6421
Sony Music Brazil hacked
I hate to pick on Sony, but they got hacked again (and no, I am not talking about the Lulzsec + sonypictures, this is another…
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
6422
6423
6424
Improved Digital Certificate Security
Posted by Stephan Somogyi, Security & Privacy PM, and Adam Eijdenberg, Certificate Transparency PM On September 14, around 19:20 GMT, Syma...
6425
Zero-knowledge proofs, Zcash, and Ethereum
Part 3 of a series on “Privacy on the Blockchain”.
6426
Threema Goes Open Source
Threema Goes Open Source, Welcomes New Partner
6427
Obama Has Gotten 3,000+ Tweets about Encryption. Let’s Double That
EFF, ACLU, and Access Now released a statement in support of Apple and its stance on encryption last week. We called on the President to reject any attempt to force backdoors like the one the FBI was seeking to Apple’s operating system. We asked our communities to help by tweeting at the President...
6428
6429
Building a WebAuthn Click Farm
How I built a click farm to “bypass” Cloudflare’s CAPTCHA killer with some cheap USB security keys, an Arduino, and a bit of python.
6430
Curryfinger – Find the Server Behind the CDN
CURRYFINGER quickly and effectively identifies the real hosts behind CDN networks like CloudFlare - and outperforms existing tools. Find out how to use it.
6431
An Update on Plugin Security
Learn about Figma's response to the security vulnerabilities that were reported in a 3rd-party library that we use for plugin security
6432
6433
Blueprint for a distributed multi-region IAM with Go and CockroachDB
Learn how to scale IAM globally. Ory provides secure multi-region identity solutions.
6434
Investigating a backdoored PyPI package targeting FastAPI applications
In this post, we analyze a malicious PyPI package attempting to backdoor FastAPI applications.
6435
Neat trick for getting private info for Facebook, GMail, Twitter and Digg users
Hidden img and script tags with onload and onerror let any site tell if you're logged into GMail, Facebook, Twitter or Digg. Google called it expected.
6436
Podman rootless containers and the Copy Fail exploit
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
6437
RubyGems.org gem replacement security vulnerability and mitigation
Summary RubyGems.org contained a bug that could allow an attacker to replace some .gem files on our servers with a different file that they supplied. We deployed a partial fix on April 2nd and a co...
6438
Modern TLS/SSL on 16-bit Windows
Lately, there's been an resurgence of new programs written for retro computers—everything from a Slack client to many Wordle clones, to a Mastodon client. But most of these programs, if they connect to the Internet, require a proxy running on a modern computer to handle the SSL/TLS connection, which almost all APIs…
6439
Digging into Linux namespaces – part 1
Process isolation is a key component for containers. One of the key underlying mechanisms are namespaces. We will explore what they are, and how they work, to build our own isolated container and better understand each piece.
6440
The Ethics of Running a Data Breach Search Service
No matter how much anyone tries to sugar coat it, a service like Have I been pwned [https://haveibeenpwned.com/] (HIBP) which deals with billions of records hacked out of other peoples' systems is always going to sit in a grey area. There are degrees, of course; at one end
6441
DNS-over-HTTPS Policy Requirements for Resolvers
Over the past few months, we’ve been experimenting with DNS-over-HTTPS (DoH), a protocol which uses encryption to protect DNS requests and responses, with the goal of deploying DoH by default ...
6442
Digital ID – The New Chains of Capitalist Surveillance
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
6443
Increasing HTTPS Adoption
When a browser connects to websites over HTTPS (vs. HTTP), eavesdroppers and attackers on the network can't intercept or alter the data that...
6444
Should notes be end-to-end encrypted?
A comprehensive guide about the different types of encryption, the upsides and downsides, and how to make decisions about how much encryption you need for note-taking, passwords, or anything else.
6445
Mad at Meta? Don't Let Them Collect and Monetize Your Personal Data
If you’re fed up with Meta right now, you’re not alone. Meta tracks you across millions of websites and apps and its business model relies on your data. If you want to limit Meta’s ability to collect and profit from your personal data, here’s what you need to know.
6446
6447
Reddit and LinkedIn apps also caught copying and pasting clipboard contents
Linkedin and Reddit both check your clipboard and copy and paste your clipboard contents with every keystroke - even when you’re in another app. Another
6448
6449
Signify: Securing OpenBSD from Us to You
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
6450