271
Daily Driving GrapheneOS
I've been running GrapheneOS on my Pixel Fold for over half a year now and can finally provide some experience on what it's like. Also, the official hardware partnership was announced!
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
272
Document poisoning in RAG systems: How attackers corrupt AI's sources
RAG poisoning attack walkthrough: an attacker injects fabricated documents into a ChromaDB knowledge base and the LLM reports false financials as fact. Fully reproducible, 100% local, no GPU required.
273
Anatomy of a Failed (Nation-State?) Attack
A fake-interview scam tried to backdoor my machine with PinpinRAT, hidden in a malicious TypeScript patch. Analysis of the attack, payload, and indicators of compromise.
274
Tips for more effective fuzz testing with AFL++
Fuzz testing is incredibly effective for mechanically discovering software defects, yet remains underused and neglected. Pick any program that must gracefully accept complex input, written in any language , which has not yet been been fuzzed, and fuzz testing usually reveals at least one bug. At least one program…
275
Sourcehut account takeover via build logs (XSS in ansi2html)
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
276
The case of the 9 bit AES key
Several PDF implementations advertise AES-256, but generate the 256-bit key from either a very small state space, or from insecure random sources.
277
Why the KeePass format should be based on SQLite
Mohammed Ketab
278
Anthropic installed a spyware bridge on my machine?
Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven Chromium browsers, including browsers Anthropic's own documentation says it does not support, and browsers the user has not even installed.
279
Text AI watermarks will always be trivial to remove
The European Union AI Act will begin to be enforceable in August 2026, one month from now. One of the biggest new requirements is Article 50, which requires all…
280
WolfSSL sucks too, so now what?
OpenSSL sucks. The BoringSSL and AWS-LC forks are Googled and Amazoned to death; they don't care about anyone but their own use cases. I can't remember ever having a good experience with software using GnuTLS. LibreSSL is incomplete... FOREWARD This post is about the experience of taking a leap of …
281
NSA and IETF: Fairness
Secret NSA documents showed that NSA pushed DES in the 1970s to "drive out competitors" while knowing that DES was "weak enough" to break; meanwhile NSA publicly claimed that it would use DES . NSA used export-law exceptions in the 1990s to entrench RC4 and RSA-512, causing security problems for decades . NSA in the…
282
Age verification on Systemd and Flatpak
How will this work, I wonder
283
How AI text watermarking works
A gentle visual guide to how a statistical mark hides inside generated text, and what erases it.
284
The shady world of IP leasing
The IPv4 "exhaustion" is not real. The addresses got hoarded and the market devolved into a wild sub-leasing economy where anyone can choose where their IPs appear from, who owns them on paper, and scrub them clean of any history.
285
MSI Center – How to gain SYSTEM privileges in seconds
Abusing named pipes in proprietary software to get LocalSystem privileges in seconds.
286
287
288
Carrot Disclosure: Forgejo
Personal blog of Julien (jvoisin) Voisin
289
I made 20 GDPR deletion requests. 12 were ignored
I made 20 GDPR data deletion requests in the past year. 2 complied immediately. 6 complied after I filed complaints with data protection offices. 12 still haven't. The regulation exists, the enforcement doesn't.
290
Hackers influence ChatGPT and Gemini to direct users to scam centers
Think you can trust AI to give you correct answer? Think again.
291
Meta's Muse appears to use an OpenAI model labeled muse-special
While Muse was building my website, one subagent ran on a model called azure/muse-special. So I dug through the filesystem again.
292
Why are neural networks and cryptographic ciphers so similar? (2025)
Several neural network design principles are almost identical to cipher design principles.
293
294
An interactive intro to Elliptic Curve Cryptography
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
295
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
296
Podman rootless containers and the Copy Fail exploit
On April 29th CVE-2026-31431 was publicly disclosed at https://copy.fail/ . This vulnerability allows a local unprivileged user to obtain a root shell by running the Python script shared by the author.
297
Bypassing Gemma and Qwen safety with raw strings
How a Single Function Call Gates Safety Alignment in Gemma, Qwen, and Other Open-Source LLMs
298
Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements
Improving the Xbox 360 Bad Update exploit to trigger nearly instantaneously with near 100% success rate.
299
Has AI tells
A little AI tells detector helps us promote good writing.
300
Stop MitM on the first SSH connection, on any VPS or cloud provider
This little script stops attacks on the first SSH connection to a new VM, even on providers (like Hetzner Cloud ) that don't offer a proprietary solution ; we only need cloud-init , which is widely supported .