1
Everyone knows your location: tracking myself down through in-app ads
How I tracked myself down using leaked location data in the in-app ads, and what I found along the way.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 371 posts.
2
How I bypassed Amazon's Kindle web DRM
As it turns out they don't actually want you to do this (and have some interesting ways to stop you)
3
Teen on Musk's DOGE team graduated from 'The Com'
Wired reported this week that a 19-year-old working for Elon Musk ‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so…
4
Leaking the email of any YouTube user for $10k
What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel
5
It is no longer safe to move our governments and societies to US clouds
The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet…
6
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
7
Everyone knows all the apps on your phone
Until a few years ago, any app you installed on an Android device could see all other apps on your phone without your permission.
8
How to gain code execution on hundreds of millions of people and popular apps
how to gain code execution on millions of people and hundreds of popular apps
9
ChatControl: EU wants to scan all private messages, even in encrypted apps
The EU is pushing legislation that would scan all our private messages, even in encrypted apps.
10
I use zip bombs to protect my server
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bo
11
That Secret Service SIM farm story is bogus
It's just normal crime
12
Bypassing Google's big anti-adblock update
Hello, I'm Derin!
13
DOGE worker’s code supports NLRB whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code…
14
I won't connect my dishwasher to your cloud
This weekend I had to buy a new dishwasher because our old GE died. I bought a Bosch 500 series because that's what Consumer Reports recommended, and more importantly, I could find one in stock. After my dad and I got it installed, I went to run a rinse cycle, only to find that that, along with features like delayed…
15
Mastercard DNS error went unnoticed for years
The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to…
16
Emailing a one-time code is worse than passwords
where my words occasionally escape /dev/null
17
YouTube's new anti-adblock measures
How I wrote filter rules for YouTube
18
I almost got hacked by a 'job interview'
I was 30 seconds away from running malware, Here's how a sophisticated scam operation almost got me, and why every developer needs to read this.
19
Have I Been Pwned 2.0
This has been a very long time coming, but finally, after a marathon effort, the brand new Have I Been Pwned website is now live! Feb last year is when I made the first commit to the public repo for the rebranded service, and we soft-launched the new brand
20
Root shell on a credit card terminal
In this project, I started to reverse engineer payment card terminals because they seemed to be an interesting target for security research, given the high stakes involved. Although I initially didn’t know much about this industry, I did expect a ton of security features and a very security-hardened device. And to…
21
Why are anime catgirls blocking my access to the Linux kernel?
Hey… quick question, why are anime catgirls blocking my access to the Linux kernel?
22
Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files
Update: This post received a large amount of attention on Hacker News — see the discussion thread.
23
Whistleblower: DOGE Siphoned NLRB Case Data
A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk ‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB…
24
A German ISP changed their DNS to block my website
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.
25
Technical analysis of the Signal clone used by Trump officials
💡Update May 3, 2025: I have posted a follow-up, Here's the source code for the unofficial Signal app used by Trump officials. Update May 4, 2025: Another followup, and a big one: The Signal Clone the Trump Admin Uses Was Hacked Update May 6, 2025: I've written
26
Smuggling arbitrary data through an emoji
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji.
27
The privacy nightmare of browser fingerprinting
If you were worried about tracking cookies, you really don’t want to know about browser fingerprinting.
28
The “S” in MCP Stands for Security
Spoiler: it doesn’t. But it should.
29
Nepenthes is a tarpit to catch AI web crawlers
Making web crawlers eat shit since 2023
30
Supreme Court's ruling practically wipes out free speech for sex writing online
Am I now committing civil disobedience... just by keeping my personal literary website up as is?