Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,769 posts.
Near the end of 2022, Trail of Bits was hired by the Open Source Technology Improvement Fund (OSTIF) to perform a security assessment of the cURL file transfer command-line utility and its library, libcurl. The scope of our engagement included a code review, a threat model, and the subject of this blog […]
I wrote a bit about my reasoning to De-Google here . Now I want to write a bit about my progress, the struggles and what I ended up with.
The comapny uses manipulative designs to prevent people from obtaining a free copy of their data in accordance with law
The perils of logging in
Using Google Analytics in a legally compliant way is still possible in Europe. Here we explain how.
Proton Mail disputed some of the content of the post originally published at this location. We will continue the discussion directly with Proton Mail, in particular at a meeting in …
(echoes of a broken system) UPDATE: Aaron committed suicide on January 11, 2013.(!) More on his life here. Aaron Swartz is a friend and Cambridge-area polymath whose projects focus on access to kno…
In the immortal words of Ricky Bobby, I wanna go fast [https://www.youtube.com/watch?v=_qJGsSuFRIg]. When I launched Pwned Passwords V2 last week [https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/], I made it fast - real fast - and I want to talk briefly here
I'll generally ignore the internet froth in a given week as much as possible, but when Her Majesty's Government starts repeating misunderstandings about TLS 1.3 it is necessary to write something, if only to have a pointer ready for when people start citing it as evidence.
Posted by Jan Keller, Technical Program Manager, Google VRP A little over 10 years ago , we launched our Vulnerability Rewards Program (VR...
Read CircleCI’s security alerts from January 2023. Last updated 1/13/2023.
Let's rig some elections.
This morning I discovered some rather anomalous 1-star reviews on Amazon for the Apple iPhone 6s 128 GB. About 17% of the reviews for that product are 1-star...
We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection. We created this feature because we believe in giving you m
Summary of CVE-2021-4228 (Log4Shell), trivial RCE in log4j, a common Java logging framework. Includes list of affected platforms.
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
A couple of months ago, I received a request from a random Internet user to add CSRF protection to my little web framework Microdot, and I thought it was a fantastic idea.When I set off to do this…
We recently switched Google's two billion line repository over to BoringSSL , our fork of OpenSSL . This means that BoringSSL is now powering Chromium (on nearly all platforms), Android M and Google's production services. For the first time, the majority of Google's products are sharing a single TLS stack and making…
MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list…
The vulnerability has been fixed as of July 7, 2026, but the exploit was simple, and hidden email addresses may still be in third-party logs.
There's a fundamental tension in authorization. Is it business logic or authorization logic? Should it be in the app, or separate? Let’s talk about what makes a
A paper from Anthropic's Alignment Science team on Alignment Faking in AI large language models
One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Ch…
