661
SQL Injection as a Feature
Looking at old applications, we always wonder who in their right mind thought of building them so badly. But every repository has its story and every effort has noble origins. I encountered such an ap
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 679 posts.
662
Protect Public School Students from Surveillance of Off-Campus Speech
EFF filed an amicus brief in Arizona federal court arguing that public school students need private digital spaces beyond their school’s reach to speak freely, without the specter of constant school surveillance and punishment.
663
Using AI to secure AI
One of Anthropic's quieter releases recently was their "Security Review," where Claude Code can identify and fix security issues in your code. But how good is it really? In my case, will it find issues with code it helped me write for my newsletter service…
664
Unmasking the Privacy Risks of Apple Intelligence
We reveal AppleStorm, our investigation into how Apple AI’s eco-system quietly transmits messages (WhatsApp, iMessage) sent via Siri to Apple servers, even when it isn’t needed to complete the task.
665
How to check if your Apple Silicon Mac is booting securely
How to check your Mac is booting in Full Security, and how to read its log to verify all the key steps involved in that process.
666
667
Why you should delete WhatsApp and install Signal
WhatsApp is not private or secure. Please consider using Signal instead.
668
Pizlix: Memory Safe Linux from Scratch
Pizlix is LFS (Linux From Scratch) 12.2 with some added components, where userland is compiled with Fil-C. This means you get the most memory safe Linux-like OS currently available.
669
Deno Under TinyKVM in Varnish
Previously, I said that TinyKVM runs regular Linux ELFs and I use this to test my programs on the terminal like a regular program before I load them in Varnish.
670
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
671
Understanding ECDSA
Exploring blockchain, math, and smart contracts through a security lens.
672
Improving PixelMelt's Kindle Web Deobfuscator
A few days ago, someone called PixelMelt published a way for Amazon's customers to download their purchased books without DRM. Well… sort of. In their post "How I Reversed Amazon's Kindle Web Obfuscation Because Their App Sucked" they describe the process of spoofing a web browser, downloading a bunch of JSON files…
673
CRLite: Certificate Revocation Checking in Firefox
Firefox is now the first and the only browser to deploy fast and comprehensive certificate revocation checking that does not reveal your browsing activity to anyone (not even to Mozilla). ...
674
Critical Security Vulnerability in React Server Components
The library for web and native user interfaces
675
Block AI Scrapers with Anubis proof-of-work
I got tired with all the AI scrapers that were bullying my git server, so I made a tool to stop them for good.
676
Countering Trusting Trust Through Diverse Double-Compiling (DDC)
David A. Wheeler's Page on Countering 'Trusting Trust' through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers
677
A new layer of security for certified Android devices
Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed.
678
Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation.
New documents and court records obtained by EFF show that Texas deputies queried Flock Safety's surveillance data in an abortion investigation, contradicting the narrative promoted by the company and the Johnson County Sheriff that she was “being searched for as a missing person,” and that “it was about her safety.”…
679
Hacking with AI SASTs: An overview of ‘AI Security Engineers’ / ‘LLM Security Scanners’ for Penetration Testers and Security Teams
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.