Topics /
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the…
The 'how' and 'why' of CORS, from start to finish.
Today, with the launch of Firefox 87, we are excited to introduce SmartBlock, a new intelligent tracker blocking mechanism for Firefox Private Browsing and Strict Mode. SmartBlock ensures that strong ...
In the distant past I was super into removing DRM from books and magazines (check out my posts on that topic: Removing Edge Magazine DRM , Removing Zinio DRM ). This interest eventually faded away, mostly because I just stopped using websites that wouldn’t allow me to download and own the products I paid for (kudos to…
Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.
The rise and fall of the largest bug bounty platform in the world
Everyone seems to be eager to pin the blame for the Sony hack on North Korea. However, I think it’s unlikely. Here’s why:1. The broken English looks deliberately bad and doesn’t e…
Microsoft Security Response Center Blog
Today, Mozilla and Google took action to protect the online security and privacy of individuals in Kazakhstan. Together the companies deployed technical so
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
While looking through the articles on a "social engineering" themed forum I discovered a relatively new scam scheme that shocked me. People create thousands of GitHub repositories with all sorts of things - from Roblox and Fortnite mods to "cracked" FL Studio and Photoshop. As soon as you download and
We are excited to announce the release of mitmproxy 11, which introduces full support for HTTP/3 in both transparent and reverse proxy modes. We’re also bringing in a ton of DNS improvements that we’ll cover in this blog post.
The move continues to expose communities across the country to toxic forever chemicals in tap water
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
A jury has ruled that Meta accessed sensitive information from women's reproductive health tracking app Flo without consent.
Author: Nitay Artenstein Introduction Fully remote exploits that allow for compromise of a target without any user interaction have become something of a myth in recent years. While some are occasionally still found against insecure and unpatched targets such as routers, various IoT devices or old versions of Windows…
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows.
Documentation and guides from the team at Fly.io.
この記事は日本語でも投稿されています: https://blog.ryotak.net/post/homebrew-security-incident/ (もし日本語が読める場合、筆者は英語がそこまで得意ではないため、日本語の記事を読むことをお勧めします。) (Official blog post about this incident is available here: https://brew.sh/2021/04/21/security-incident-disclosure/) Preface Homebrew project is running a “Vulnerability Disclosure Program”…
Certificates and public key infrastructure (PKI) are hard. No shit, right? I know a lot of smart people who''ve avoided this particular rabbit hole. Eventually, I was forced to learn this stuff because of what it enables: PKI lets you define a system cryptographically. It''s universal and vendor-neutral yet poorly…
JWT, JWE, JWS, etc. are terrible designs and need to be scrapped, not resuscitated.
Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
ESET researchers have discovered the first in-the-wild UEFI rootkit. Dubbed LoJax, the research team has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
A Hacker's Blog of Unintended Use and Insomnia.
Back in January this year we found a new family of cross-platform backdoors for desktop environments. After the discovery of the binaries for Linux and Windows systems, we have now finally come across the OS X version of Mokes.A.
Earlier this week, I read a really interesting piece on 3 things that need to be done to save the web [https://www.theguardian.com/technology/2017/mar/11/tim-berners-lee-web-inventor-save-internet] . The first observation was that "we’ve lost control of our personal data" and
