4861
Are popular toxicity models simply profanity detectors?
Are popular toxicity models simply profanity detectors? We show how toxicity models overweight profanity, and make mistakes when profanity is used in a positive way.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
4862
GCC's new fortification level: The gains and costs (2022)
Discover the gains and costs of GCC’s enhanced runtime buffer overflow protection. Level 3 _FORTIFY_SOURCE preprocessor macro may detect more buffer overflows, but there’s a cost.
4863
C2PA Cameras Do Not Survive Contact with Reality
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
4864
Proposed illegal image detectors on devices are ‘easily fooled’
Proposed algorithms that detect illegal images on devices can be easily fooled with imperceptible changes to images, Imperial research has found.
4865
Owners of 1-Time Passcode Theft Service Plead Guilty
Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.
4866
4867
Stop the Apple and Google contact tracing platform
Apple and Google released a joint specification that allows both iPhones and Android devices to do contact tracing on a global scale. Even though "privacy, transparency, and consent are of utmost importance", this is a game changing event that has grave consequences. We must stop Apple and Google in their tracks. Or…
4868
An attacker’s blunder gave us a look into their operations
An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.
4869
No Copyright Intended
On October 26, a YouTube user named crimewriter95 posted a full-length version of Pulp Fiction, rearranged in chronological order. A couple things struck me about this video. First, I’m surprised that a full-length, 2.5-hour very slight remix of a popular film can survive on YouTube for over six weeks without getting…
4870
Bypassing Denuvo in Hogwarts Legacy
When I announced my Black Ops 3 integrity bypass, someone commented that my research was not impressive and I should try analyzing Denuvo instead. That kinda stuck with me, so I did what everyone would do and spent the last 5 months of my free time reverse engineering and bypassing the Denuvo DRM in Hogwarts Legacy. I…
4871
OpenSSH versus SSH
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
4872
Lies, damn lies, and front-end tracking
I’m here to warn you about the dangers of front-end user tracking. Not because Google is tracking you, but because it doesn’t track you quite well enough.
4873
4874
How to steal Bitcoins that are protected by weak passphrases
Every Bitcoin address is based on a secret key, from which the public key (associated to a Bitcoin address) is calculated. Once you have the private key for an address, you have the control of that address and can use it to transfer funds.
4875
The AWS S3 Denial of Wallet Amplification Attack
If you publicly host large data files on AWS S3 & pay for transfer costs, you may be vulnerable to a “Denial of Wallet” amplification…
4876
Google uncovers major account-hijacking campaign targeting senior US officials
Insights from Googlers into our products, technology, and the Google culture
4877
Bootkitty: Analyzing the first UEFI bootkit for Linux
ESET's discovery of the first UEFI bootkit designed for Linux sendss an important message: UEFI bootkits are no longer confined to Windows systems alone.
4878
120 days until Google restricts side-loading, declaring war on Android freedom
Starting 2027, Google will block apps on Android devices whose developers have not registered with Google, paid, and given their ID. It’s fair to say that Google is becoming Apple: Your device, their rules.
4879
The new ProtonMail has passed its independent security audit
Before we released the new Proton Mail, security experts conducted an independent audit of its open source code. You can read their report.
4880
Get root on macOS 13.0.1 the macOS Dirty Cow bug
Get root on macOS 13.0.1 with CVE-2022-46689 (macOS equivalent of the Dirty Cow bug), using the testcase extracted from Apple’s XNU source.
4881
How I snatched 153k Ether after a bad Tinder date
Over the weekend, I did a lot of swiping right. I’ve never had a Tinder go this fast from match to agreeing on a date time this fast…
4882
Bringing supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report & prevent vulnerabilities.
4883
OAuth with Cloudflare workers on a statically generated site
An article on implementing OAuth user registration for a newsletter on a statically generated site using Cloudflare workers.
4884
GoDaddy employees used in attacks on multiple cryptocurrency services
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy , the world’s largest domain name registrar, KrebsOnSecurity has learned.
4885
Six curl CVEs after OpenAI and Anthropic came back with zero
After frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.
4886
Qubes Air: Generalizing the Qubes Architecture
The Qubes OS project has been around for nearly 8 years now, since its original announcement back in April 2010 (and the actual origin date can be traced back to November 11th, 2009, when an initial email introducing this project was sent within ITL internally). Over these years Qubes h...
4887
4888
Supabase Auth: SSO, Mobile, and Server-Side Support
Supacharging Supabase Auth with Sign in with Apple on iOS, Single-Sign-On support with SAML 2.0, and PKCE for server-side rendering and mobile auth.
4889
Post-mortem and remediations for the Matrix.org security breach
Matrix, the open protocol for secure decentralised communications
4890
