Security index
ABS: Android security underpinnings (February 28, 2013)
SELinux on Android (August 27, 2014)
Stagefrightening (July 29, 2015)
CopperheadOS: Securing the Android (February 17, 2016)
TLS certificate management on Android (March 2, 2016)
Four new Android privilege escalations (August 10, 2016)
Revenge of the modems (October 3, 2018)
Android wallpaper fingerprints (October 26, 2021)
Retrieving pixels from Android phones with Pixnapping (October 29, 2025)
Eavesdropping on Tor traffic (September 12, 2007)
TorProxy and Shadow (October 14, 2009)
The Amnesic Incognito Live System: A live CD for anonymity (April 27, 2011)
Phantom: Decentralized anonymous networking (June 8, 2011)
GNUnet adds VPN, direct wireless peering, and more (December 21, 2011)
Tor offers SSL obfuscation for users behind censorship walls (February 15, 2012)
Whonix for anonymity (October 17, 2012)
DeadDrop and Strongbox (May 22, 2013)
Tor and browser vulnerabilities (August 7, 2013)
Browser fingerprinting (October 16, 2013)
Spoiled onions and Tor exit relays (January 29, 2014)
Tails reaches 1.0 (April 30, 2014)
Anonymous, wireless file sharing with PirateBox (June 11, 2014)
Browser tracking through "canvas fingerprinting" (July 23, 2014)
Kernel support for SYN packet fingerprinting (May 20, 2015)
Tor and library freedom (August 5, 2015)
Tor Messenger (December 9, 2015)
The perils of federated protocols (May 18, 2016)
New browser-fingerprinting techniques (May 25, 2016)
Anonymous publishing with Riffle (July 20, 2016)
SecureDrop: anonymity and security for whistleblowers (March 29, 2017)
Recent improvements to Tor (March 28, 2018)
Avoiding "supercookie" tracking (February 3, 2021)
Android wallpaper fingerprints (October 26, 2021)
Rollercoaster: group messaging for mix networks (November 17, 2021)
Apache attacked by a "slow loris" (June 24, 2009)
Apache range request denial of service (August 31, 2011)
Linux security non-modules and AppArmor (June 27, 2007)
The future of AppArmor (October 17, 2007)
TOMOYO Linux and pathname-based security (April 14, 2008)
Application binary interface (ABI)
Cascading security updates (February 27, 2008)
Design for security (January 30, 2019)
Fedora accepting YubiKey one-time passwords (October 13, 2010)
OATH: yesterday, today, and tomorrow (December 15, 2010)
Trusted internet identity (January 12, 2011)
The end of OpenID? (February 2, 2011)
BrowserID: A new web authentication scheme (July 27, 2011)
Password storage on Android devices (August 3, 2011)
SSSD: System Security Services Daemon (September 27, 2011)
Enforcing password strength (October 12, 2011)
A Periodic Table of password managers (November 9, 2011)
FreeIPA: centralized identity management for Linux (December 11, 2012)
PyCon: Mozilla Persona (March 20, 2013)
FreeOTP multi-factor authentication (January 22, 2014)
The YubiKey NEO (April 16, 2014)
Multi-factor authentication with U2F (August 6, 2014)
Smartcard features on the YubiKey NEO (November 5, 2014)
One-time passwords and GnuPG with Nitrokey (July 27, 2016)
OpenID for authentication (December 7, 2016)
A comparison of cryptographic keycards (October 17, 2017)
Adding a "duress" password with PAM Duress (August 24, 2021)
Passwordless authentication with FIDO2—beyond just the web (February 21, 2023)
Fingerprint recognition using fprint (November 21, 2007)
Biometrics for identification (April 2, 2008)
A look at PAM face-recognition authentication (November 7, 2012)
Authentication bypass in routers (March 5, 2008)
Linux and automotive computing security (October 10, 2012)
The Internet of criminal things (September 23, 2015)
Inside the Volkswagen emissions cheating (January 6, 2016)
Automotive security and safety (January 27, 2016)
