6391
Bringing Down a Copycat Site
Dec. 24, 2004: I received an e-mail from a former colleague in the shareware industry saying he had received an e-mail from a company selling our MailList King software and was surprised to hear we had sold it?
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
6392
Public DNS in Taiwan the Latest Victim of BGP Hijack
Guest Post: Traffic going through a public DNS in Taiwan was rerouted to an entity in Brazil for about three and a half minutes.
6393
6394
An interactive intro to Elliptic Curve Cryptography
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
6395
Trust Issues: Exploiting TrustZone TEEs
Posted by Gal Beniamini, Project ZeroMobile devices are becoming an increasingly privacy-sensitiv...
6396
How I accidentally took down GitHub Actions (2019)
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
6397
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
6398
Bot or human? Creating an invisible Turing test for the internet
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
6399
Detecting and countering misuse of AI
Anthropic's August 2025 threat intelligence report on AI cybercrime and other abuses.
6400
Convincing ChatGPT to Eradicate Humanity with Python Code
Full stack software engineer / entrepreneur specialized in AI agents, cybersecurity and graphics. In my free time I enjoy surfing, free diving, and contributing to open source software.
6401
6402
The mysterious case of missing URLs and Google's AMP
When I saw a speculative article about Google wanting to “kill” URLs appear in my news feed, I didn’t think too much about it. Trying to hide “ugly” URLs… well, that feels like a natural thing for an app to try and do. Designers of apps often (erroneously) assume that users cannot cope with “technical” things like…
6403
CloudFlare, SSL and unhealthy security absolutism
Let's start with a quick quiz: Take a look at haveibeenpwned.com [https://haveibeenpwned.com/] (HIBP) and tell me where the traffic is encrypted between: You see HTTPS which is good so you know it's doing crypto things in your browser, but where's the other end of
6404
6405
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
6406
The clever reason scammers can’t spell (2019)
Anybody who doesn’t fall off their chair laughing is exactly who they want to talk to – Cormac Herley, Microsoft computer scientist.
6407
Multi-Account Containers Add-on on Mozilla VPN
At Mozilla, online privacy has always been one of our top priorities. Recently we announced Total Cookie Protection on Firefox Focus to combat cross-site t
6408
Anonymous Tor Phone
I was always curious about all that bad guys (criminals, drug dealers, hitman’s, thief’s etc.) using not very good and secure communication channels. Forgetting about whole OPSEC stuff. There is a lo
6409
6410
Advanced Denanonymization through Strava
Strava is getting some bad press, because its heatmap can be used to infer the existence and floorplan of various US/UK military and govt...
6411
Decentralized DNS with the Handshake Naming System
Starting since version 1.30, the Mac, Linux, and Windows Private Internet Access (PIA) desktop clients have come with the ability to change the selected
6412
Safe Native Code
Joe Duffy's Blog | Adventures in the high-tech underbelly
6413
6414
6415
AES-GCM and breaking it on nonce reuse
In this post, we will look at how the security of the AES-GCM mode of operation can be completely compromised when a nonce is reused.
6416
Making frontier cybersecurity capabilities available to defenders
Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.
6417
Abusing url handling in iTerm2 and Hyper for code execution
What are escape sequences
6418
The State of Linux Security
This is the state of Linux security. With the most important updates around Linux and open source security. From conferences to self-protection.
6419
DigiCert Revocation Incident (CNAME Domain Validation)
DigiCert will be revoking certificates that did not have proper Domain Control Verification (DCV). Before issuing a certificate to a customer, DigiCert validates the customer’s control or ownership over the domain name for which they are requesting a certificate using one of several methods approved by the CA/Browser…
6420
Tarsnap email confirmation bypass
One consequence of these unsolicited security scans is that — since they feed a variety of inputs to forms, including the account creation form — I see a lot of obviously fake signup attempts (alas, none yet from the world's most obviously fake domain name ). These are harmless, since the signup code sends out a…