Topics /
The most popular blog posts about security & privacy on Hacker News. 717 posts.
Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.
This is a quick update about the status of Briar. Short version: the project is still active but we’re only making essential security updates and bugfixes for now. Long version: For several years we’ve been trying to find solutions to some of the longstanding issues with Briar, such as high battery usage and…
InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their…
Thanks for giving me a viable business model Amazon!
CISA lost a third of its staff and its acting leader uploaded sensitive docs to public ChatGPT, while China sits inside U.S. critical infrastructure.
Task Force Raider’s role in 2026 elections has military officers uneasy
Most supply-chain attacks against RubyGems exploit a narrow window: an account is compromised, a malicious version ships, and any bundle install in the minutes that follow resolves straight to it. ...
OpenAI is strengthening monitoring, alignment, and security for frontier AI models. See how new safeguards are guiding the pace of model development.
macOS ships a VulgarWordUsage.db and a dictionary that rates every word as vulgar, offensive or sensitive. Dumped for 199,000 English words and a dozen other languages.
By: Emily M. Bender and Decca Muldowney At a recent appointment, Emily’s physical therapist (who knows some about her research) said, “Before we get started,...
It finally happened. After months of speculation, Discord dropped the hammer: mandatory age verification for all users is rolling out next month. The era of anonymous gaming chats is officially over.
dict.cc requests users to consent to the tracking by 1,741 "partner" companies. This makes it impossible for people to know what happens to their data
The concept of “surveillance pricing” is just one part of a much larger problem and business model: corporations maximizing their profits by invading our privacy. The all-too-common business model is to systematically harvest, collate, and store as much of our personal data as possible, and then...
An attacker gained unauthorized access to environment variables for a subset of organizations. We've blocked the exploit and emailed all impacted account owners with steps to mitigate.
A few weeks ago, my longstanding friend and colleague Curt Cunning mentioned to me that he was slogging through Nietzsche, which bespeaks his incredible will to power through things that are unpleasant (one of the many things that makes him an exceptional engineer). In any case, it lead me to revisit some of his work…
The `unsafe` keyword is being redesigned to mark caller-facing contracts rather than just syntax. Safety obligations between callers and callees become visible and reviewable. The model is motivated by the rise of AI-assisted code generation and arrives as a preview in .NET 11.
An automated routing policy configuration error caused us to leak some Border Gateway Protocol prefixes unintentionally from a router at our Miami data center. We discuss the impact and the changes we are implementing as a result.
How the Verus "program verifier", which automatically checks code against a mathematical specification of its functionality, helps increase security assurance in software projects.
This blog post shows how to fix a buffer overflow in the su progam of UNIX v4
The smartwatch for children that Gustaf Blomqvist hacked in his thesis turned out to be a security disaster. The watch had an insecure network service that anyone could access via the internet.
FDR has always been one of my favorite presidents, second maybe to Lincoln. Both were men the establishment assumed were one of them until, to their horror, they governed like they weren't. Both could trash the opposition in one breath and take the moral high ground in the next.
Learn how to run NanoClaw, a Claude-powered WhatsApp assistant, inside a Docker Sandboxes shell sandbox for stronger isolation and proxy-managed API keys.
VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.
This is going to be a rant about modern web design practices. But before I get to that, let me begin with a familiar principle from the world of cryptography. Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does…
The Qualys Threat Research Unit has identified a Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. This flaw (CVE-2026-3888)…
