Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,771 posts.
This xz backdoor thing reminds me of a story I heard from friends that worked at a tech company that made cell phones. They had a great coder that worked on the project, he had put in work as a contractor for a few months, and due to the quality of his work he was hired in full time. After two months he simply stopped…
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.
Introducing URU Card: an open-source, wallet-sized FIDO2 BLE authenticator based on ESP32, ATECC508A, OLED screen, and MPR121 touch keyboard. Join the project and start building your own secure authenticator.
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
A while ago, someone came to me and gave me some data involving AT&T iPad customers to publicize, the full story of which I’m sure you’re all familiar with from my previous excellent blog posts. I was subsequently raided by the FBI and arrested , though I have been under gag orders and haven’t been able to discuss the…
apple's 'quicklook' cache, may leak encrypted data
This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.
13 vulnerabilities in GarminOS and the MonkeyC VM, 9 with CVEs, that let Connect IQ apps escape the VM and bypass permissions on 100+ Garmin watches.
Note: This information has been disclosed to Google appropriately, they have chosen to not fix this behavior.
A personal story about creating new products and their unintended consequences
Tech companies are using the word “privacy” a lot these days. What do they mean when they say it? To one company, privacy means keeping your informatio
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
In December 2014, the FBI received a tip from a foreign law enforcement agency that a Tor Hidden Service site called “Playpen” was hosting child pornography. That tip would ultimately lead to the largest known hacking operation in U.S. law enforcement history. The Playpen investigation—driven by...
We all jumped on "the Equifax dumpster fire bandwagon" recently and pointed to all the things that went fundamentally wrong with their disclosure process. But it's equally important that we acknowledge exemplary handling of data breaches when they occur because that's behaviour that should be encouraged. Last week,
Little Snitch by Objective Development is the first app that I install on a new Mac. In fact I just bought a new Mac, an M4 MacBook Pro with nano-texture display, and I installed Little Snitch via thumb drive even before connecting the Mac to the internet. While setting up my new Mac, which came with macOS 15.2…
The legal dispute between Apple and the FBI might prove pivotal in the long-running battle to protect users' privacy and right to use uncompromised encryption. The case has captured the public imagination. Of course, EFF supports Apple's efforts to protect its users. The case is complicated...
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
Infomaniak transfers the majority of its voting rights to a Swiss public-benefit foundation. Your cloud remains sovereign, independent, and true to its values. Forever.
A great find: In his 1956 short story, “Let’s Get Together,” Isaac Asimov describes security measures proposed to counter a terrorist threat: “Consider further that this news will leak out as more and more people become involved in our countermeasures and more and more people begin to guess what we’re doing. Then…
In this post, I would like to share about new CSS based attack with unicode-range descriptor of @font-face rule . Using this technique, an...
Docker is a founding member of the Blueprint Alliance, a 12-company reference architecture for securing AI agents, built around four governance questions.
Censors pose a threat to the entire Internet.
Matrix, the open protocol for secure decentralised communications
A writeup of my $4133.70 Google Drive vulnerability chain.
Put an io_uring on it - Exploiting the Linux Kernel - chompie at the bits
This started with a consulting snafu: Government organisation A got government organisation B to develop a web application. Government organisation B subcontracted part of the work to somebody. Hosting and maintenance of the project was later contracted out to a private-sector company C. Company C discovered that the…
