This has to be the most infuriating bug report I've ever submitted. I went to type in my 2FA code on a website - but no numbers appeared on screen. Obviously, I was an idiot and had forgotten to press the NumLock button. D'oh! I toggled it on and typed again. No numbers appeared. I switched to another tab, my numbers…
Over the years of troubleshooting performance problems in the Unix/Linux world, I have seen multiple cases where a regularly used command line tool in a customer server just stops working for some reason. The tool just returns immediately, doing absolutely nothing. No output printed, no coredumps and the exit code is…
I keep getting a lot of private emails about my previous post about the latest status of the Linux kernel patches to resolve both the Meltdown and …
The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! In this article I am going to show you how to create an executable that runs arbitrary code if it's...
I get a lot of people popping up with data breaches for Have I been pwned [https://haveibeenpwned.com/] (HIBP). There’s an interesting story in that itself actually, one I must get around to writing in the future as folks come from all sorts of different backgrounds and offer
When Prohibition began, anti-alcohol crusaders demanded that the St. Louis Public Library burn every book that explained "the home production of alcohol for drinks". The librarian insisted on keeping the books but agreed to hide them from the "general public".
