Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
It’s an established fact on the internet that we have ran out of IP(v4) addresses , and we are starting to see the pressure on obtaining IPv4 space. For example if you want to get a /24 block from RIPE NCC when you sign up as a member, then you are currently looking at a 2 month wait for a recycled IPv4 /24 block .
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
Today, Let's Encrypt announced that they are enabling an extension to DNS CAA records known as ACME-CAA ( RFC 8657 ). This came as a surprise to me, but a very pleasant one, since I wrote the ACME-CAA specification back in 2016 with Let's Encrypt in mind, and it was finally published as RFC 8657 back in 2019. To my…
I was reticent to write this blog post because it leaves a lot of questions unanswered, questions that we should be able to answer. It's about a data breach with almost 90GB of personal information in it across tens of millions of records - including mine. Here's what I
The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank. Of course, thi…
As I've previously blogged in Pure Rust Implementation of Apple Code Signing (2021-04-14) and Expanding Apple Ecosystem Access with Open Source, Multi Platform Code signing (2022-04-25), I've been hacking on an open source implementation of Apple code signing and notarization using the Rust programming language. This…
Back in 2007 I stumbled upon something called a QR Code . It was a neat two-dimensional barcode that encodes textual information visually—with URLs being a promising application for the emerging smartphone market (thanks to the release of the iPhone that year). So I did what any self-respecting personal blogger would…
Yesterday the House Permanent Select Committee on Intelligence unanimously approved the FISA Reform and Reauthorization Act of 2023 (FRRA), which would reauthorize Section 702 of the Foreign Intelligence Surveillance Act (FISA 702). The full House is expected to vote on this bill next Tuesday. Like other competing…
Bug Bounty & Application Security
🇫🇷 French: Traduction du dossier Chat Control 2.0, stopchatcontrol.fr🇸🇪 Swedish: Chat Control 2.0🇩🇰 Danish: chatcontrol.dk🇳🇱 Dutch: Chatcontrole Table of contents: The End of the Privacy of Digital Correspondence and the End of Anonymous Communication Take action to stop Chat
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
By Sekwon Choi
Missouri Governor Mike Parson made headlines last year when he vowed to criminally prosecute a journalist for reporting a security flaw in a state website that exposed personal information of more than 100,000 teachers. But Missouri prosecutors now say they will not pursue charges following revelations that the data…
Creating fake signed commits
This story starts with Sidney Crosby. A professional hockey player and Canadian icon. I can neither confirm nor deny that I welled up like…
Adversarial examples are inputs to machine learning models that an attacker has intentionally designed to cause the model to make a mistake; they’re like optical illusions for machines. In this post we’ll show how adversarial examples work across different mediums, and will discuss why securing systems against them…
Security research and technical deep dives from the Appsecco team — cloud attacks, Kubernetes security, vulnerability analysis, and AppSec engineering.
Twitter has an undocumented feature which lets you follow accounts without being logged in. Here's how I found it, and how you can use it. My crappy old TV has a crappy old web browser on it. One boring Sunday, I decided to see which websites worked and which didn't on a 6 year old browser. Anything using LetsEncrypt…
Link to: https://benpackard.github.io/blog/2020-01-28-sign-in-with-apple/
Recently, multiple organisations have disclosed how clusters of so-called “rogue” AI agents attempted to break into websites and online services, sometimes successfully. Agents from OpenAI’s enviro…
How bots used our sign-up and forgot password pages to bomb real people's inboxes, and what we did to stop it. A practical guide to subscription bombing for founders and developers who think CAPTCHA is an "I'll do it later" task.
Self-taught developer. Go, Rust, Python and Javascript. - hackermondev
This document provides the GNU Name System (GNS) technical specification. GNS is a decentralized and censorship-resistant domain name resolution protocol that provides a privacy-enhancing alternative to the Domain Name System (DNS) protocols. This document defines the normative wire format of resource records…
A Certification Authority (CA) is an organization that browser vendors (like Mozilla) trust to issue certificates to websites. Last year, Mozilla published and discussed a set of issues with one ...
Update – Since this was posted, Max Allan and Damion Yates have investigated further and found that BT are intercepting DNS queries and replying with doctored DNS results, which I didn’…
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
