Every blog post that took off on Hacker News, ranked by the votes of its best submission. 718 posts.
OpenSSL sucks. The BoringSSL and AWS-LC forks are Googled and Amazoned to death; they don't care about anyone but their own use cases. I can't remember ever having a good experience with software using GnuTLS. LibreSSL is incomplete... FOREWARD This post is about the experience of taking a leap of …
Secret NSA documents showed that NSA pushed DES in the 1970s to "drive out competitors" while knowing that DES was "weak enough" to break; meanwhile NSA publicly claimed that it would use DES . NSA used export-law exceptions in the 1990s to entrench RC4 and RSA-512, causing security problems for decades . NSA in the…
How will this work, I wonder
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
If you run a server with cPanel or WHM, you need to read this carefully. On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new…
The IPv4 "exhaustion" is not real. The addresses got hoarded and the market devolved into a wild sub-leasing economy where anyone can choose where their IPs appear from, who owns them on paper, and scrub them clean of any history.
Abusing named pipes in proprietary software to get LocalSystem privileges in seconds.
Personal blog of Julien (jvoisin) Voisin
I made 20 GDPR data deletion requests in the past year. 2 complied immediately. 6 complied after I filed complaints with data protection offices. 12 still haven't. The regulation exists, the enforcement doesn't.
Think you can trust AI to give you correct answer? Think again.
While Muse was building my website, one subagent ran on a model called azure/muse-special. So I dug through the filesystem again.
A vulnerability in Ramp's Sheets AI allowed the agent to insert formulas that made external network requests without user approval, creating the risk of data exfiltration via indirect prompt injection.
Several neural network design principles are almost identical to cipher design principles.
OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
Defend yourself against tracking and surveillance. Circumvent censorship. | Good Bad ISPs
How a Single Function Call Gates Safety Alignment in Gemma, Qwen, and Other Open-Source LLMs
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
Withdrawing its opposition under behind-the-scenes pressure from Gov. Gavin Newsom and lawless threats from the US Department of Homeland Security (DHS), the California legislature has agreed to fund and revise state law to authorize the upload of information about all driver’s licenses and ID cards issued by the…
A math solver leads to encrypted code in npm packages. Follow the loader, the trigger matrix that unlocks it, the remote access payload, and the full indicators.
DMARC verifies a domain owner authorised an email; it does not verify the email is safe. Where DMARC helps, where it falls short, and why authentication is not trust.
How a hidden prompt injection in CONTRIBUTING.md revealed that 40% of pull requests to a popular GitHub repository were generated by AI bots
A little AI tells detector helps us promote good writing.
Automated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface reduction techniques to large open-source codebases using Claude.
