6991
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,772 posts.
6992
Security releases issued
Posted by James Bennett on Feb. 19, 2013
6993
Zero Day Vulnerability in many Wordpress Themes
Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Read this now.
6994
Whois: Fragile, Unparseable, Obsolete
A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS
6995
Mongo BSON Injection: Ruby Regexps Strike Again
We do penetration testing, source code auditing and vulnerability assessments
6996
6997
NVD Damage Continued
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
6998
EFF to Court: Lifetime GPS Tracking Violates the Fourth Amendment
All too often, new police surveillance tools are initially applied to only the “worst of the worst” and then slowly—but surely—expanded to include an ever-growing number of less culpable individuals. We’ve seen it with DNA collection. And now we’re starting to see it with GPS tracking. That’s why...
6999
Black Lotus Labs uncovers Linux executables deployed as stealth Windows loaders
The Lumen blog and newsroom is your source for business technology news and insights, customer stories, press and media, and trending articles.
7000
Users Betrayed as Australia Adopts a Copyright Censorship Regime
Since our report last week on Australia's Internet censorship bill, the bill did indeed pass the Senate yesterday, and will become the Copyright Amendment (Online Infringement) Act 2015. The new law provides an accelerated process for rightsholders to obtain court orders for ISPs to block sites...
7001
The lack of HTTPS at Amazon: identifying items purchased via information leakage
If you were to browse Amazon right now and someone was eavesdropping on your connection, they could tell exactly what you were looking at. They could even tell what you've bought.
7002
Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)
A technique for abusing HTTP 301 redirects and random numbers to uniquely track users; even those who have cookies disabled in their web browsers.
7003
Rootless Containers
Rootless containers is a new concept that don’t require root privileges in order to formulate, but have some unique challenges.
7004
Zigfrid – A Passive RFID Fuzzer
Zigfrid is the end result of my RFID tinkering. Since I will most definitely forget most things described here in the (very) near future, I share this for those few who might find it interesting. P…
7005
7006
Windows 0-day exploit used in Operation WizardOpium
During our investigation, we discovered that yet another 0-day exploit (CVE-2019-1458) was used in Operation WizardOpium attacks.
7007
7008
GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773)
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub …
7009
7010
A shallow survey of formal methods for C code
Two interesting things in formally verified software happened recently. The big one was the release of SeL4 - a formally verified L4 microkernel. The second was much smaller, but closer to my usual scope: a paper which showed the correctness of sections of a couple of the assembly implementations of Curve25519.
7011
7012
AEADs: getting better at symmetric cryptography
I gave a talk a couple of weeks ago at the Yahoo Unconference . The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer…
7013
Adtech is built on a privacy fault line
The IAPP's Cobun Zweifel-Keegan rounds up the latest privacy developments from Washington, D.C., and elsewhere in the U.S. for the week of 24 July 2023.
7014
7015
Anti-Cheat Expert: all your pixels are belong to us
a blog about exploring reverse engineering, hypervisor development and software programming.
7016
Web Fonts Collateral Damage of Ad Blockers
Years of abusive implementation of webfonts has landed the feature under the umbrella of content blocking APIs, affecting those few who’ve cared all along.
7017
Why Isn’t Telegram End-to-End Encrypted by Default (2017)
telegra.ph/why-isnt-telegram-end-to-end-encrypted-by-default-08-142021127 points145 commentscited by 11Security & Privacy details
I've been getting this question more often this year. It's based on the wrong assumption that some other popular messaging apps such as WhatsApp are "end-to-end encrypted by default", while Telegram is not. This post is intended to disprove this myth that has been so carefully crafted by Facebook/WhatsApp marketing…
7018
U.S. border surveillance towers have always been broken
A new bombshell scoop from NBC News revealed an internal U.S. Border Patrol memo claiming that 30 percent of camera towers that compose the agency's "Remote Video Surveillance System" (RVSS) program are broken. Except, this isn't a bombshell. What should actually be shocking is that Congressional leaders are acting…
7019
The dark side of account bans
I recently lost my Facebook account for two months, and was significantly cut off from certain aspects of society during that time. This is the dark side of account bans.
7020
It’s time to extend the US Privacy Act to EU citizens
Last summer’s Snowden revelations not only highlighted the urgent need for surveillance reform but also severely damaged relations between t...