The Car Hacker's Handbook (March 16, 2016)
The backdooring of WordPress (March 7, 2007)
The backdooring of SquirrelMail (December 19, 2007)
A backdoor in UnrealIRCd (June 16, 2010)
Toward healthy paranoia (September 11, 2013)
event-stream, npm, and trust (November 28, 2018)
A backdoor in a popular Ruby gem (April 10, 2019)
How the XZ backdoor works (April 2, 2024)
Free software's not-so-eXZellent adventure (April 2, 2024)
Bash gets shellshocked (October 1, 2014)
Berkeley Internet Name Daemon (BIND)
Cache poisoning vulnerability found in BIND (July 25, 2007)
The dangers of weak random numbers (February 20, 2008)
Security in an error-prone world (November 3, 2015)
Core Infrastructure Initiative best-practices badge (June 8, 2016)
Book Review: Hacking VoIP (January 28, 2009)
Book review: Nmap Network Scanning (February 18, 2009)
The Car Hacker's Handbook (March 16, 2016)
Cracking Linux with the backspace key? (December 21, 2015)
Storm worm gains strength (August 29, 2007)
ITU getting serious about botnets (November 28, 2007)
Storm botnet used to study spam (November 12, 2008)
Linux botnets (March 25, 2009)
SCALE 8x: Ten million and one penguins (March 10, 2010)
Linux/Moose: Interesting but ineffective (June 3, 2015)
Session cookies for web applications (May 21, 2008)
Another kind of cookie (October 29, 2008)
Should web developers say no to cookie-based authentication? (March 24, 2010)
Capsicum: practical capabilities for UNIX (February 22, 2012)
Capsicum for Linux (July 2, 2014)
Counting vulnerabilities (June 22, 2007)
Cascading security updates (February 27, 2008)
Secrecy and the DNS flaw (July 9, 2008)
Injunction lifted against MIT students (August 20, 2008)
Partial disclosure (October 8, 2008)
Distribution advisories (November 26, 2008)
"Vishing" advisory targets Asterisk (December 17, 2008)
Vulnerability disclosure policies (July 7, 2010)
The future of vendor-sec (March 9, 2011)
Python vulnerability disclosure (April 27, 2011)
An odd vulnerability report for LibreOffice (October 5, 2011)
How long should security embargoes be? (February 8, 2012)
GitHub incidents spawns Rails security debate (March 7, 2012)
Responsible disclosure in open source: The crypt() vulnerability (June 6, 2012)
Stockpiling zero-day vulnerabilities (August 15, 2012)
A story of three kernel vulnerabilities (February 19, 2013)
Mayhem finds 1200 bugs (July 3, 2013)
Subverting Android package verification (July 10, 2013)
Full Disclosure back in full (April 2, 2014)
OpenBSD and the latest OpenSSL bugs (June 11, 2014)
Evaluating the LZO integer-overflow bug (July 9, 2014)
RPM Fusion, wiki defacement, and bug reporting (July 30, 2014)
An overhyped GHOST (January 28, 2015)
OpenOffice and CVE-2015-1774 (July 8, 2015)
Proprietary vulnerabilities (August 12, 2015)
Apache OpenOffice and CVE-2016-1513 (July 27, 2016)
Dirty COW and clean commit messages (October 21, 2016)
Vulnerability hoarding and Wcry (May 17, 2017)
CVE-2018-5390 and "embargoes" (August 14, 2018)
Improving the handling of embargoed hardware-security bugs (October 25, 2018)
Lessons from the linux-distros mailing list (October 27, 2021)
Kernel security reporting for distributions (August 16, 2023)
A flood of useful security reports (April 9, 2026)
CVE woes lead some to seek alternatives (March 9, 2016)
A new process for CVE assignment (March 8, 2017)
CVE-less vulnerabilities (June 25, 2019)
What to do about CVE numbers (October 4, 2019)
Resurrecting DWF (April 7, 2021)
The bogus CVE problem (September 13, 2023)
Supplementing CVEs with !CVEs (December 5, 2023)
A turning point for CVE numbers (February 14, 2024)
Capsicum: practical capabilities for UNIX (February 22, 2012)
CAP_SYS_ADMIN: the new root (March 14, 2012)
The trouble with CAP_SYS_RAWIO (March 13, 2013)
