Topics /
The most popular blog posts about security & privacy on Hacker News. 8,768 posts.
Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things, the company’s data backups also were encrypted by Zeppelin. After two weeks of…
We’re delighted to announce the release of mitmproxy 8, a free and open source interactive HTTPS proxy. This release brings major improvements to mitmweb, our web interface, and new functionality for addon developers.
A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to…
Malicious hackers are exploiting a zero-day vulnerability in Versa Director , a software product used by many Internet and IT service providers. Researchers believe the activity is linked to Volt Typhoon , a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the…
This guide is written for the person very new to firewalling. Please realize that the sample firewall we build should not be considered appropriate for actual use. I just try to cover a few basics, that took me awhile to grasp from the better known (and more detailed) documentation referenced below
Notion AI was susceptible to data exfiltration via indirect prompt injection due to a vulnerability in which AI document edits are saved before user approval.
Posted by Brandon Azad, Project ZeroOne Byte to rule them all, One Byte to type them,One Byte to ...
Teleport’s Enhanced Session Recording feature can add vital extra visibility into commands being run on your systems.
If you're setting up a service where people can register their own usernames to be used as a hostname (username.example.com), email address (username@example.com), or URL path (example.com/username) within your domain, there are some common names you should avoid letting the general public register. Many …
In which I attempt to be pragmatic. Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess. Google has recently announced that Android users will only be able to install apps which have been digitally signed…
New immigration rules for the UK are being enforced starting February 2026. This means citizens of 85 additional countries (including the USA and European countries) will need an Electronic Travel Authorisation (ETA) to visit, even for tourism. Luckily, you can apply (and pay) digitally. Unfortunately, the government…
I ran command line macOS tools, such as Bash and Geekbench, on a jailbroken iPhone by replacing iOS’s dyld shared cache (all of iOS’s code) with macOS’s. However, graphical apps will never work: macOS’s WindowServer won’t start, since iOS’s drivers are too different.
Smart TVs are everywhere! But who is the master? Amid the electronics boom driven by A.I., one piece of electronics has remained almost unchanged financially. That is the digital display or flat-panel monitor. With good reason! The entire entertainment and streaming industry wants one of these devi
In September 2020, Brown University accused students of lying about their location; e.g.:
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
Jay Hou, Software Engineer, TrustFabric (transparency.dev) Pixel Binary Transparency was originally announced in 2021; the following blog ...
The new White House memo on zero trust is a strong signal that the US federal government is taking an active stance regarding cybersecurity. Not only does this have far-reaching ramifications for the public and private sectors, it also serves to cut through the noise about zero trust with an impartial source. Let’s…
It's finally time: it's time the pendulum swings further towards the "secure by default" end of the scale than what it ever has before. At least insofar as securing web traffic goes because as of this week's Chrome 62's launch, any website with an input box
I was surprised to see the Facebook SDK being loaded in the network tab on my blog when I don't have any Facebook buttons. It turned out to be coming courtesy of Disqus. No wonder Facebook knows everywhere you go!
I recently spun up a .onion mirror of this website.
Posted by Oliver ChangModern graphic drivers are complicated and provide a large promising attack...
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…
