Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,775 posts.
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
Building a social network is not easy. Social networks have value proportional to their size, so participants aren’t motivated to join new social networks which aren’t already large. It’s a paradox where if people haven’t already joined, people aren’t motivated to join. The trouble is that whi...
Posted by Charlie Reis, Site Isolator Speculative execution side-channel attacks like Spectre are a newly discovered security risk for web...
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
It’s no secret that the Ethereum blockchain is a highly adversarial environment. If a smart contract can be exploited for profit, it eventually will be. But this unforgiving environment pales in comparison to the mempool. If the chain itself is a battleground, the mempool is something worse: a dark forest.
by Sophia Cope, Amul Kalia, Seth Schoen, and Adam SchwartzDownload the report as a PDF.EXECUTIVE SUMMARYThe U.S. government reported a five-fold increase in the number of electronic media searches at the border in a single year, from 4,764 in 2015 to 23,877 in 2016.[fn] Gillian Flaccus, Electronic...
I've spent the past few months developing a new build system for the 3.0 series of the Tor...
This is a historic blog post at this point. Please see our certificate lifetime documentation for the current status of certificate lifetimes. We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer…
Which libraries are vulnerable to attacks and how to prevent them.
If any of you reading this have decision-making ability along those lines, I would appreciate your assistance in making this happen. If you're wondering why: they are still shipping a version of my software that I released in 2014. Since that's roughly a decade in software years, it recently began popping up a single…
Reviewing AI Security Engineers: How ZeroPath found 200+ bugs in curl and why AI SASTs are becoming a viable replacement for traditional tools.
This document describes the web tracking practices that WebKit believes, as a matter of policy, should be prevented by default by web browsers.
Brave is committed to maintaining Manifest V2 support, allowing users to keep their favorite extensions functioning beyond the industry-wide deprecation.
Last week, I wrote about statements made by Charles Ding, Huawei’s Senior Vice President and Chief Representative in the U.S., Mr. Ding explained the