Capsicum for Linux (July 2, 2014)
Inheriting capabilities (February 11, 2015)
CAP_PERFMON — and new capabilities in general (February 21, 2020)
A crop of new capabilities (June 8, 2020)
CHERI with a Linux on top (September 24, 2025)
Breaking CAPTCHA (March 19, 2008)
GCC and pointer overflows (April 16, 2008)
Mozilla and CNNIC (February 3, 2010)
EFF analyzes SSL certificates and certificate authorities (August 11, 2010)
The case of the fraudulent SSL certificates (March 23, 2011)
Fallout from the fraudulent SSL certificates (March 30, 2011)
Certificates and "authorities" (September 7, 2011)
Convergence: User-controlled SSL certificate checking (October 19, 2011)
A ".secure" top-level domain (May 16, 2012)
Cyberoam deep packet inspection and certificates (July 11, 2012)
Debian and CAcert (March 18, 2014)
The EFF announces "Let's Encrypt" (November 19, 2014)
The Let's Encrypt certificate revocation scare (March 10, 2020)
Red Hat and IBM get certified (June 20, 2007)
Fedora and CAPP (December 10, 2008)
Core Infrastructure Initiative best-practices badge (June 8, 2016)
What chroot() is really for (October 3, 2007)
Unprivileged chroot() (March 15, 2021)
Comparing GCC and Clang security features (September 12, 2019)
Safer flexible arrays for the kernel (September 22, 2022)
Managing security for the cloud (October 8, 2014)
Where to store your encrypted data (October 22, 2014)
Mayhem finds 1200 bugs (July 3, 2013)
A Matrix overview (November 4, 2020)
Evaluating the LZO integer-overflow bug (July 9, 2014)
A report from the Enigma conference (February 14, 2018)
A proposed threat model for confidential computing (February 13, 2023)
Linux capabilities support for user namespaces (December 22, 2010)
LSS: Secure Linux containers (September 6, 2012)
Sandstorm personal cloud platform (June 25, 2014)
Hardware technologies for securing containers (September 10, 2015)
Audit, namespaces, and containers (September 8, 2016)
Filesystem images and unprivileged containers (September 14, 2016)
On the way to safe containers (September 21, 2016)
Network security in the microservice environment (April 12, 2017)
Kubernetes & security (April 19, 2017)
Securing the container image supply chain (May 17, 2018)
Easier container security with entitlements (May 24, 2018)
Measuring container security (December 11, 2018)
Handling the Kubernetes symbolic link vulnerability (December 19, 2018)
A container-confinement breakout (March 6, 2019)
Making containers safer (August 21, 2019)
System-call interception for unprivileged containers (June 29, 2022)
Progress for unprivileged containers (September 28, 2022)
Another runc container breakout (February 12, 2024)
Content blockers and Chrome's Manifest V3 (December 21, 2021)
HTML Subresource Integrity (June 29, 2016)
Improving control-flow integrity for Linux on RISC-V (June 13, 2024)
Core Infrastructure Initiative
Assessing risk with the Core Infrastructure Initiative (July 22, 2015)
Extended Validation certificates and cross-site scripting (March 12, 2008)
Mozilla's Content Security Policy (July 1, 2009)
Cross-site scripting here at LWN (November 4, 2009)
Chrome reflective XSS protection (November 4, 2009)
LCA: CSP for cross-site scripting protection (February 6, 2013)
A comparison of cryptographic keycards (October 17, 2017)
BruCON: Can we trust cryptography? (September 30, 2009)
Bitcoin: Virtual money created by CPU cycles (November 10, 2010)
Desktop Summit: Crypto consolidation (August 10, 2011)
On keys, trust, and webs (October 5, 2011)
Forward secure sealing (August 22, 2012)
A crypto library aimed at auditability (January 8, 2014)
Does Fedora need a system-wide crypto policy? (March 5, 2014)
The state of crypto in Python (April 30, 2014)
The WebCrypto API (July 2, 2014)
