Topics /
The most popular blog posts about security & privacy on Hacker News. 356 posts.
ICE is using a smartphone app called “Mobile Fortify” to scan faces and capture contactless fingerprints, instantly pulling back names and biographical data — and court filings say the same encounters are being followed by revocations of Global Entry and TSA PreCheck. That turns “trusted traveler” into chilling of…
“The devil is in the details,” they say.
The story of CVE-2025-55182 (React2Shell)
AVAILABLE NOW OpenAI, Anthropic, and Chrome ship it. Apple deprecated it. Nobody documented it. Until now. → sandbox-exec: The Miss...
Today, we welcome the 47th government onboarded to Have I Been Pwned’s free gov service: Nepal. Their National Cyber Security Centre now has access to monitor Nepalese government domains against the data in HIBP. This gives the NCSC the ability to identify exposure across government email addresses and respond
Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitati...
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
A week of cyber incidents one after another – is this what every week is going to look like and what can we do about it?
For the past several months, I’ve been receiving and then ignoring a steady stream of concerning emails from Sendgrid, the popular email delivery service owned by Twilio that I use for sendin…
Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to…
Why security through obscurity still matters: not as your only defence, but as a practical layer that raises attacker cost.
New immigration rules for the UK are being enforced starting February 2026. This means citizens of 85 additional countries (including the USA and European countries) will need an Electronic Travel Authorisation (ETA) to visit, even for tourism. Luckily, you can apply (and pay) digitally. Unfortunately, the government…
Smart TVs are everywhere! But who is the master? Amid the electronics boom driven by A.I., one piece of electronics has remained almost unchanged financially. That is the digital display or flat-panel monitor. With good reason! The entire entertainment and streaming industry wants one of these devi
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
What the accidental Claude Code source code leak tells us about the real value of code, product market fit, and why integration is what actually makes software great.
According to the Apple support document How to identify the DFU port on Mac , the DFU (device firmware update) port location for MacBook Pro models with Apple silicon is as follows:
| Read on LessWrong | Comment on HN | Large language models often take actions running on one computer (via an agentic harness such as Claude Code or Codex), however the LLMs’ responses to prompts are computed on a different computer with GPU access.
This page is taking an unexpected detour...
I let AWS Cognito gaslight me for three weeks so you don't have to. Here's the unfiltered autopsy.
Much have been said about futility of trying to validate email addresses. Generally accepted advice is that you should just send verification link and don’t care about trying to validate it beforehand.
Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAW…
The current situation on the IT job market is hard. So you are lucky when a recruiter on LinkedIn reaches out to you having a suitable match for a new position based on your prior experience. It might not be what it seems at a first glance.
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
I purchased a Matrix CoolRunner Rev D back in 2017. This little chip is called a glitcher and it’s a type of modchip. Its sole purpose, the reason it was designed, is to deliver a short pulse of energy (~ 100 nanoseconds) to an Xbox 360 Console.
Lots of the CVE world seems to focus on “security bugs” but I’ve found that it is not all that well known exactly how the Linux kernel security process works. I gave a talk about this back in 2023 and at other conferences since then, attempting to explain how it works, but I also thought it would be good to explain…
Apple recently announced an upcoming feature for their new Apple Watches called “Audio Intelligence,” which will always be listening to a...
Last week I wrote a thing about how to run Claude Code when you don’t trust Claude Code. I proposed the creation of a dedicated user account & standard unix access controls. The objective was to stop Claude from dancing through your .env files, eating your secrets. There are some usability problems with that guide- I…
FINAL STATUS (2026-10-21): the CVE-2026-109618 / CVE-2026-109619 memory-corruption class shipped patches 2026-10-21. On the patch, that class is closed: the cached-pointer chain dies at the addref and the serialize-state path is a memory-safety bug, not code execution. Two session-handling flaws survive on…
