Topics /
The most popular blog posts about security & privacy on Hacker News. 300 posts.
FiveM provides a powerful framework to create game experiences not otherwise possible in Grand Theft Auto. However, this power can be abused by attackers through the use of XSS in vulnerable NUI resources.
Part 1 of a multi-part series on using LLMs securely within your organisation. This post provides a framework to categorize risks based on different use cases and deployment type.
I ran into an issue after accidently enabling HSTS for a website on localhost. This was not an issue for the original website that was runni...
Early in his career, Kevin Mitnick successfully hacked California law. He told me the story when he heard about my new book, which he partially recounts his 2012 book, Ghost in the Wires. The setup is that he just discovered that there’s warrant for his arrest by the California Youth Authority, and he’s trying to…
A look at diversity of MX records across all gTLDs and the Top 1M domains, indicating where SMTP is concentrated and what organizations might have broad access to the world's emails.
I don't trust Signal because it pretends to be things which it provably isn't and forces use of their controlled the network. This means that if Signal wanted to, they could intercept messages. In this article I show receipts, that while each individual issue is not back-breaking: casts huge doubts to me on if i…
Two U.S. men have been charged with hacking into a U.S. Drug Enforcement Agency (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government…
A critical security vulnerability in Gumroad's API allowed anyone to generate unauthorized license keys for paid products without making a purchase.
By making a minor concession EU governments hope to find a majority next week to approve the controversial „chat control“ bill. According to the proposed child sexual abuse regulation (CSAR), providers of messengers, e-mail and chat services would be forced to automatically search all private messag
How we can be better at authentication security
Table of Contents
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
UPDATE: this post unexpectedly ended up on Hacker News and I received a lot of comments. The two most important points being made are (1) that Secure Boot on the RPi as …
On 26 Nov 2019 at 14:55 UTC, I logged into my server that hosts my website to perform a simple maintenance activity. Merely three minutes later, at 14:58 UTC, the domain name susam.in used to host this website was transferred to another registrant without any authorisation by me or without any notification sent to me…
I was a remote opening keynote speaker at ACM SCORED 2023 , which we decided meant that I sent a video to play and I was on Discord during the talk for attendees to text directly with question as the video played, and then we did some live but still remote Q&A after the talk.
Devices based on the i.MX8 or i.MX8M (such as the Librem phone or MNT Reform) have received popular coverage recently. The number of firmware blobs involved in the bringup of these devices is often a point of discussion. At times, people have considered whether some of these blobs could be replaced with libre…
Starting from the constraint that only sudo logrotate * may be run, and ending at root: abusing the log file flag to overwrite root owned scripts and ride cron to privilege escalation.
Trying to make the case for permanent irrevocable digital identities, which unfortunately today, by de-facto, are email addresses.
Countless smartphones seized in arrests and searches by police forces across the United States are being auctioned online without first having the data on them erased, a practice that can lead to crime victims being re-victimized, a new study found. In response, the largest online marketplace for items seized in U.S…
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late ’90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry Solinas, passed away in…
Some time ago I was using Logic Pro to record some of my music and I needed a way to start and stop the recording from an iPhone, so I found about Logic Remote…
This critical role would not be possible without funding from the OpenSSF Alpha-Omega Project. Massive thank-you to Alpha-Omega for investing in the security of the Python ecosystem! Python ...
This morning I received an interesting scam email. It might not be a new scam, but it was the first time I’d seen it.
10/18/2026: Drive Specifications Matter (Complete) 10/09/2026: Gear Review: XTEINK X4 Pro 10/09/2026: Gear Review: OLYVUE V78 Dash Cam 10/01/2026: UNREDACTED Magazine Issue 013 09/21/2026: Updated OSINT Scripts 09/20/2026: New Socials 08/29/2026: Blog Archive 08/20/2026: Free PDF Self-Publishing Guide 08/19/2026: OS…
