6391
CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers
No single cloud fits all. Explore how we build a more flexible future with hybrid cloud.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
6392
Bringing Down a Copycat Site
Dec. 24, 2004: I received an e-mail from a former colleague in the shareware industry saying he had received an e-mail from a company selling our MailList King software and was surprised to hear we had sold it?
6393
Public DNS in Taiwan the Latest Victim of BGP Hijack
Guest Post: Traffic going through a public DNS in Taiwan was rerouted to an entity in Brazil for about three and a half minutes.
6394
6395
An interactive intro to Elliptic Curve Cryptography
A hands-on introduction to elliptic curve cryptography. Start with curve geometry, build point addition and scalar multiplication, see why ECDLP is hard, and then use that math in ECDH, ECDSA, and ECIES.
6396
Trust Issues: Exploiting TrustZone TEEs
Posted by Gal Beniamini, Project ZeroMobile devices are becoming an increasingly privacy-sensitiv...
6397
How I accidentally took down GitHub Actions (2019)
Last December, I was invited to a private bug bounty program to test a beta version of GitHub Actions. GitHub Actions is a workflow automation tool integrated with GitHub. One common use case of GitHub Actions is for CI builds – a project can fairly easily start up a Docker container every time they push a commit…
6398
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety…
6399
Bot or human? Creating an invisible Turing test for the internet
Behavioral and cognitive patterns distinguish humans from bots. Explore interactive demos and a practical framework for invisible Proof of Human.
6400
Detecting and countering misuse of AI
Anthropic's August 2025 threat intelligence report on AI cybercrime and other abuses.
6401
Convincing ChatGPT to Eradicate Humanity with Python Code
Full stack software engineer / entrepreneur specialized in AI agents, cybersecurity and graphics. In my free time I enjoy surfing, free diving, and contributing to open source software.
6402
6403
The mysterious case of missing URLs and Google's AMP
When I saw a speculative article about Google wanting to “kill” URLs appear in my news feed, I didn’t think too much about it. Trying to hide “ugly” URLs… well, that feels like a natural thing for an app to try and do. Designers of apps often (erroneously) assume that users cannot cope with “technical” things like…
6404
CloudFlare, SSL and unhealthy security absolutism
Let's start with a quick quiz: Take a look at haveibeenpwned.com [https://haveibeenpwned.com/] (HIBP) and tell me where the traffic is encrypted between: You see HTTPS which is good so you know it's doing crypto things in your browser, but where's the other end of
6405
6406
Obscurity Is a Valid Security Layer
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
6407
The clever reason scammers can’t spell (2019)
Anybody who doesn’t fall off their chair laughing is exactly who they want to talk to – Cormac Herley, Microsoft computer scientist.
6408
Multi-Account Containers Add-on on Mozilla VPN
At Mozilla, online privacy has always been one of our top priorities. Recently we announced Total Cookie Protection on Firefox Focus to combat cross-site t
6409
Anonymous Tor Phone
I was always curious about all that bad guys (criminals, drug dealers, hitman’s, thief’s etc.) using not very good and secure communication channels. Forgetting about whole OPSEC stuff. There is a lo
6410
6411
Advanced Denanonymization through Strava
Strava is getting some bad press, because its heatmap can be used to infer the existence and floorplan of various US/UK military and govt...
6412
Decentralized DNS with the Handshake Naming System
Starting since version 1.30, the Mac, Linux, and Windows Private Internet Access (PIA) desktop clients have come with the ability to change the selected
6413
Safe Native Code
Joe Duffy's Blog | Adventures in the high-tech underbelly
6414
6415
6416
AES-GCM and breaking it on nonce reuse
In this post, we will look at how the security of the AES-GCM mode of operation can be completely compromised when a nonce is reused.
6417
Making frontier cybersecurity capabilities available to defenders
Claude Code Security is one step towards our goal of more secure codebases and a higher security baseline across the industry.
6418
Abusing url handling in iTerm2 and Hyper for code execution
What are escape sequences
6419
The State of Linux Security
This is the state of Linux security. With the most important updates around Linux and open source security. From conferences to self-protection.
6420
DigiCert Revocation Incident (CNAME Domain Validation)
DigiCert will be revoking certificates that did not have proper Domain Control Verification (DCV). Before issuing a certificate to a customer, DigiCert validates the customer’s control or ownership over the domain name for which they are requesting a certificate using one of several methods approved by the CA/Browser…