Topics /
The most popular blog posts about security & privacy on Hacker News. 8,770 posts.
Dropbear is a small and lightweight SSH server and client that can replace OpenSSH on any POSIX platform such as GNU / Linux, * BSD, Cygwin … Dropbear is free software since it is released under MIT-style licenses.
Understanding the OpenSSH CVE-2023-25136 high vulnerability. Read our analysis with Proof-of-Concept, learn what's vulnerable, and discover remediations.
Spam on GitHub is getting out of control and affecting 10,000's of users daily. GitHub is seemly doing nothing about it, here is the proof.
During the week of June 8th, the Office of Personnel Management (OPM) announced that the records of all current and past US federal employees had been compromised. That includes standard employment information - address, social security numbers, etc - of over 4 million people ranging from a random forest ranger to US…
Securitum is a pure pentesting company specialising in the security of IT systems. We have experience in performing security audits (including penetration tests) - mainly for financial/e-commerce/industrial sectors. We have performed penetration tests and cyber security services for leading European banks (see…
I recently heard from a source in law enforcement who had a peculiar problem. The source investigates cybercrime, and he was reaching out for advice after trying but failing to conduct undercover buys of stolen credit cards from a well-known underground card market. Turns out, the cybercrime bazaar’s own security…
The Internet Engineering Task Force (IETF), the body that sets standards for the Internet, has...
Snapchat 's (and now Facebook Poke 's) main claim to fame is that it lets you send "self-destructing" image messages. Setting aside the debate about the uses of this beyond sexting , the key vulnerability in both apps is the built-in ability to take screenshots. Both take a reactive approach, where you're notified if…
Visit the post for more.
I'm joev, a security engineer 👋 You may know me from my work at Apple or on Metasploit, or from my CVEs.
Today, we’re announcing Sec-Gemini v1, a new experimental AI model focused on advancing cybersecurity AI frontiers. As outlined a year ago, defenders face the daunting t…
The Rails community has had a few high-profile security issues this week. They are well-summarized, with an alarming list of what follow-ons to expect, by Patrick McKenzie: What the Rails Security Issue Means for Your Startup.
Earlier this year, before Apple had too many goto fails and GnuTLS had too few , before everyone learnt that TLS heart-beat messages were a thing and that some bugs are really old , I started a tidy up of the OpenSSL code that we use at Google.
Update: In the HN discussion, awalton mentioned you can set CPUID flags in VMWare. Simply adding cpuid.7.ebx = "-----------0--------------------" to the vmx file will disable SMAP. Late last year, I upgraded my old MBP to the 2016 model with a Skylake processor. As I was debugging a kernel exploit, it turned out that…
Arctic Wolf®, the leader in security operations, has acquired Cylance, a pioneer of AI-based endpoint security.
Play Framework - The High Velocity Web Framework For Java and Scala
Note: The focus of this article is to explain the process of reverse engineering, and it is not continually updated to reflect ongoing changes in Facebook APIs. If you are looking for updated details, consider basing your work on open-source projects like mautrix/meta , which is developed by my employer Beeper .
Update August 11, 2026: A group of researchers from all over Europe were inspired by this post, and actually turned it into a real working attack! Check out their writeup and paper here. This is a …
The authoritative information platform for the semiconductor industry. Learn why TechInsights is the most trusted source of actionable, in-depth intelligence to the semiconductor industry.
Google recently launched GPUs on Google Cloud Platform (GCP), which will allow customers to leverage this hardware for highly parallel workloads. These GPUs are connected to our cloud machines via a variety of PCIe switches, and that required us to have a deep understanding of PCIe security.
