Topics /
The most popular blog posts about security & privacy on Hacker News. 679 posts.
My new book guides you through the start-to-finish build of a real world web application in Go — covering topics like how to structure your code, manage dependencies, create dynamic database-driven pages, and how to authenticate and authorize users securely .
ACME, a brief history of one of the protocols which has changed the Internet Security Changelog 03 December 2025: article announced on Mastodon, LinkedIn and X. 03 December 2025: J.C. Jones published his reflections about 10 years of Let’s Encrypt. A must read! 03 December 2025: J.C. has also been kind enough to…
Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites…
Disclaimer: If you're here for the holy grail of bot detection, this may not be it, unless your UX strategy involves surprise popups and your marketing strategy involves blocking Google crawlers. We recently stumbled across a bug on the Chromium bug tracker where a short JavaScript snippet can crash
Trump paralysed the "Privacy and Civil Liberties Oversight Board" (PCLOB), a key element of the EU-US data transfer deal that allows EU-US data flows.
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve…
Bidding farewell to one of the last kernel address leaks, CVE-2025-53136. Even patches can open new doors for exploitation.
The DMCA online safe harbor is a notice-and-takedown scheme. Web hosts aren’t liable for copyright-infringing third-party uploads unless and until the copyright owner submits a proper takedown notice to the host, at which point the web host can remain legally...
For the past few years, cheats have evolved rapidly. First came memory reading aimbots, then colorbots, and now AI aim assist. Cheats have escaped the host PC. How does it affect the players and anti-cheats?
Over the course of years, RSA implementations gradually replaced Euler's totient function with Carmichael's totient function.
A 13‑year Redis flaw (CVE‑2025‑49844) allows attackers to escape Lua sandbox and run code on hosts. See Wiz Research’s analysis and mitigations.
With OpenSSL, it’s pretty easy to generate a simple self-signed TLS certificate . Just run the following command:
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
Anthropic's August 2025 threat intelligence report on AI cybercrime and other abuses.
From The world is entering an era where identity is no longer a matter of personal relationships, lived experience, or even paperwork. Increasingly, it is reduced to biometric scans, algorithmic ve…
If you’re fed up with Meta right now, you’re not alone. Meta tracks you across millions of websites and apps and its business model relies on your data. If you want to limit Meta’s ability to collect and profit from your personal data, here’s what you need to know.
Across the internet, users rely on browsers and extensions to shape how they experience the web: to protect their privacy, improve accessibility, block harmful or intrusive content, and take control ...
Marko Elez , a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury and Justice departments, and the Department of Homeland Security. So it should fill all Americans with a deep sense of…
© 2025 Peter N. M. Hansteen Long rumored and eagerly anticipated by some, the fourth edition of The Book of PF is now available for ...
At this summer's HOPE conference, Joshua Aaron spoke about ICEBlock, his iPhone app that allows users to anonymously report ICE sightings within a 5 mile radius, and to get notifications when others report ICE sightings near them. You can see the full talk, and the lively/infuriating Q&A,
This is the story of how I used a Gmail message to trigger code execution through Claude Desktop, and how Claude itself (!) helped me plan the attack.
The PHP Foundation — Supporting, Advancing, and Developing the PHP Language
Binary Security found the undocumented APIs for Azure API Connections. In this post we examine the inner workings of the Connections allowing us to escalate privileges and read secrets in backend resources for services ranging from Key Vaults, Storage Blobs, Defender ATP, to Enterprise Jira and SalesForce servers.
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
Why the Sanitizer API is just <code>setHTML()</code>
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets.
Updated May 1, 2025: CNCF and Synadia have come to an agreement to ensure that NATS continues to thrive as a healthy open source project within CNCF, with Synadia’s continued support and involvement.
Fast, Declarative, Reproducible, and Composable Developer Environments using Nix.
