2791
Apple Is Listening
They had encountered significant turbulence in the product line over the preceding years, especially Macs. It was a rough time to be a pro Mac user.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 8,770 posts.
2792
Iran-backed hackers claim wiper attack on medtech firm Stryker
A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker , a global medical technology company based in Michigan. News reports out of Ireland, Stryker’s largest hub outside of the United States, said the company sent home more than 5,000 workers…
2793
European govt air-gapped systems breached using custom malware
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal.
2794
2795
Bloomberg’s ‘The Big Hack’
One way or the other, there is more to come on this story, and either Bloomberg’s or Apple’s and Amazon’s credibility is going to take a significant hit.
2796
PIA open-sources and announces audit plans
The VPN industry looks just like the world of religion - everyone has their different beliefs on who to trust. However, even the diamond in the rough lied
2797
A Bug in Early Creative Commons Licenses Has Enabled Copyleft Trolls (2022)
Copyleft trolls, robosigning, and Pixsy.
2798
GitHub has not removed malicious imitation software after 3 weeks
On the 31st August I got an email from a customer, telling me that they had found an imitation of my data wrangling software on Github. I’m not linking to it, but here is a screenshot: It is …
2799
On Cybersecurity and Being Targeted
Last month, I was the subject of a targeted cyber attack. Someone went through substantial lengths to attempt to gain access to my GitHub account, but were...
2800
White House Deletes TSA Petition
At approximately 11:30 am EDT, the White House removed a petition about the TSA airport screening procedures from the White House
2801
Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall
Despite Apple’s changes to macOS with the release of Big Sur, we can confirm that the Mullvad app still performs as intended by not allowing Apple’s own apps to bypass our VPN firewall.
2802
2803
2804
Kids Pass Just Reminded Us How Hard Responsible Disclosure Is
Only a couple of months ago, I did a talk titled "The Responsibility of Disclosure: Playing Nice and Staying Out of Prison". The basic premise was to illustrate where folks finding security vulnerabilities often go wrong in their handling of the reporting, but I also wanted to show how organisations
2805
Creative usernames and Spotify account hijacking
Spotify supports unicode usernames which we are a bit proud of (not many services allow you to have ☃, the unicode snowman, as a username). However, it has also been a reliable source of pain over the years. This is the story of one time when it bit us pretty badly and how we spent Easter dealing with it.
2806
2807
CISA passes Senate
CISA passed the Senate today in a 74-21 vote. The bill is fundamentally flawed due to its broad immunity clauses, vague definitions, and aggressive spying authorities. The bill now moves to a conference committee despite its inability to address problems that caused recent highly publicized...
2808
Attack campaign involving stolen OAuth tokens issued to third-party integrators
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our…
2809
I Hacked Google App Engine: Anatomy of a Java Bytecode Exploit
Back in college, I was very interested in Java bytecode. When I got an internship at Google in 2013, I was skeptical of the security of the Java version of Google App Engine and got permission to spend the last week of my internship doing a mini red team exercise, trying to break into App Engine. This is the story of…
2810
EFF: Show Support for the Fourth Amendment
This Fourth of July, EFF will be demonstrating our commitment to your Constitutional right of privacy from government surveillance by displaying the text of the Fourth Amendment on our website. This demonstration is a visual symbol of our opposition to the illegal and unconstitutional surveillance...
2811
Beg Bounties
When someone passed me hundreds of thousands of records on kids taken from CloudPets a few years ago [https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/] , I had a nightmare of a time getting in touch with the company. They'd
2812
Don't use passkeys for encrypting user data
Passkeys are the future of authentication, but using them for data encryption is a disaster waiting to happen. Overloading these credentials creates a dangerous blast radius that can lead to the irreversible loss of a user's most sacred memories and documents.
2813
Yubico and Microsoft Introduce Passwordless Login
The Security Key by Yubico with FIDO2 enables passwordless login for Windows 10 devices and Microsoft Azure Active Directory.
2814
Microsoft actions following attack by nation state actor Midnight Blizzard
Microsoft Security Response Center Blog
2815
How we protect our most sensitive secrets from the most determined attackers
As a bank, we have a lot of secrets we need to protect to keep our customers and ourselves safe. These include private keys that only we know, which we use to digitally sign requests as coming from us (sort of like a private password). These private keys are super important and are used all over Monzo and when…
2816
Someone is impersonating us in a recruiting scam
Our startup was recently the center of an elaborate recruiting scam. What do other companies do if they realize that someone is impersonating them to attack vulnerable job seekers? This article gives advice to job seekers and shares our story.
2817
Rubygems.org AWS Root Access Event – September 2025
As part of standard incident-response practice, Ruby Central is publishing the following post-incident review to the public. This document summarizes the September 2025 AWS root-access event, what occurred, what we verified, and the actions we’ve taken to strengthen our security processes.
2818
2819
Deleting System32\curl.exe
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
2820
NixOS and reproducible builds could have detected the xz backdoor
In March 2024, a backdoor was discovered in xz, a (de)-compression software that is regularly used at the core of Linux distributions to unpack source tarballs...