2011
How I re–over-engineered my home network for privacy and security
How I used Docker Compose, Ansible, and Caddy to re-over-engineer my network setup for easier maintenance, treating my Raspberry Pi like cattle, not a pet.
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 8,767 posts.
2012
How the Dreamcast Copy Protection Was Defeated
After I shipped the DOOM Black Book , I took some vacation in Japan where I was able to play Ikaruga on a real arcade at Taito HEY in Akihabara. The experience reignited my interest in SEGA's ultimate video game console, the Dreamcast. There is a lot of documentation available online which made the studying process…
2013
What I Learned Trying to Secure Congressional Campaigns
You know how it happens. You try to secure one Congressional campaign, and then another, and pretty soon you can't stop. You'll fly across the country just to brief a Green Party candidate in a district the Republicans carried by 60 points. You want more, more, always looking for that next fix.
2014
Spotting base64 encoded JSON, certificates, and private keys
A colleague spotted base64-encoded JSON in a long string of gibberish without any tools. I was amazed, until he explained how anyone can do it.
2015
‘Evil Corp,’ a $100M Cybercrime Menace
The U.S. Justice Department this month offered a $5 million bounty for information leading to the arrest and conviction of a Russian man indicted for allegedly orchestrating a vast, international cybercrime network that called itself “ Evil Corp ” and stole roughly $100 million from businesses and consumers. As it…
2016
Twitter, Reddit support challenge of visa applicant social media requirement
WASHINGTON – Twitter, Reddit, and Internet Association filed an amicus brief late yesterday in support of a lawsuit filed last year by the Knight First Amendment Institute at Columbia University, the Brennan Center for Justice, and Simpson Thacher & Bartlett LLP on behalf of plaintiffs Doc Society and International…
2017
2018
Don't trust AI agents
AI agents need a security model that assumes things will go wrong. The right response isn't better permission checks, it's architecture that makes trust unnecessary.
2019
2020
50 CVEs in 50 Days: Fuzzing Adobe Reader
Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the number from the year before (see table below). The probable reason for this is the increased…
2021
Toward a Reasonably Secure Laptop
It’s no secret that hardware selection is one of the biggest hurdles Qubes users face. Finding a computer that is secure, trustworthy, and compatible is more difficult than it should be. In an effort to address the compatibility aspect of that problem, we introduced the Qubes-certified ...
2022
2023
CVE-2021-22555: Turning \x00\x00 into 10000$
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
2024
Beware: Windows 10 Signature Edition Blocks Installing Linux
We help you acquire the perfect domain for your site. Affordable payment options. Quick and responsive customer support available.
2025
Authenticated Boot and Disk Encryption on Linux
Posts and writings by Lennart Poettering
2026
2027
Air Gaps
Since I started working with Snowden’s documents, I have been using a number of tools to try to stay secure from the NSA. The advice I shared included using Tor, preferring certain cryptography over others, and using public-domain encryption wherever possible. I also recommended using an air gap, which physically…
2028
Linux Sandboxes and Fil-C
Memory safety and sandboxing are two different things. It's reasonable to think of them as orthogonal: you could have memory safety but not be sandboxed, or you could be sandboxed but not memory safe.
2029
2030
Mozilla solves the Manifest V3 puzzle to save ad blockers
Google Chrome's new platform for extensions, Manifest V3, threatens to limit the functionality of ad blockers. Firefox has found a way around this problem. Read how.
2031
O2 VoLTE: locating any customer with a phone call
Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.
2032
2033
2034
2035
More Encryption, More Notifications, More Email Security
Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw Engineer Today, we’re announcing a variety of...
2036
Have I Been Pwned Is Now Partnering with 1Password
The penny first dropped for me just over 7 years ago to the day: The only secure password is the one you can't remember [https://www.troyhunt.com/only-secure-password-is-one-you-cant/]. In an era well before the birth of Have I Been Pwned [https://haveibeenpwned.
2037
Inside ZCode: Silently uploading your Git history to the cloud
ZCode silently uploads full Git history to the cloud; this post provides a block rule and source review — checkpoint claims fall apart against the code.
2038
7-Zip: From Uninitialized Memory to Remote Code Execution
Blog about anti-virus software vulnerabilities.
2039
Login Forms Over HTTPS, Please
Update: This feature is now also enabled in Firefox Beta, starting with Firefox Beta 50. Pretty much everyone who uses the web has used a password to log into something. ...
2040
Let’s Encrypt to transition to ISRG root
Let's Encrypt have announced that on July 8th, 2019 they will begin issuing new certificates from their own intermediate CA and not their current cross-signed intermediate. Here's what that means and what action, if any, site operators need to take…