1231
“Should you encrypt or compress first?”
Appcanary makes sure you never run vulnerable software on your servers. Like our blog? Subscribe to our newsletter or podcast . Browse the archive , or follow us on twitter , github or rss .
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1232
A supply chain attack on PyTorch
Security tends to lag behind adoption, and AI/ML is no exception. Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platform…
1233
Lastpass Security Incident
Please refer to the latest article for updated information.nbs[..]
1234
Google Chrome Keystone is modifying /var symlink on non SIP Macs causing k-panic
Reports that some AVID Users Macs would no longer boot. It now may be that a Google Chrome Keystone update modifies /var on NON SIP Protected Macs.
1235
VPN – Very Precarious Narrative
A very long article about commercial VPNs, their marketing strategies, and the truth behind their privacy and security claims.
1236
With questionable copyright claim, Jay-Z orders deepfake parodies off YouTube
With a questionable claim to copyright, Jay-Z ordered two deepfake audio parodies of his voice off YouTube. I talked to the video's creator about the future of AI for creative expression.
1237
Prompt injection: what’s the worst that can happen?
Activity around building sophisticated applications on top of LLMs (Large Language Models) such as GPT-3/4/ChatGPT/etc is growing like wildfire right now. Many of these applications are potentially vulnerable to prompt …
1238
Falling through the KRACKs
The big news in crypto today is the KRACK attack on WPA2 protected WiFi networks. Discovered by Mathy Vanhoef and Frank Piessens at KU Leuven, KRACK (Key Reinstallation Attack) leverages a vulnerab…
1239
Examining a vintage RAM chip, I find a counterfeit with a different die inside
A die photo of a vintage 64-bit TTL RAM chip came up on Twitter recently, but the more I examined the photo the more puzzled I became. The c...
1240
Tailscale Has Partnered with Mullvad
Since Tailscale was founded in 2019, customers have been forced to choose between either Tailscale or Mullvad without the ability for them to co-exist.
1241
What Data Does Facebook Collect When I’m Not Using Facebook, and Why?
Explaining more about the information we get from other websites and apps; how we use the data they send to us; and the controls you have.
1242
I Followed the Official AWS Amplify Guide and Was Charged $1,100
An interesting thing happens when you follow the official Amplify guide.
1243
Going Dark, and the era of law enforcement hacking
I’m coming down from spending a few days at Usenix Security, right here in my hometown of Baltimore. This means that my days have been taken up with two kinds of conversation: first, explaini…
1244
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
1245
Google AdWords Exploit Seen in the Wild
See the ad for ebay at the top of the results? Not particularly interesting, right?…
1246
Firefox Containers Preview
Today, we’re excited to announce the Preview of Containers in Firefox version 153, which lets you keep separate parts of your online life (work, shopping
1247
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
UPDATE: PLEASE HELP ME TEST UPATE TO THE UPDATE: Similar log entries are now found in another system log that is more persistent, see the article here . UPDATE: This is still vulnerable on current versions of macOS 10.13.3 when encrypted an ALREADY EXISTING unencrypted APFS volume
1248
Password Managers
I’ve spent a lot of time trying to understand the attack surface of popular password managers. I think I’ve spent more time analyzing them than practically anybody else, and I think that qualifies me to have an opinion!
1249
USPS text scammers duped his wife, so he hacked their operation
How someone I don't know hacked the scammers back
1250
Linux Hardening Guide
Linux is not a secure operating system . However, there are steps you can take to improve it. This guide aims to explain how to harden Linux as much as possible for security and privacy. This guide attempts to be distribution-agnostic and is not tied to any specific one. DISCLAIMER: Do not attempt to apply anything in…
1251
Chrome's Plan to Distrust Symantec Certificates
Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome Security This post is a broader announcement of plans already finalized on t...
1252
If you’re not using SSH certificates you’re doing SSH wrong (2019)
SSH has some pretty gnarly issues when it comes to usability, operability, and security. The good news is this is all easy to fix. SSH is ubiquitous. It’s the de-facto solution for remote administration of *nix systems. SSH certificate authentication makes SSH easier to use, easier to operate, and more secure.
1253
Re-entry to US without backscatter or pat-down
On November 21, 2010, I was allowed to enter the U.S. through an airport security checkpoint without being x-rayed or touched by a TSA officer. This post explains how.
1254
1255
Hacking into an insurance company by exploiting their premium calculator
A vulnerable API on Toyota Tsusho Insurance Broker India’s premium calculator website exposed Microsoft corporate cloud credentials.
1256
A picture got my PostgreSQL database to start mining Monero
A Deep Dive into Database Attacks [Part III]: Why Scarlett Johansson’s Picture Got My Postgres Database to Start Mining Monero
1257
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
1258
Hacking Grindr Accounts with Copy and Paste
Sexuality, relationships and online dating are all rather personal things. They're aspects of our lives that many people choose to keep private or at the very least, share only with people of our choosing. Grindr [https://www.grindr.com/] is "The World's Largest Social Networking App for Gay,
1259
1260
Google’s fully homomorphic encryption compiler – a primer
Back in May of 2022 I transferred teams at Google to work on Fully Homomorphic Encryption (newsletter announcement). Since then I’ve been working on a variety of projects in the space, including being the primary maintainer on github.com/google/fully-homomorphic-encryption, which is an open source FHE compiler for…