Darkcoin: A cryptocurrency with more anonymity (October 29, 2014)
The FREAK crypto downgrade attack (March 4, 2015)
The prospect of a crypto monoculture (March 30, 2016)
Breaking Libgcrypt RSA via a side channel (July 5, 2017)
ROCA: Return Of the Coppersmith Attack (November 14, 2017)
Reconsidering Speck (August 8, 2018)
Progress on Zinc (thus WireGuard) (September 26, 2018)
Zinc: a new kernel cryptography API (November 6, 2018)
Adiantum: encryption for the low end (January 16, 2019)
Cryptography and elections (January 28, 2020)
Desktop malware risk gets raised and patched (February 25, 2009)
A desktop "secrets" API (July 29, 2009)
Linux malware: an incident and some solutions (December 23, 2009)
Where are the non-root X servers? (September 8, 2010)
Linux autorun vulnerabilities? (February 9, 2011)
Libsecret revealed (April 4, 2012)
The perils of desktop tracking (April 18, 2012)
GUADEC: Imagining Tor built-in to GNOME (August 8, 2012)
A look at PAM face-recognition authentication (November 7, 2012)
Security implications for user interface changes? (November 28, 2012)
Prompt-free security for GNOME (August 14, 2013)
Matthew Garrett calls for the private, secure desktop (July 30, 2014)
GStreamer and the state of Linux desktop security (December 7, 2016)
Maintainers for desktop "critical infrastructure" (January 11, 2017)
Capturing web attacks with open proxy honeypots (July 3, 2007)
Bluepot: A honeypot for Bluetooth attacks (February 16, 2011)
Verifying the source code for binaries (June 26, 2013)
Security software verifiability (August 21, 2013)
Binary "diversity" (August 28, 2013)
Lots of progress for Debian's reproducible builds (January 21, 2015)
Reproducible Android app builds (February 18, 2015)
A status update on Debian's reproducible builds (September 16, 2015)
Reproducible builds (April 12, 2017)
Toward a fully reproducible Debian (June 15, 2018)
The history, status, and plans for reproducible builds (August 23, 2024)
Free user space for non-graphics drivers (June 3, 2020)
ParanoidLinux: from fiction to reality (October 1, 2008)
Tin Hat: secured by running from RAM (March 18, 2009)
BackTrack 4: the security professional's toolbox (January 20, 2010)
Fedora 13 to debut a security "spin" (March 3, 2010)
IPFire 2.5: Firewalls and more (April 28, 2010)
Qubes: security by virtualization (May 5, 2010)
Lightweight Portable Security (December 15, 2010)
Deliberately insecure Linux distributions as practice targets (April 6, 2011)
The Amnesic Incognito Live System: A live CD for anonymity (April 27, 2011)
Security testing with BackBox 2 (September 8, 2011)
Whonix for anonymity (October 17, 2012)
Tails reaches 1.0 (April 30, 2014)
A look at FreedomBox 0.2 (May 29, 2014)
Anonymous, wireless file sharing with PirateBox (June 11, 2014)
Sandstorm personal cloud platform (June 25, 2014)
What's new in FreedomBox 0.3 (January 28, 2015)
Qubes OS nears version 3.0 (May 28, 2015)
The private, anonymous desktop of Tails 2.0 (February 3, 2016)
CopperheadOS: Securing the Android (February 17, 2016)
Subgraph OS, a new security-centric desktop distribution (March 9, 2016)
New functionality and polish in FreedomBox 0.9 (June 2, 2016)
BlackArch: a distribution for pen testing (September 13, 2016)
Qubes OS 3.2 (November 9, 2016)
Life behind the tinfoil curtain (September 5, 2018)
Compartmentalized computing with CLIP OS (October 29, 2018)
PureOS: freedom, privacy, and security (December 23, 2020)
A modest update to Qubes OS (February 20, 2024)
LCA: How to improve Debian security (January 17, 2007)
Security hardening for Debian (February 6, 2008)
Eee PC security or lack thereof (February 13, 2008)
Debian, OpenSSL, and a lack of cooperation (May 14, 2008)
