5041
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
5042
Certificate Revocation Issue
We're experts in automated, Scalable, Integrated Digital Certificates Solutions, SSLs/TLSs, managed PKI, IoT, authentication & email security. Learn more about our identity management services.
5043
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
5044
1-Click RCE to steal your Moltbot data and keys
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary…
5045
No, I did not hack your MS Exchange server
New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name.
5046
Over 20k servers have their iLO interfaces exposed to the internet
Over 20 thousand servers have their iLO interfaces exposed to the internet, many with outdated and vulnerable versions of FW, Author: Jan Kopriva
5047
It's Your Data, It's Your Bot: It's Not A Crime
Can public websites decide who is and is not a criminal through their terms of service? A brief EFF filed yesterday argues no. The amicus brief is a follow-up to one we filed last month in Facebook v. Power Ventures. Facebook claims that Power breaks California criminal law by offering users a tool...
5048
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
5049
5050
DigiNotar Damage Disclosure (with full list of issued certs)
About an hour ago I was contacted by the Dutch Government with more details about the DigiNotar...
5051
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
5052
5053
UK intelligence agency admits unlawfully spying on Privacy International
Thames House, Offices of MI5. Photo Credit: Wikimedia Commons
5054
5055
Fast open-source intrusion detection
The system, developed by Carnegie Mellon University CyLab researchers, achieves speeds of 100 gigabits per second using a single server.
5056
How Tor Works: Part One
Security and Programming Blog
5057
Don't use bcrypt
(Edit: Some numbers for you people who like numbers) If you're already using bcrypt, relax, you're fine, probably. However, if you're ...
5058
You Don't Need Anubis
don't use anubis just to block llm scrapers
5059
Disqus Security Alert: User Info Breach
More publishers trust us to engage, grow, and understand their audiences than any other. Build your on-site community with Disqus.
5060
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…
5061
5062
Maybe you should store passwords in plaintext
“Never, ever, think about something else when you should be thinking about the power of incentives.” – Charlie Munger, American billionaire investor.
5063
AWS acquires Wickr
We’re excited to share that AWS has acquired Wickr, an innovative company that has developed the industry’s most secure, end-to-end encrypted, communication technology. With Wickr, customers and partners benefit from advanced security features not available with traditional communications services – across messaging…
5064
5065
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
5066
Verizon announces plans to install a download-tracking app on its Android phones
UPDATE: We have received additional information from Verizon and based on that information we are withdrawing this post while we investigate further. Here is the statement from Kelly Crummey, Director of Corporate Communications of Verizon: "As we said earlier this week, we are testing AppFlash to...
5067
Intelligent Tracking Prevention
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
5068
How random are TOTP codes?
I'm pretty sure that the 2FA codes generated by my bank's TOTP app have a bias towards the number 8 - because eight is an auspicious number. But is that just my stupid meaty brain noticing patterns where none exist? The TOTP algorithm uses HMAC, which in turn uses SHA-1. My aforementioned brain is not clever enough to…
5069
Securing Ubuntu
Table of Contents Initial Setup Setting up iptables and Fail2Ban Fail2Ban iptables rules Make shared memory read-only Setting up Bastille Linux Configuring Bastille sysctl hardening Setting up a chroot environment Securing nginx inside the chroot Extras Initial Setup Let’s login to our new machine and take some…
5070
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …