2701
Writing Exploit-Resistant Code with OpenBSD
On April 27, 2019, I gave a talk on how to use OpenBSD to write better software at CarolinaCon 15 in Charlotte.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,335 posts.
2702
Zero Trust Information
Zero Trust Networking is security with Internet assumptions; there is tremendous value if we apply the same approach to information.
2703
Sexual Harassment at DefCon (and Other Hacker Cons)
Excellent blog post by Valerie Aurora about sexual harassment at the DefCon hackers conference. Aside from the fact that this is utterly reprehensible behavior by the perpetrators involved, this is a real problem for our community. The response of “this is just what hacker culture is, and changing it will destroy…
2704
How does Ada's memory safety compare against Rust?
A comparison of how well Rust and Ada prevent the most common memory-related software errors.
2705
Rules for Writing Safety Critical Code (2006)
Ten rules for writing safety critical code, to facilitate analysis and increase software reliability
2706
Don’t underestimate grep-based code scanning
Static analysis tools (SAST) are perhaps the most common tool for an AppSec team in the endless effort to move security to the left. They can be integrated into development pipelines in order to of…
2707
Battle with bots prompts purge of Amazon, Apple employee accounts on LinkedIn
On October 10, 2022, there were 576,562 LinkedIn accounts that listed their current employer as Apple Inc. The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at Amazon comes as LinkedIn is struggling to combat a significant uptick in…
2708
Sandboxing all the things with Flatpak and BubbleBox
A few years ago, I have blogged about my approach to sandboxing less-trusted applications that I have to or want to run on my main machine. The approach has changed since then, so it is tim...
2709
2710
ICE Is Buying a Tool to Track Phones, Without Warrants
Trump is quietly building a surveillance state, and almost no one is paying attention.
2711
Alexa leaks private wishlists
This morning, my wife noticed that Alexa was insistently flashing its little blue lights. "Alexa... Notifications?" "You have one notification. An item on your wishlist has dropped in price. The … is now only £…" And that's how my wife found out what I planned to get her for her birthday! What happened to cause this?…
2712
ZombAIs: From Prompt Injection to C2 with Claude Computer Use
A few days ago, Anthropic released Claude Computer Use, which is a model + code that allows Claude to control a computer. It takes screenshots to make …
2713
2714
Half of All Phishing Sites Now Have the Padlock
Maybe you were once advised to “look for the padlock” as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock…
2715
Bug finding is slow in spite of many eyeballs
"given enough eyeballs, all bugs are shallow" The saying (also known as Linus' law) doesn't say that the bugs are found fast and neither does it say who finds them. My version of the law would be much more cynical, something like: "eventually, bugs are found", emphasizing the 'eventually' part. (Jim Zemlin apparently…
2716
2717
Own your calendar and contacts with OpenBSD, Baïkal, and FOSS Android
Writer for Semaphore and ButterCMS. Previously Staff Engineer at Deliveroo and in technical leadership at various public sector organisations.
2718
We are building data breach machines and nobody cares
A few weeks ago, my longstanding friend and colleague Curt Cunning mentioned to me that he was slogging through Nietzsche, which bespeaks his incredible will to power through things that are unpleasant (one of the many things that makes him an exceptional engineer). In any case, it lead me to revisit some of his work…
2719
2720
2721
Reverse engineering Solos smart glasses
First and foremost: If you’ve got any documentation on this hardware, please contact me! I would love to read the actual specs for this protocol.
2722
How to decrypt WhatsApp end-to-end media files
At the center of the "Saudis hacked Bezos" story is a mysterious video file investigators couldn't decrypt, sent by Saudi Crown Prince MBS t...
2723
The Evolution of Privacy on Facebook
Facebook is a great service. I have a profile , and so does nearly everyone I know under the age of 60.
2724
A first look at Ghidra’s Debugger – Game Boy Advance Edition
Building Ghidra and reviewing the debugging features
2725
2726
Our Git Hash Bug
Things this developer thinks might be interesting to you.
2727
2728
Privacy Protects Bothersome People (2013)
We need to support privacy, not for those of us who have "nothing to hide", but for bothersome people like investigative journalists and activists, without which our democracy would crumble
2729
What the QWAC? An EV Certificate all over again
Almost 2 years on from the last time I wrote about QWACs, I'm sadly not here to tell you that things have gone well since then. In fact, I'm actually here to tell you that things are not going well at all... QWAC Back in Jan 2022, I
2730
Using a Yubikey as a touchless, magic unlock key for Linux
Yubikeys are great for security, but their benefits decrease somewhat when you leave them in your computer unattended. I also have login passwords that are way too long. How to solve these problems? Use a Yubikey to unlock your computer!