Topics /
The most popular blog posts about security & privacy on Hacker News. 8,762 posts.
EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. This decision impacts Google’s, Amazon’s and Microsoft’s online advertising businesses.
Security reviews of modern Windows Active Domain infrastructures are – from our point of view – quite sobering. Therefore, we often look left and right, when, for example, examining the hardening of protection mechanisms of a workstation. Here, we often find all sorts of dangerous and ill-conceived stuff. We want to…
I’ve been an SELinux complexity apologist for years. Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.
Edited to add: I wrote a followup post to address comments here and elsewhere that advertising is working as intended. This paper has been ...
In essence, a phishing attack is a kind of hack used by cybercriminals to trick victims into performing a certain activity. These emails are frequently sent
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
Encrypting data at rest is vital for Cloudflare with more than 200 data centres across the world. In this post, we will investigate the performance of disk encryption on Linux and explain how we made it at least two times faster for ourselves and our customers!
Fighting censorship with technology since 2011. We use AI to monitor censorship and expand free speech worldwide.
17 out of 20 popular VPNs exit traffic from different countries than they claim. Dig into what that means and why it matters in our VPN report.
[German]It seems that Google has established a surveillance function for Android phones. They are claiming the right, to collect and store meta data from incoming/outgoing phone calls and SMS from…
If you have just/as of late gotten an email about your keys being revoked, this is because of me, and if you have, you should really go through and make sure that no one has done anything terrible to you, since you have opened yourself to people doing very mean things to you for what is most likely a very long time.
A Council of the European Union document leaked by Statewatch on 30 August reveals that during the summer months, that Estonia (current EU Presidency) has been pushing the other Member States to strengthen indiscriminate internet surveillance, and to follow in the footsteps of China regarding online censorship…
Apple AirTags: Arbitrary data can be uploaded from non-internet-connected devices by sending Find My BLE broadcasts to nearby Apple devices. We're releasing an ESP32 firmware that turns the microcontroller into an (upload only) modem, and a macOS application to retrieve, decode and display the uploaded data.
Bypassing certificate pinning in Meta’s Messenger application on macOS.
I've wanted to write a blog post for everyone who learns things the same way that I do; by trying to break them. I'll start off with an awfully flawed implementation that authorizes a user with a 3...
Use Dagster, dbt, and BigQuery to analyze suspicious GitHub star activity and protect open-source credibility.
JFrog finds a new supply chain attack targeting python developers using the PyPI repository
right to repair laws should include provisions requiring manufacturers to unlock a device's bootloader (to provide root access) upon consumer request.
Access to this page requires authorization. You can try signing in or changing directories .
[What follows are my thoughts on some recent research in machine learning privacy. These are my thoughts, and do not represent those of others.]
OpenAI built an autonomous pipeline that found, validated, and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel.
Claude Code 2.1.277 added AGENTS.md support, but the loader sits behind a remote feature flag. With telemetry or nonessential traffic turned off, a local AGENTS.md is skipped without a warning. This is what I measured and the one-line CLAUDE.md I use instead.
Mass surveillance costs millions of Dollars. Yet, it does not improve security.
Edit: It seems that the blog post and the thesis caused quite some interest. Please contact me under the following mail address: admin [|[at]|] incolumitas [[|dot|]] com In this blog post, it is demonstrated how 17000 computers were forced to execute arbitrary code by typosquatting programming language…
