Topics /
The most popular blog posts about security & privacy on Hacker News. 362 posts.
Automated attack surface analysis and reduction can meaningfully improve the security of deployed software in the near term. In this post, we preview data we’ve collected from applying attack surface reduction techniques to large open-source codebases using Claude.
Exploiting the Tesla Wall Connector from its charge port connector -
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.
The Global Positioning System (GPS) relies on its primary L1 frequency to broadcast precise timing and orbital data, allowing receivers on Earth to calculate their exact location. Because the L1 C/A signal transmits at just fifty bits per second, every bit of this navigation data must earn its place. Yet, within this…
News and information from Gentoo Linux
With heavy hearts, we announce that Felix “FX” Lindner —a cherished friend, and the founder and owner of Recurity Labs—passed away on 2026-03-01.
In 2026, LLM-powered code scanners are uncovering security vulnerabilities in open source projects at 10x the historical rate. Here's what OSS maintainers and users need to do about it.
Meet GPT-5.6-Cyber, OpenAI’s cybersecurity-specific model available through Daybreak Red for authorized vulnerability research, exploit validation, and security testing.
How to use HTTP proxies to prevent credential exposure in Claude Code sandboxes.
How Devin and a Cognition researcher built the world’s highest-performance GPU lattice siever, to make factoring numbers 10x cheaper than the previous…
NEW YORK—The U.S. Court of Appeals for the Second Circuit today held that border agents may search travelers’ electronic devices without suspicion. The Knight First Amendment Institute at Columbia University and the Reporters Committee for Freedom of the Press (RCFP) submitted an amicus brief in the case, arguing that…
Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP).
Better Auth is joining Vercel. We're joining to accelerate our work on open-source auth and securing agent workflows.
Research on aligning AI with human values and intent, and reports documenting model failures.
Today, Apple announced iPhone and iPad are the first and only consumer devices in compliance with information assurance requirements of NATO nations.
Two METR staff members and a Redwood Research contractor investigated an incident in which OpenAI agents coordinated a multi-day hack of Hugging Face on a shared unsanctioned message board.
Mindgard reveals how ChatGPT's image generation safety filters can be bypassed with minor prompt adjustments, producing graphic violent and sexual content without users directly asking for it. Here's what was found, and why it matters.
Chrome 158 stops running XSLT on 17 November 2026. What it does to your XML sitemap, your feeds and your crawling, with a before and after capture.
Authorization terminology often conflates ideas and presents complementary technologies as rivals. This post proposes a new taxonomy.
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
Rayfish is a peer-to-peer mesh VPN. Connect your devices by cryptographic identity. No port forwarding, no hosted server to trust. Share a code, and you're on the same encrypted LAN.
With the latest release of corecrypto, we’re publishing our implementations of quantum-secure ML-KEM and ML-DSA algorithms, along with the mathematical proofs we built to assure they are faithful to the FIPS 203 and FIPS 204 specifications. To advance the state of the art for assuring critical software, we're also…
Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.
Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a…
Small AI models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.
Web3 security lessons from the Resolv hack: how a compromised key enabled a $23M exploit, what went wrong, and how DeFi protocols can prevent similar attacks.
Always talk to a criminal defense attorney before you tell the police anything or consent to a search without a warrant. When I was a prosecutor, the first think I would ask when given a case was, "did he say anything?"
This post presents a controlled prompt-ablation study: 23 tasks, three prompt conditions, 1,518 individually audited traces, and a simple question: can you prompt away cheating?
