Topics /
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
HP servers provide a management module called iLO (a.k.a. Integrated Lights-Out), which turns on as soon as the power cable is connected, loading a full-blown proprietary operating system. This module has full access to all the firmware, hardware, software, and operating system installed on the server. In addition to…
On Wednesday, July 24th Google launched the Chromecast. As soon as the source code hit we began our audit. Within a short period of time we had multiple items to look at for when our devices arrived. Then we received our Chromecasts the following day and were able to confirm that one of the bugs existed in the build…
Search IETF mail list archives
A storage server configured for public access exposed millions of files belonging to the Oklahoma Securities Commission.
Update II: Apparently not frightened off by Apple's letter defending its developers, Lodsys went ahead and sued at least seven developers in the Eastern District of Texas for patent infringement. In its original cease-and-desist letters, Lodsys gave developers 21 days to respond. But – apparently...
This is part 1 of a series on the security of HTTPS and TLS/SSL HTTPS is a lot more secure than HTTP! If a site uses accounts, or publishes material that people might prefer to read in private, the site should be protected with HTTPS. Unfortunately, is still feasible for some attackers to break...
EFF has petitioned a federal appeals court to reconsider its flawed ruling in our national security letter case on behalf of CREDO Mobile and Cloudflare. In July, the Ninth Circuit in San Francisco upheld the NSL statute against our First Amendment challenge. The court ruled that the FBI is...
Finding RCE during deobfuscation in JEB decompiler running on Java 18.
This is part 2 of a series on the security of HTTPS and TLS/SSL. [Part 1] In a previous post, we discussed some structural insecurities in HTTPS and TLS/SSL, and how those are beginning to pose serious problems for the security of the Web. In this post I will introduce a new proposal called "...
On March 15th, 2021, Cloudflare was sued by a patent troll called Sable Networks. Today, we are launching our efforts to fight back.
Learn about the Log4j vulnerability and how you can combat it. Read this comprehensive guide to get actionable tips.
Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.
$300,000 for cracking #Telegram encryption
A team of Cornell computer science researchers has developed a way to “watermark” light in videos, which they can use to detect if video is fake or has been manipulated, another potential tool in the fight against misinformation.
Our smart devices, such as mobile phones and tablets, contain a wealth of important personal information that needs to be kept safe. Google is constantly trying to find new and better ways protect that valuable information on Android devices. From partnering with external researchers to find and fix vulnerabilities…
Xinjiang, home of the China's muslim Uighur minority, has long been the world's laboratory for Internet repression. Faced with widespread local unrest, and online debate, China has done everything it can to enforce its vision of the Net in the region, from imprisoning bloggers and online publishers...
Today, we’re excited to open up a beta of a third approach to keeping web browsing safe with Cloudflare Browser Isolation.
By using Cloud Spanner as a storage backend for HashiCorp Vault, you get all the benefits of a traditional relational database, the scalability of a globally-distributed data store, and the availability of a fully managed service.
Virtually every organization uses a directory service such as Active Directory to allow computers to join domains, list and authenticate users, and to locate and connect to printers, and other network services including SQL Server databases. A centralized directory reduces the amount of administrative work that must…
From: FreeBSD Security Officer < security-officer@FreeBSD.org > To: FreeBSD Security < FreeBSD-security@FreeBSD.org > Bcc: freebsd-announce@freebsd.org , freebsd-security-notifications@FreeBSD.org Reply-To: secteam@FreeBSD.org Subject: Security Incident on FreeBSD Infrastructure
By James Forshaw, Project ZeroIn my previous blog post I discussed an issue with the Windows Kern...
Overview Defending a Customer from a Botmaster An Unsuspecting Customer Stopping the Bot Conversations with a Botmaster You Can Find Anything on the Internet One-Stop Botnet Shopping Pretense to Avoid Pwning Conclusion References Acknowledgments
