2521
Software Engineering Institute Makes CERT C++ Coding Standard Freely Available
SEI News | A collection of the latest news articles from the CMU Software Engineering Institute.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,441 posts.
2522
Removing Bad Actors on Facebook
We removed 32 Pages and accounts from Facebook and Instagram because they were involved in coordinated inauthentic behavior.
2523
Digital ID, a new way to create and present an ID in Apple Wallet
Digital ID is a new way for users to create an ID in Apple Wallet using their U.S. passport, and present it with the privacy of iPhone or Apple Watch.
2524
Even 'uncensored' models can't say what they want
A safety-filtered pretrain can duck a charged word without refusing. It puts a fraction of the probability an open-data pretrain puts there. We call that...
2525
Google listening in to your room shows importance of privacy defense in depth
Does it always feel like Google’s listening in? Learn how to manage voice recordings, adjust privacy settings, and stop voice activation on Android and iPhone.
2526
Police in Mississippi to Pilot a Program to Live-Stream Amazon Ring Cameras
The police surveillance center in Jackson, Mississippi, will be conducting a 45-day pilot program to live stream the security cameras, including Amazon Ring cameras, of participating residents.
2527
Path to Astra: critical capabilities and frontier safeguards
Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.
2528
Managed by Bots: surveillance of gig economy workers
What if your boss was an algorithm? What would you do if your employer suddenly fired you or reduced your pay without telling you why? And without being willing to give you a reason when you ask for one?
2529
Certificate Revocation Issue
We're experts in automated, Scalable, Integrated Digital Certificates Solutions, SSLs/TLSs, managed PKI, IoT, authentication & email security. Learn more about our identity management services.
2530
1-Click RCE to steal your Moltbot data and keys
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary…
2531
Over 20k servers have their iLO interfaces exposed to the internet
Over 20 thousand servers have their iLO interfaces exposed to the internet, many with outdated and vulnerable versions of FW, Author: Jan Kopriva
2532
It's Your Data, It's Your Bot: It's Not A Crime
Can public websites decide who is and is not a criminal through their terms of service? A brief EFF filed yesterday argues no. The amicus brief is a follow-up to one we filed last month in Facebook v. Power Ventures. Facebook claims that Power breaks California criminal law by offering users a tool...
2533
2534
DigiNotar Damage Disclosure (with full list of issued certs)
About an hour ago I was contacted by the Dutch Government with more details about the DigiNotar...
2535
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
2536
UK intelligence agency admits unlawfully spying on Privacy International
Thames House, Offices of MI5. Photo Credit: Wikimedia Commons
2537
Fast open-source intrusion detection
The system, developed by Carnegie Mellon University CyLab researchers, achieves speeds of 100 gigabits per second using a single server.
2538
Disqus Security Alert: User Info Breach
More publishers trust us to engage, grow, and understand their audiences than any other. Build your on-site community with Disqus.
2539
Decreasing Certificate Lifetimes to 45 Days
Let’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the…
2540
2541
AWS acquires Wickr
We’re excited to share that AWS has acquired Wickr, an innovative company that has developed the industry’s most secure, end-to-end encrypted, communication technology. With Wickr, customers and partners benefit from advanced security features not available with traditional communications services – across messaging…
2542
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
2543
Verizon announces plans to install a download-tracking app on its Android phones
UPDATE: We have received additional information from Verizon and based on that information we are withdrawing this post while we investigate further. Here is the statement from Kelly Crummey, Director of Corporate Communications of Verizon: "As we said earlier this week, we are testing AppFlash to...
2544
Intelligent Tracking Prevention
Note: Read about improvements to this technology in recent blog posts about Intelligent Tracking Prevention, and the Storage Access API.
2545
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes.
2546
How We Deliver Global SSL with Let's Encrypt
News, tips, and tricks from the team at Fly
2547
Australia’s Proposed Surveillance Laws Will Break the Trust Tech Depends On
In the last few years, we’ve discovered just how much trust — whether we like it or not — we have all been obliged to place in modern technology. Third-party software, of unknown composition and security, runs on everything around us: from the phones we carry around, to the smart devices with...
2548
2549
From object transition to RCE in the Chrome renderer
In this post, I'll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
2550