3811
Simple Linux kernel memory corruption bug can lead to complete system compromise
An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project ...
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
3812
ETS Isn't TLS and You Shouldn't Use It
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
3813
The Myth of Consumer-Grade Security
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that’s not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect…
3814
macOS's Little-Known Command-Line Sandboxing Tool (2025)
AVAILABLE NOW OpenAI, Anthropic, and Chrome ship it. Apple deprecated it. Nobody documented it. Until now. → sandbox-exec: The Miss...
3815
The time I hacked my high school
When I was in high school, I started the Chess Club. I needed money to buy chess sets and chess cl...
3816
A memory leak in Apple's Network Extension framework
Is it normal for the Little Snitch Network Extension to consume Gigabytes of memory? No it isn’t. Unfortunately that’s another new bug in the Network Extension framework of macOS. It’s a memory leak in Apple’s framework, which developers…
3817
3818
XSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
3819
Syscall Auditing at Scale
If you are are an engineer whose organization uses Linux in production, I have two quick questions for you: 1) How many unique outbound TCP connections have your servers made in the past hour? 2) Which processes and users initiated each of those connections? If you can answer both of these questions, fantastic! You…
3820
3821
3822
Stupid certificate tricks
Sometimes I do things for no real reasons other than “because I can” and/or “it amuses me”. For example, embedding a snarky message into my HTTPS certificate.
3823
HTTP security headers
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
3824
Important Allies Join the Fight Against NSA Internet Backbone Surveillance
Last week, the ACLU filed a welcome additional challenge to the NSA’s warrantless Internet backbone surveillance (aka “Upstream” surveillance) on behalf of Wikimedia and a number of other media and human rights organizations. We applaud all of those involved in bringing the case. It adds another...
3825
TSA considers new system for flyers without ID
According to a solicitation to potential contractors published last week, the Transportation Security Administration (TSA) wants to outsource its current questioning of airline passengers without ID , and its decisions about which travelers without ID to allow to travel and which to prevent from flying , to a…
3826
Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea
Disclaimer: Thoughts expressed here are my own, and not of my employers.
3827
Turn on MFA Before Crooks Do It for You
Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don’t take advantage of these added safeguards may find it far more difficult to regain access when their account gets…
3828
Los Angeles Cops Argue All Cars in LA Are Under Investigation
Do you drive a car in the greater Los Angeles Metropolitan area? According to the L.A. Police Department and L.A. Sheriff’s Department, your car is part of a vast criminal investigation. The agencies took a novel approach in the briefs they filed in EFF and the ACLU of Southern California’s...
3829
3830
Coordinated disclosure of XML roundtrip vulnerabilities in Go’s standard library
We have identified three independently exploitable vulnerabilities in Go's encoding/xml. Read more about their impact to Mattermost users.
3831
Exploitable vulnerabilities found in Kaspersky Anti-Virus
Posted by the notorious Tavis Ormandy.We’ve talked before about how we use Google scale to ...
3832
Hardening the Kernel in Android Oreo
News and insights on the Android platform, developer tools, and events.
3833
Beware of sudo on OS X
There's a little kerfuffle going on over on HN about a newly discovered local root exploit on OS X 10.10.5 , so I thought this might be a g...
3834
Promiscuous cookies and their impending death via the SameSite policy
Cookies like to get around. They have no scruples about where they go save for some basic constraints relating to the origin from which they were set. I mean have a think about it: If a website sets a cookie then you click a link to another page on that
3835
Building a Curve25519 Hardware Accelerator
Note: this post uses a $\LaTeX$ plugin to render math symbols. It may require a desktop browser for the full experience…
3836
3837
The Basics of Web Application Security
Security is both very important and often under-emphasized. While many targeted techniques help, there are some basic clean code habits which every developer can and should be doing
3838
EFF Sues to Invalidate FOSTA, an Unconstitutional Internet Censorship Law
We are asking a court to declare the Allow States and Victims to Fight Online Sex Trafficking Act of 2017 (“FOSTA”) unconstitutional and prevent it from being enforced. The law was written so poorly that it actually criminalizes a substantial amount of protected speech and, according to experts,...
3839
GitHub will require 2FA by the end of 2023
GitHub will require all users who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023.
3840
Exodus Bitcoin Wallet: $490k swindle
Edit: There’s a short follow-up to this post: Exodus Bitcoin Wallet: Follow up. tl;dr: A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time, and if nothing changes, it…