481
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 717 posts.
482
Remotely unlocking an encrypted hard disk
what's a few systemd services in initramfs between friends?
483
Getting debug access on a Brother printer over Telnet
As it turns out, the Brother NC-8700w Command Console is more interesting than it first appears.
484
A peek into Reddit's anti-spam internals
How Reddit accidentally leaked its spamurai system.
485
Gone (Almost) Phishin'
This is a little embarrassing to share, but I’d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes. One evening last month, my Apple Watch, iPhone, and Mac …
486
487
C2PA Cameras Do Not Survive Contact with Reality
You might have heard that C2PA is a technology that will miraculously save us from rampant AI forgeries, by having cameras cryptographically sign the images they capture. Hooray for cryptography !
488
120 days until Google restricts side-loading, declaring war on Android freedom
Starting 2027, Google will block apps on Android devices whose developers have not registered with Google, paid, and given their ID. It’s fair to say that Google is becoming Apple: Your device, their rules.
489
Six curl CVEs after OpenAI and Anthropic came back with zero
After frontier AI systems came up empty, AISLE surfaced six CVEs in curl, one of the world's most audited codebases. Its maintainers patched all six.
490
The Kimwolf botnet is stalking your local network
The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it’s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the…
491
IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay
WebKit-based browsers on iOS and macOS can be configured to route all web traffic through proxy servers, which is how Tor browsers on iOS and our own Psylo work. We found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass the configured proxy and send traffic…
492
The agent harness belongs outside the sandbox
Two architectures for running agent harnesses, the tradeoffs between them, and how we make skills and memories work when the harness isn't local.
493
Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
494
Malicious skills targeting Claude Code and Moltbot users
Malicious ClawdBot skills target ByBit, Polymarket, Axiom, Reddit and LinkedIn, installing malware on unsuspecting OpenClaw user machines.
495
Expanding Project Glasswing
We’re extending Project Glasswing to approximately 150 new organizations in more than fifteen countries
496
GrapheneOS recommended for domestic abuse victims
Looking for a DV safe phone in Australia? This 2026 guide covers tech abuse on normal phones, what a privacy phone can and cannot do, and where to get help.
497
Even 'uncensored' models can't say what they want
A safety-filtered pretrain can duck a charged word without refusing. It puts a fraction of the probability an open-data pretrain puts there. We call that...
498
Path to Astra: critical capabilities and frontier safeguards
Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.
499
Slightly safer vibecoding by adopting old hacker habits
I have seen a lot of public discussion around supply-chain attacks on the Python ecosystem, prompt injection risks when using coding agents,...
500
When str.lower() is a security vulnerability in Python
Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was...
501
1-Click RCE to steal your Moltbot data and keys
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary…
502
Memory Safe Inline Assembly
Since Fil-C 0.685, memory-safe inline assembly is supported on both X86_64 and ARM64.
503
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
38 zero-day security vulnerabilities, three critical, and the shift from disclosure to prevention in healthcare software
504
DeepSeek v4.1 Flash Is Now Our Best Hacking Model
DeepSeek’s 11/11 result showed why advanced agent benchmarks need to check both the outcome and the attack path: our audit confirmed six planned exploits and found five unexpected routes.
505
Infomaniak transitions to a foundation model to protect user data privacy
Infomaniak transfers the majority of its voting rights to a Swiss public-benefit foundation. Your cloud remains sovereign, independent, and true to its values. Forever.
506
507
Let's discuss sandbox isolation
A dive into the spectrum of sandboxing and isolation, from Linux namespaces and gVisor to hardware-enforced microVMs and WebAssembly, and why picking the right boundary matters for multi-tenant workloads.
508
Post-Mythos Cybersecurity: Keep calm and carry on
As some of those fears, uncertainties, and doubts about Mythos are starting to feel real, what can we do about it? Paradoxically, I believe that little needs to change in what we’ve been doing for years.
509
ICE Awards $25M Iris-Scanning Contract to Bi2 Technologies
The no-bid deal is five times the size of the agency's previous contract with the Massachusetts company and could put devices in agents' hands by late June.
510
