Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
Update, 14 Feb 2014: A year and a half on from writing this, Tesco has indeed suffered a serious security incident almost certainly as a result of some of the risks originally detailed here. Read more about it in The Tesco hack – here’s how it (probably) happened [https://www.
Last month we shared statistics on some popular reflection attacks. Back then the average SSDP attack size was ~12 Gbps.
RDS-TMC uses an encryption algorithm simple enough to be run using pen-and-paper hardware.
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
This was a tough decision, having used Gmail since 2007/2008. However, I had to draw the line and stop giving Google my data for free. The problem with email is …
Cambridge researchers urge public health bodies like the NHS to provide trustworthy, research-driven alternatives to platforms driven by profit.
Law Enforcement, Courts Need to Better Understand IP Addresses, Stop Misuse If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional. Yet EFF has found that police and courts are regularly conducting and approving raids...
bypassing macOS's file quarantine, gatekeeper, and notarization requirements
February 19, 2019
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a…
Today I’m publicizing a Google OAuth vulnerability that allows employees at companies to retain indefinite access to applications like Slack and Zoom, after they’re off-boarded and removed from their company’s Google organization. The vulnerability is easy for a non-technical audience to understand and exploit.
I am fascinated by things that are simple on the surface and complex underneath! For example, consider the popular padlock icon that is used to signify that traffic to and from a web site is encrypted: How does the browser know that it should display the green padlock? Well, that’s quite the story! It all […]
After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.
In 2007 I wrote a pair of modding tools, binitools , for a space trading and combat simulation game named Freelancer . The game stores its non-art assets in the format of “binary INI” files, or “BINI” files. The motivation for the binary format over traditional INI files was probably performance: it’s faster to load…
Fuchsia is a general-purpose open-source operating system created by Google. It is based on the Zircon microkernel written in C++ and is currently under active development. The developers say that Fuchsia is designed with a focus on security, updatability, and performance. As a Linux kernel hacker, I decided to take a…
tl;dr: I like PurelyMail and I will slowly switch all my online accounts to use it. I've been using it for almost three months and I didn't have any issues (except with some Hotmail/Outlook addresses). I have a GMail account since 2006 (that's the date
Last February, while driving down a Nevada highway on the way to visit his daughters, Stephen Lara was robbed in plain sight. But his assailants […]
How best to punish spammers? I give this topic a lot of thought because I spend a lot of time sifting through the endless rubbish they send me. And that's when it dawned on me: the punishment should fit the crime - robbing me of my time - which means that
The personal website of James Belchamber.
TinyKVM can be used to sandbox regular Linux programs or programs with specialized APIs embedded into your servers.
When you start Chrome, it attempts to connect to three random domains. I've seen a few theories about why exactly this happens that brush up against the nefarious. The true rationale is incredibly mundane: hopefully this short summary will clear things up.
Two lawyers hid a white-on-white instruction inside a court filing telling the AI to go easy on their case. The court's AI caught it. The fine was $16,000.
Microsoft has renewed its Privacy Policy and Service Agreement. The new services agreement goes into effect on 1 August 2015, only a couple of days after the launch of the Windows 10 operating system on 29 July. The new “privacy dashboard” is presented to give the users a possibility to control their data related to…
When we look at the general security posture of Let’s Encrypt, one of the things that worries us most is how much of the operating system and network infrastructure is written in unsafe languages like C and C++. The CA software itself is written in memory safe Golang, but from our server operating systems to our…
This research presents VPN⁰, the first distributed virtual private network offering a privacy preserving traffic authorization and validation mechanism.
Yesterday at the WWDC keynote, Apple announced a series of new security and privacy features, including one feature that’s drawn a bit of attention — and confusion. Specifically, Apple …
