2011
This year’s insane timeline of hacks
An archive of this year’s insane timeline of hacks few people are talking about
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
2012
How I re–over-engineered my home network for privacy and security
How I used Docker Compose, Ansible, and Caddy to re-over-engineer my network setup for easier maintenance, treating my Raspberry Pi like cattle, not a pet.
2013
How the Dreamcast Copy Protection Was Defeated
After I shipped the DOOM Black Book , I took some vacation in Japan where I was able to play Ikaruga on a real arcade at Taito HEY in Akihabara. The experience reignited my interest in SEGA's ultimate video game console, the Dreamcast. There is a lot of documentation available online which made the studying process…
2014
What I Learned Trying to Secure Congressional Campaigns
You know how it happens. You try to secure one Congressional campaign, and then another, and pretty soon you can't stop. You'll fly across the country just to brief a Green Party candidate in a district the Republicans carried by 60 points. You want more, more, always looking for that next fix.
2015
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
2016
‘Evil Corp,’ a $100M Cybercrime Menace
The U.S. Justice Department this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself “ Evil Corp ” and stole roughly $100 million from businesses and consumers. As it…
2017
Twitter, Reddit support challenge of visa applicant social media requirement
WASHINGTON – Twitter, Reddit, and Internet Association filed an amicus brief late yesterday in support of a lawsuit filed last year by the Knight First Amendment Institute at Columbia University, the Brennan Center for Justice, and Simpson Thacher & Bartlett LLP on behalf of plaintiffs Doc Society and International…
2018
2019
Don't trust AI agents
AI agents need a security model that assumes things will go wrong. The right response isn't better permission checks, it's architecture that makes trust unnecessary.
2020
2021
50 CVEs in 50 Days: Fuzzing Adobe Reader
Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the number from the year before (see table below). The probable reason for this is the increased…
2022
Toward a Reasonably Secure Laptop
It’s no secret that hardware selection is one of the biggest hurdles Qubes users face. Finding a computer that is secure, trustworthy, and compatible is more difficult than it should be. In an effort to address the compatibility aspect of that problem, we introduced the Qubes-certified ...
2023
2024
CVE-2021-22555: Turning \x00\x00 into 10000$
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
2025
Beware: Windows 10 Signature Edition Blocks Installing Linux
We help you acquire the perfect domain for your site. Affordable payment options. Quick and responsive customer support available.
2026
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
2027
2028
Air Gaps
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
2029
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
2030
2031
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
2032
O2 VoLTE: locating any customer with a phone call
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
2033
2034
2035
2036
More Encryption, More Notifications, More Email Security
Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw Engineer Today, we’re announcing a variety of...
2037
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
2038
Inside ZCode: Silently uploading your Git history to the cloud
ZCode silently uploads full Git history to the cloud; this post provides a block rule and source review — checkpoint claims fall apart against the code.
2039
7-Zip: From Uninitialized Memory to Remote Code Execution
Blog about anti-virus software vulnerabilities.
2040
Login Forms Over HTTPS, Please
Update: This feature is now also enabled in Firefox Beta, starting with Firefox Beta 50. Pretty much everyone who uses the web has used a password to log into something. ...