Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
The Chinese company in charge of handing out domain names ending in “ .top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that…
Everybody knows that the digital locks of DRM on the digital media you own is a big problem. If you’ve bought a digital book, album, or movie, you should be able to do what you want with it—whether that’s enjoying it wherever you want to, or making it more accessible by changing the font size or...
SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that…
What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report,
[…] with iCloud Drive, you can safely store all your presentations, spreadsheets, PDFs, images, and any other kind of document in iCloud. Then access them from your iPhone, iPad, iPod touch, Mac, or PC […]
Yep, Google removed the permissions list from Play Store, and we can no longer check the app permissions on it.
Posted by Fermin J. Serna, Staff Software Engineer, Matt Linton, Senior Security Engineer and Kevin Stadmeyer, Technical Program Manager O...
Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitati...
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
There’s a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A…
Zero tenant isolation, exposed military training data, and a five-month responsible disclosure timeline.
5th Edition of The Lie Behind the Lie Detector Released
We (along with researchers from Berkeley and Stanford) are co-authors on today’s paper led by Google Brain researchers, Concrete Problems in AI Safety. The paper explores many research problems around ensuring that modern machine learning systems operate as intended.
For the past eight months, Trail of Bits has worked with the Python Cryptographic Authority to build cryptography-x509-verification, a brand-new, pure-Rust implementation of the X.509 path validation algorithm that TLS and other encryption and authentication protocols are built on. Our implementation is fast…
Update with OpenAI response added What happened? On 29 May 2025 I privately reported a vulnerability to the OpenAI disclosure mailbox using an encrypted email. The flaw allows peeking at chat responses intended for other users. This content may contain personal data, confidential business plans, …
Container security is critical as companies use them more often for AI workloads and cloud workloads. Learn about 17 container security best practices here.
A few days ago, Peter Gramantik from our research team found a very interesting backdoor on a compromised site. This backdoor didn’t rely on the…
Google signed a definitive agreement to acquire Wiz. This deal will make it easier for companies to protect themselves across major clouds.
An update on what we're doing to protect people from scraping data on Facebook and Instagram.
Once upon a time, loading common scripts & styles from a public CDN like cdnjs or Google's Hosted Libraries was a 'best practice' - a great way to instantly...
You may be concerned that the NSA is reading your e-mail. Is there really anything you can do about it though? After all, you don’t really want to move off of GMail / Google Apps. And no plac…
Entropic Engineering was approached in January ‘24 by the DEFCON Badge Team, who were looking for a small company to partner with. They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s…
CORS does not secure your API: why browser-side API keys are unsafe, and how to protect Drupal JSON:API endpoints with proper authentication.
One of the most detailed pictures to date of how the US government uses airline reservations to target illegal searches is provided by documents released recently by the US government as part of an agreement to settle a lawsuit brought by David House , an activist with the Pvt. Manning Support Network .
2-Step Verification offers a strong extra layer of protection for Google Accounts. Once enabled, you’re asked for a verification code from...
telegra.ph/why-openbsd-is-marginally-less-horrible-12-052019220 points127 commentsSystems & Performance details
The following document is an attempt to consolidate down a number of threads spanning separate discussions from around the 'net I have been having on the subject of operating system development models and OpenBSD. I will break up this document into several sections each of which will handle separate pillars of my…
The Norwegian Data Protection Authority has notified Disqus Inc. (Disqus) that we intend to issue an administrative fine of NOK 25 000 000 for not complying with the GDPR rules on accountability, lawfulness, and transparency.
