1771
Playing around with the Fuchsia operating system
A look at the new Fuchsia Operating System.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,768 posts.
1772
Firefox, you're supposed to be in my pocket, not the other way around
Personal blog of Julien (jvoisin) Voisin
1773
How we cracked millions of Ashley Madison passwords
Not long after the release of the Ashley Madison leaks, many groups and individuals attempted to crack the bcrypt hashes. Since t...
1774
Okta's NextJS-0auth troubles
When AI engineering fails: Dealing with hallucinations, misattribution, and broken code in an Okta/Auth0 pull request maintained by AI.
1775
The Python Package Index is now a GitHub secret scanning integrator
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
1776
Breaking open the Mt. Gox case, part 1
The official blog of WizSec, a group of bitcoin security specialists, and their investigation into MtGox.
1777
1778
Infosec company pwned by 4chan user
risk visualize deez nuts
1779
Don't trust me: I might be a spook
But the latest revelations scare me. It's one thing to find and exploit vulnerabilities in software; there's a lot of software out there which was written by developers with very little understanding of cryptography or software security, and it shows. If you care about security, we reasoned, stick to software written…
1780
AI generated security reports about curl
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
1781
Recovering secret keys from devices using video footage of their power LED
Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED
1782
1783
1784
GoogleMeetRoulette: Joining random meetings
Finding Google Meet phone numbers and bruteforcing PINs to join random meetings
1785
Hacking the Apple Webcam (Again)
$100,500 Apple Bug Bounty for hacking the webcam via a Safari Universal Cross-Site Scripting (UXSS) bug. CVE-2021-30861, CVE-2021-30975
1786
Twitter's pivot to x.com is a gift to phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com , which until very…
1787
1788
Wanted to download an ISO, ended up writing a kernel exploit
My TP-Link EAP770 v1 corrupts downloads over Wi-Fi and TP-Link EOL'd it before I unboxed it. The fix is two zeros in sysfs. TP-Link's shell won't let me write them, so I wrote a kernel exploit for my own fucking access point.
1789
If your code accepts URIs as input, filter out “file://”
There are many online sites that accept reading input from remote locations. For example a site might try to extract all the text from a webpage, or show you the HTTP-headers a given server sends back in response to a request.
1790
EFF’s concerns about the UN Cybercrime Convention
Update: This post has been updated to clarify the scope of the compelled assistance provisions and the broad nature of criminalization and electronic evidence gathering. The final version of the draft convention can still be used to expand the reach of repression under the pretext of combating...
1791
We Have 24 Hours to Save Online Privacy Rules
This is our last chance to save critical online privacy protections. Take part in the action! We are one vote away from a world where your ISP can track your every move online and sell that information to the highest bidder. Call your lawmakers now and tell them to protect federal online privacy...
1792
A decade-old Steam bug
Valve has shown to occasionally not act on community feedback and bug reports. A story about a decade old bug.
1793
1794
My Google Workspace account suspension
As the title suggests, I have finally become the victim of Google’s account suspension.
1795
Linode launches free DDoS protection
/PRNewswire-PRWeb/ -- Linode, the world's largest independent cloud provider, today announced advanced protection across its global network of 11 data centers...
1796
Mark Felt-Tipped: Uncovering top-secret information by counting pixels
KEMUDITOTO merupakan official Situs Togel 4D & Toto TOGEL ONLINE Terjamin Maxwin dengan akses cepat, pilihan permainan lengkap, layanan responsif, dan nyaman digunakan setiap hari.
1797
Barracuda urges replacing, not patching, its email security gateways
It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks , as the company…
1798
The Vercel breach: OAuth attack exposes risk in platform environment variables
An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius. This article examines the attack chain, underlying design tradeoffs, and what it reveals about modern PaaS and software supply chain risk.
1799
1800