Debian vulnerability has widespread effects (May 14, 2008)
SELinux and Fedora (July 9, 2008)
Ubuntu, security response, and community contributions (July 16, 2008)
Fedora distributes new keys (September 10, 2008)
Distribution advisories (November 26, 2008)
Fedora and CAPP (December 10, 2008)
OpenVAS replacing Nessus in Debian (August 12, 2009)
Fedora 12 and unprivileged package installation (November 20, 2009)
Fedora's privilege escalation policy proposal (February 3, 2010)
FOSDEM'10: Maemo 6 platform security (February 10, 2010)
Distribution security response times (September 22, 2010)
A high-level view of the MeeGo security landscape (November 17, 2010)
The MeeGo security framework (November 24, 2010)
CentOS 5, RHEL 5.6, and security updates (February 23, 2011)
Arch Linux and (the lack of) package signing (March 23, 2011)
MeeGo rethinks privacy protection (April 13, 2011)
UDS security discussions (May 18, 2011)
Phones and permissions (June 2, 2011)
Security testing tools for Fedora (August 10, 2011)
Six years of RHEL 4 security (August 17, 2011)
Security response: how are we doing? (November 16, 2011)
How long should security embargoes be? (February 8, 2012)
Exploring options for the openSUSE security policy (May 23, 2012)
Fedora and secure release upgrades (December 19, 2012)
Distributions face the MoinMoin and Rails vulnerabilities (January 9, 2013)
Code authenticity checking (May 1, 2013)
Upgrading Debian's keys (February 26, 2014)
Does Fedora need a system-wide crypto policy? (March 5, 2014)
Debian forms Off-the-Record team (April 16, 2014)
Fedora's firewall furor (April 23, 2014)
Fedora mulls providing a local DNSSEC resolver (May 21, 2014)
Apt vulnerability sparks Debian security discussion (June 18, 2014)
The security of git.centos.org (July 16, 2014)
RPM Fusion, wiki defacement, and bug reporting (July 30, 2014)
Fedora 21 and its Workstation firewall (December 17, 2014)
Fedora and "strong" passwords (February 4, 2015)
Key management with Gentoo Keys (February 25, 2015)
Toward secure package downloads (March 25, 2015)
Fedora revisits password policies (April 8, 2015)
Previewing OpenWrt 15.05 (July 1, 2015)
Trouble at Linux Mint — and beyond (February 24, 2016)
Fedora and SELinux relabeling (July 7, 2016)
Debian to shift to a modern GnuPG (August 10, 2016)
Supporting UEFI secure boot in Debian (October 10, 2016)
Qubes OS and colored-border spoofing (October 26, 2016)
Debian considering automated upgrades (December 14, 2016)
Using systemd for more secure services in Fedora (December 21, 2016)
Toward a fully reproducible Debian (June 15, 2018)
Signing and distributing Gentoo (July 11, 2018)
Limiting the power of package installation in Debian (November 7, 2018)
Fedora security response time (April 29, 2020)
Removing run-time disabling for SELinux in Fedora (September 23, 2020)
OpenWrt and SELinux (September 30, 2020)
OpenWrt and self-signed certificates (November 18, 2020)
Bootstrappable builds (January 6, 2021)
A possible step toward integrity measurement for Fedora (January 8, 2021)
Fedora and supply-chain attacks (June 16, 2021)
Lessons from the linux-distros mailing list (October 27, 2021)
Adding fs-verity support for Fedora 36? (December 14, 2021)
Locked root and rescue mode (December 22, 2021)
Another Fedora integrity-management proposal (January 4, 2022)
Fedora and pkexec (February 2, 2022)
Kernel security reporting for distributions (August 16, 2023)
Trust and mirrors (July 16, 2008)
Attacks on package managers (April 8, 2009)
LSS: Security modules and RPM (October 3, 2012)
Subverting Android package verification (July 10, 2013)
SELinuxDenyPtrace and security by default (April 11, 2012)
Supporting secure DNS in glibc (November 18, 2015)
Fedora and DNSSEC (December 9, 2015)