Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
Recently, Verizon was caught tampering with its customer's web requests to inject a tracking super-cookie. Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the US and...
The EU’s Chat Control law would scan private messages and weaken encryption. Sign Mozilla Foundation’s petition to defend privacy and protect our digital future.
Matrix, the open protocol for secure decentralised communications
Libsodium is now 13 years old!
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Stella is the companion app for Meta's smart glasses. Inspecting version 273.0.0.21 of the Android build (com.facebook.stella), I found the entire computational and storage stack for on-device facial recognition: three face models, a local database schema, a cosine-similarity vector index dimensioned to
TLDR: my bank sent out emails with websites which looked a lot like phishing mails, so much so that this similarity could potentially be used against them legally by potential phishing victims Discussion at hackernews: https://news.ycombinator.com/item?id=44592377 Chapter 1: You’ve got mail As I was writing my first…
OpenAI advances AI content provenance with Content Credentials, SynthID, and a verification tool to help people identify and trust AI-generated media.
Custom PHP2Shell Exploit Chained with Kernel LPE to Root Versions of Palo Alto Networks PAN-OS Firewalls in the Wild
A new Federal Trade Commission (FTC) report confirms what EFF has been warning about for years: tech giants are widely harvesting and sharing your personal information to fuel their online behavioral advertising businesses.
LibreSSL was officially announced to the world just about exactly five months ago. Bob spoke at BSDCan about the first 30 days. For those who weren't there, I'll quickly rehash some of that material. Also, it's always best to start at the beginning, but then I'll try to focus on some new material and updates.
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
I have a love/hate relationship with the Cato Institute. Most of their analysis I strongly disagree with, but some of it I equally strongly agree with. Last September 11—the tenth anniversary of 9/11—Cato’s David Rittgers published “Abolish the Department of Homeland Security“: DHS has too many subdivisions in too…
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten's product, deployment, and CLI repos in a public Docker image.
Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, and Jörg Schwenk, Ruhr University Bochum
San Francisco—The Electronic Frontier Foundation (EFF) is urging a federal appeals court to reinstate a lawsuit seeking to hold Cisco Systems accountable for aiding in human rights abuses by building the Chinese government a system that Cisco officials knew was intended to identify—and facilitate...
I wrote a follow-up to this guide, which you should probably consider along with this article.
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
State Partitioning is the new privacy feature called Total Cookie Protection, which will be available in ETP Strict Mode in Firefox 86.
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
Dear Reader, No Starch Press and I have decided to release this free ebook version of Hacking the Xbox in honor of Aaron Swartz. As you read this book, I hope that you’ll be reminded of how important freedom is to the hacking community and that you’ll be inclined to support the causes that Aaron believed in. Download…
