241
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 356 posts.
242
Remotely unlocking an encrypted hard disk
what's a few systemd services in initramfs between friends?
243
Getting debug access on a Brother printer over Telnet
As it turns out, the Brother NC-8700w Command Console is more interesting than it first appears.
244
A peek into Reddit's anti-spam internals
How Reddit accidentally leaked its spamurai system.
245
Gone (Almost) Phishin'
This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes. One evening last month, my Apple Watch, iPhone, and Mac …
246
C2PA Cameras Do Not Survive Contact with Reality
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
247
The Kimwolf botnet is stalking your local network
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the…
248
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic…
249
Slightly safer vibecoding by adopting old hacker habits
I have seen a lot of public discussion around supply-chain attacks on the Python ecosystem, prompt injection risks when using coding agents,...
250
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
251
Horible public key tricks
So, I've always been somewhat annoyed at SSL/TLS. It requires everyone to go through a complex "ACME" dance just to put up a public website. Worse, certificates expire every few months, so it's not a one and done thing: even with automation, maintaining a certificate requires care to ensure the ACME client always has…
252
253
Let's discuss sandbox isolation
A dive into the spectrum of sandboxing and isolation, from Linux namespaces and gVisor to hardware-enforced microVMs and WebAssembly, and why picking the right boundary matters for multi-tenant workloads.
254
ICE Awards $25M Iris-Scanning Contract to Bi2 Technologies
The no-bid deal is five times the size of the agency's previous contract with the Massachusetts company and could put devices in agents' hands by late June.
255
256
Amazonbot is finally respecting robots.txt
Thanks for giving me a viable business model Amazon!
257
How the Military Will Hack the Election
Task Force Raider’s role in 2026 elections has military officers uneasy
258
I dumped Apple’s word list
macOS ships a VulgarWordUsage.db and a dictionary that rates every word as vulgar, offensive or sensitive. Dumped for 199,000 English words and a dozen other languages.
259
Refuse to let your doctor record you
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
260
261
Discord just killed anonymity
It finally happened. After months of speculation, Discord dropped the hammer: mandatory age verification for all users is rolling out next month. The era of anonymous gaming chats is officially over.
262
We are building data breach machines and nobody cares
A few weeks ago, my longstanding friend and colleague Curt Cunning mentioned to me that he was slogging through Nietzsche, which bespeaks his incredible will to power through things that are unpleasant (one of the many things that makes him an exceptional engineer). In any case, it lead me to revisit some of his work…
263
You Know GDPR Is Good Based on Who Hates It
FDR has always been one of my favorite presidents, second maybe to Lincoln. Both were men the establishment assumed were one of them until, to their horror, they governed like they weren't. Both could trash the opposition in one breath and take the moral high ground in the next.
264
Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
265
Dissecting Apple's Sparse Image Format (ASIF)
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
266
Don't Roll Your Own
This is going to be a rant about modern web design practices. But before I get to that, let me begin with a familiar principle from the world of cryptography. Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does…
267
Fooling around with encrypted reasoning blobs
Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …
268
I found 39 Algolia admin keys exposed across open source documentation sites
A systematic audit of Algolia DocSearch found 39 admin API keys exposed across projects like Home Assistant, KEDA, and vcluster.
269
I accidentally made law enforcement shut down their fake honeypot
How I stumbled across a fake booter site run by international police, and how they panicked when I started digging
270