5551
A Git Horror Story: Repository Integrity With Signed Commits
(Note: This article was written at the end of 2012 and is out of date. I will update it at some point, but until then, please keep that in perspective.)
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
5552
Password reuse and credential stuffing
The short version: I'm loading over 1 billion breached accounts into HIBP. These are from 2 different "combo lists", collections of email addresses and passwords from all sorts of different locations. I've verified their accuracy (including my own record in one of them) and many hundreds of millions
5553
Jamming XKeyScore
Back in the day there was talk about "jamming echelon" by adding keywords to email that the echelon system was supposedly looking for. We ca...
5554
Spectre Mitigations in Microsoft's C/C++ Compiler
This form of Spectre can be used to attack a broad range of software -- operating systems, device drivers, web APIs, database systems, and almost anything else that receives untrusted input and may run on the same computer as untrusted code. Because large programs can contain literally millions of conditional branches…
5555
Experimenting with Post-Quantum Cryptography
Posted by Matt Braithwaite, Software Engineer Quantum computers are a fundamentally different sort of computer that take advantage of aspec...
5556
Who got arrested in the raid on the XSS crime forum?
On July 22, 2025, the European police agency Europol said a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS, a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS…
5557
Something Secret This Way Comes
On the Rust Lint Workshop, I started coding on a “secret” project (Actually I hinted at the possibility during our 100 clippy lints celebration). Now that I’ve built a prototype, it’s time to spill the beans: I wrote a new lint. One might even say a new type of lint. One of the interesting things about this lint is…
5558
Sealed Rust Update
Part 2 - The Plan
5559
The hacking of culture and the creation of socio-technical debt
Culture is increasingly mediated through algorithms. These algorithms have splintered the organization of culture, a result of states and tech companies vying for influence over mass audiences. One byproduct of this splintering is a shift from imperfect but broad cultural narratives to a proliferation of niche groups…
5560
5561
Dissecting Apple's Sparse Image Format (ASIF)
At WWDC 2025, Apple announced macOS 26 Tahoe. One of the new features in macOS Tahoe is a new disk image format: ASIF. Designed for use with virtual machines (its documentation lives under the Virtualization framework), ASIF takes a lot of inspiration from existing virtual disk formats. Practically, that means it’s…
5562
5563
The issue of anti-cheat on Linux (2024)
Why are developers so hesitant to bring anti-cheat solutions to Linux?
5564
Why are websites requesting access to motion sensors on my desktop? (2019)
I was checking the status of a FedEx order when Brave warned me that “this site has been blocked from accessing your motion sensors”. I’m struggling to understand why a website would need that access. Do I get a different experience if I drop my device? Tip my monitor over? Spin the mouse around?
5565
Recursion kills: The story behind CVE-2024-8176 in libexpat
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license .
5566
Extended Validation Certificates Are Really Dead
Almost one year ago now, I declared extended validation certificates dead [https://www.troyhunt.com/extended-validation-certificates-are-dead/]. The entity name had just been removed from Safari on iOS, it was about to be removed from Safari on Mojave and there were indications that Chrome would remove it
5567
Let yourself be monitored: EU governments to agree on Chat Control
Based on a new proposal by the Belgian Minister of the Interior, EU governments could endorse the much-criticised child sexual abuse regulation (CSAR or chat control) as early as June after all. This is what internal information leaked to Pirate Party MEP and shadow rapporteur Patrick Breyer reveals
5568
Comparing how security experts and non-experts stay safe online
Posted by Iulia Ion, Software Engineer - Rob Reeder, Research Scientist - Sunny Consolvo, User Experience Researcher Today, you can find...
5569
Leakage paths for the Apple / Google Bluetooth tracing system
Plus general overview
5570
How Secure Boot Works on M1 Series Macs
This article has now been extensively corrected and modified.
5571
5572
Tiny, tamper-proof ID tag can authenticate almost anything
A cryptographic tag developed at MIT uses terahertz waves to authenticate items by recognizing the unique pattern of microscopic metal particles that are mixed into the glue that sticks the tag to the item’s surface.
5573
Releasing rainbow tables to accelerate Net-NTLMv1 protocol deprecation
Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.
5574
Google does not want rights to things you do using Chrome (2008)
Alright, I’ve got another conspiracy theory misconception to dispel. :) After reading through the Chrome Terms of Service, some people are worried that Google is trying to assert rights on ev…
5575
Making Truth Social Comply with the AGPL
Defending Mastodon from Donald Trump's social media
5576
Apple wants to redefine what it means to violate your privacy. We mustn’t let it
Violation of privacy by proxy is still violation of privacy.
5577
The Death of Infosec Twitter
"Infosec Twitter," a vibrant community of security practitioners, known for its insight, inspiration, and entertainment, is coming to an end.
5578
EC2 Instance Connect
Discover more about what's new at AWS with Introducing Amazon EC2 Instance Connect
5579
Saying goodbye to encrypted SMS/MMS
It’s 2015, and the end of the road for encrypted SMS/MMS in TextSecure. The TextSecure story started back in 2009, at the dawn of the smartphone era. Back then, TextSecure focused on securing the transport that everyone coming from feature phones was familiar with: SMS. Today, many things have c...
5580