1651
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1652
Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
1653
1654
How to win at CORS
The 'how' and 'why' of CORS, from start to finish.
1655
Firefox 87 introduces SmartBlock for Private Browsing
Today, with the launch of Firefox 87, we are excited to introduce SmartBlock, a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode. SmartBlock ensures that strong ...
1656
Reverse engineering yet another eBook format
In the distant past I was super into removing DRM from books and magazines (check out my posts on that topic: Removing Edge Magazine DRM , Removing Zinio DRM ). This interest eventually faded away, mostly because I just stopped using websites that wouldn’t allow me to download and own the products I paid for (kudos to…
1657
Ubiquiti developer charged with extortion, causing 2020 “breach”
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
1658
What Happened to HackerOne?
The rise and fall of the largest bug bounty platform in the world
1659
Why the Sony hack is unlikely to be the work of North Korea
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…
1660
Results of technical investigations for Storm-0558 key acquisition
Microsoft Security Response Center Blog
1661
Mozilla takes action to protect users in Kazakhstan
Today, Mozilla and Google took action to protect the online security and privacy of individuals in Kazakhstan. Together the companies deployed technical so
1662
Hardening Firefox with Claude Mythos Preview
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
1663
Github scam investigation: Thousands of “mods” and “cracks” stealing data
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
1664
Mitmproxy 11: Full HTTP/3 Support
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
1665
EPA Seeks to Eliminate Critical PFAS Drinking Water Protections
The move continues to expose communities across the country to toxic forever chemicals in tap water
1666
Vulnerability reports are not special anymore
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
1667
Meta accessed women's health data from Flo app without consent, says court
A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.
1668
Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets
Author: Nitay Artenstein Introduction Fully remote exploits that allow for compromise of a target without any user interaction have become something of a myth in recent years. While some are occasionally still found against insecure and unpatched targets such as routers, various IoT devices or old versions of Windows…
1669
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
1670
API Tokens: A Tedious Survey
Documentation and guides from the team at Fly.io.
1671
Remote code execution in Homebrew by compromising the official Cask repository
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…
1672
1673
Everything you should know about certificates and PKI but are too afraid to ask
Certificates and public key infrastructure (PKI) are hard. No shit, right? I know a lot of smart people who''ve avoided this particular rabbit hole. Eventually, I was forced to learn this stuff because of what it enables: PKI lets you define a system cryptographically. It''s universal and vendor-neutral yet poorly…
1674
JSON Web Tokens should be avoided
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
1675
1676
Cloudflare targets 2029 for full post-quantum security
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
1677
LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group
ESET researchers have discovered the first in-the-wild UEFI rootkit. Dubbed LoJax, the research team has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
1678
1679
Taking Over DigitalOcean Domains via a Lax Domain Import System
A Hacker's Blog of Unintended Use and Insomnia.
1680
Sophisticated OS X Backdoor Discovered
Back in January this year we found a new family of cross-platform backdoors for desktop environments. After the discovery of the binaries for Linux and Windows systems, we have now finally come across the OS X version of Mokes.A.