Topics /
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
Cryptographic schemes are based on the computational difficulty of solving some ‘hard’ problem. For example, RSA (specifically, RSA-2048) is based on the difficulty of a problem like this:
Yesterday Twitter announced that they plan to amend the assignments agreements that they sign with their employees. They call this proposed amendment the Innovator's Patent Agreement. I've been aware of this effort inside of Twitter for a while and I like to call this move the "Twitter Patent Hack" because I think…
Hey. I decided to get a paid plan on Github and Paypal looked like a good payment option to me. Click the blue button here : This looks ...
I think one of the biggest challenge for system engineers is designing security. Recently, at the 32c3 conference, plutoo, derrek, and smea presented a series of hacks that completely defeated the security of the 3DS. As a result, people have implemented boot-time unsigned code execution (called “arm9loaderhax” in the…
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
Learn how to keep your SSL certificates up to date and valid.
In the first part of this series we discussed the mechanics of an exploit, the general concept of hardening, and the stack protector hardening technique in particular. Some of the concepts explained there will be
I’m writing a book on security in the highly connected Internet-of-Things world. Tentative title: Click Here to Kill Everybody Peril and Promise in a Hyper-Connected World There are two underlying metaphors in the book. The first is what I have called the World-Sized Web, which is that combination of mobile, cloud…
Security protocols often assume an accurate, local clock (e.g. TLS, Kerberos, DNSSEC and more). It's a widely accepted assumption when designing protocols but, for a lot of people, it just isn't true. We find good evidence that at least 25% of all certificate errors in Chrome are due to a bad local clock.
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
I have been awarded a fellowship at the Berkman Center for Internet and Society at Harvard University, for the 2013–2014 academic year. I’m excited about this; Berkman and Harvard is where a lot of the cool kids hang out, and I’m looking forward to working with them this coming year. In particular, I have three goals…
From 15 March 2026, CAs must validate DNSSEC on CAA lookups and ACME checks. I've run DNSSEC for 14 years; see if your registrar supports it.
The recent move among U.S. states to add digital “age verification” to websites which serve adult content is a troubling one. Digital age verification systems are rife with privacy concerns, many requiring you to upload your government ID to third-party vendors or even directly to the website in question. Privacy…
My long-time collaborator Richard Barnes [1] used to say that "in security, trust is a four letter word" , and yet the dominant experience of using any software-based system—which is, you know, pretty much anything electronic—is trusting the manufacturer. Not only is there no meaningful way to determine what software…
Brief background
Like many developers, I find myself more and more using AI agents to help with software development. I currently use Claude Code, the co...
Let’s start by defining the word Wardriving: it is the search for WIFI wireless networks from a vehicle equipped with a computer. This would be the classic definition. I define modern wardriving as the search for WIFI networks, Bluetooth devices … Continue reading →
a guided introduction for first-timers
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
For programmers new to cryptography, there are plenty of “known unknowns” – unfamiliar terms like “elliptic curves” and “random oracles”, and unnecessarily long acronyms (“RSASSA-PKCS-v1_5”, like really?). But what really gives cryptography its reputation is the unknown unknowns. The things that catch even experienced…
Hartley writes about full stack software engineering and AI-driven software development.
Programming Zen is a blog about programming and emerging technologies, authored by Antonio Cangiano, a Software Development Manager and AI Evangelist at IBM.
