301
Trapping misbehaving bots in an AI Labyrinth
How Cloudflare uses generative AI to slow down, confuse, and waste the resources of AI Crawlers and other bots that don’t respect “no crawl” directives.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 679 posts.
302
A story on home server security
Happy New Year! Or so I thought. After a refreshing Christmas vacation with my family, I was stashing something away in our storage room when I noticed the server fan running at maximum speed. This was very unexpected, considering my server is powered by an Intel i3 and should handle all the light tasks I run quite…
303
If you are harassed by lasers
The green and blue "laser" dots at lower left are actually lens flare caused by the bright sun at upper right. The sun is reflecting off elements inside the lens, causing dots or flare. The flare is almost always located diagonally mirrored from a bright light source. Photo of a sunset, with upper and lower "beams"…
304
Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera
Claimed end-to-end privacy doesn’t fully conceal your rear-end data
305
DoubleClickjacking: A New type of web hacking technique
data:blog.metaDescription
306
Linux Kernel Exploitation: Attack of the Vsock
What started off as casual scrolling through the KernelCTF submissions quickly spiraled into a weeks-long deep dive into a deceptively simple patch - and my first root shell from a Linux kernel exploit!
307
Introduction to GrapheneOS
In this blog post, you will learn about the security oriented smartphone operating system GrapheneOS
308
TikTok unlawfully tracks shopping habits and use of dating apps?
TikTok tracks its users even if they're using other apps. The video platform therefore also knows what dating app you use
309
A dark adtech empire fed by fake CAPTCHAs
Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout…
310
Malware found in official gravityforms plugin indicating supply chain breach
Update 7-12-2025 06:00 UTC: We have observed some activity in regard to one of the backdoors that involves a gf_api_token parameter. The IP address 193.160.101.
311
CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code
Get details on our discovery of a critical vulnerability in GitHub Copilot Chat.
312
Unexpected security footguns in Go's parsers
File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production systems. We explore three real-world attack scenarios…
313
Hyperlight WASM: Fast, secure, and OS-free
We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine “micro-guest” that can run wasm component workloads written in many programming languages. Learn more.
314
Malware found on NPM infecting local package with reverse shell
For the first time, RL researchers discover malicious locally-installed npm packages infecting other legitimate packages.
315
New Vulnerability in GitHub Copilot, Cursor: Hackers Can Weaponize Code Agents
Pillar Security researchers have uncovered a dangerous new supply chain attack vector we've named "Rules File Backdoor." This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilot—the…
316
An inside look at NSA tactics, techniques and procedures from China's lens
Since I reside in a Five Eyes country (Australia) and have publicly presented four cases I led on China’s APT41 attacking organisations in ASEAN , particularly concerning China’s cyber and political strategies, I was curious to explore what China publishes about Five Eyes operations. This led me down a rabbit hole of…
317
How encryption for Cinema Movies works
The Cinema Industry is using its own standards for creating and distributing movies in a secure way. The DCI (Digital Cinema Initiatives) specification defines everything from file formats and encryption to the projection systems itself.
318
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
319
Build a tiny CA for your homelab with a Raspberry Pi
Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.
320
321
EU ruling: tracking-based advertising [...] across Europe has no legal basis
Landmark court decision against “TCF” consent pop ups on 80% of the internet
322
323
A new generation of Tailscale access controls
Grants are Tailscale’s next generation of access controls that combine network and application capabilities into a single syntax.
324
Memory-safe sudo to become the default in Ubuntu
May 6, 2025 – Ubuntu 25.10 is set to adopt sudo-rs by default. Sudo-rs is a memory-safe reimplementation of the widely-used sudo utility, written in the Rust programming language.
325
Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025
The Great Firewall of China (GFW) conducted a large-scale, unconditional block targeting TCP port 443 on August 20, 2025. This report documents the measurements and analysis we conducted of that event.
326
US authorities can see more than ever, with Big Tech as their eyes
Big Tech companies - Apple, Google, and Meta - have built a mass surveillance machine that the government can easily tap into.
327
How to Delete Your 23andMe Data
This week, the genetic testing company 23andMe filed for bankruptcy, which means the genetic data the company collected on millions of users is now up for sale. If you don't want your data included in any potential sale, it’s a good time to ask the company to delete it.
328
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
329
Data-at-Rest Encryption in DuckDB
DuckDB 1.4 ships database encryption capabilities. In this blog post, we dive into the implementation details of the encryption, show how to use it, and demonstrate its performance implications.
330
U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report
What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report,