Topics /
The most popular blog posts about security & privacy on Hacker News. 8,772 posts.
When they start using Docker, people often ask: “How do I get inside my containers?” and other people will tell them “Run an SSH server in your containers!” but that’s a very bad practice. We will see why it’s wrong, and what you should do instead.
This post is about a Man in the Middle (MitM) vulnerability in KeePass 2’s automatic update check. KeePass – the free and open source password manager – uses, in all versions up to the current 2.33, unencrypted HTTP requests to check for new software versions. An attacker can abuse this automatic update check – if…
Android 12, Pixel 6
Browsers have always been an arena for fighting and flaming over why your browser is the best and has the most features, while all others are inferior and un...
It has been a really long time since I last wrote something here as life happens, things get busier, etc etc. I am now trying to get back into writing things down and here we go! So, imagine a tool or a service that allows you to run some arbitrary code via a shell. Either through a ssh or more commonly, via a web…
Segment's Incident and Scheduled Maintenance History
This is the second article in the “reproducible builds” series. Previously: Improvements in testing and building: GitLab CI and reproducible builds. In the previous article, Improvements in testing and building: GitLab CI and reproducible builds, we discussed reproducible builds and our...
Survival in an Extremely Adversarial Environment If your secure communications platform isn’t being used by terrorists and pedophiles, you&# …
Byte swapping does not necessarily imply the data comes from an external source. For example, when writing graphics code, you sometimes need to do byte swapping if you’re converting between 24-bit RGB and BGR image formats (Windows’ GDI famously uses BGR so this is one place where you need to do such conversions)…
A small HTTP-header tribute to Sir Terry Pratchett
Stealing Chrome Cookies without root or password on OSX, Linux, and Windows via Remote Debugging Protocol.
Demonstrating how a weak session secret can allow an attacker to take control of a server
Today I went to launch VMware 4.1.0 on my OS X 10.8.1 Mac and was met with this surprising refusal to open:
An incomplete list of (technical) things just about anybody working in Information Security would benefit from knowing.
I awoke this morning to find my account on Twitter ( @briankrebs ) had attracted almost 12,000 new followers overnight. Then I noticed I’d gained almost as many followers as the number of re-tweets (RTs) earned for a tweet I published on Tuesday . The tweet stated how every time I tweet something related to Russian…
Research on aligning AI with human values and intent, and reports documenting model failures.
Warning: Half-satire, half-truth
I have been seeing this paper by cryptographer Peter Schnorr making the rounds: “Fast Factoring Integers by SVP Algorithms.” It describes a new factoring method, and its abstract ends with the provocative sentence: “This destroys the RSA cryptosystem.” It does not. At best, it’s an improvement in factoring—and I’m not…
As promised, here is the Linux Foundation UEFI secure boot system. This was actually released to us by Microsoft on Wednesday 6 February, but with travel, conferences and meetings I didn’t really get time to validate it all until today. The files are here
Background On April 16, 2025, Apple released a patch for a bug in CoreAudio which they said was “Actively exploited in the wild.” This flew under the radar a bit. Epsilon’s blog has a great writeup of the other bug that was presumably exploited in this chain: a bug in RPAC. The only thing out there that I am aware of…
