Skip to content
HomeVideosBooksBlogs
AllTop postsTopics
Podcasts
HistoryListsWatch laterLiked videosFollowing

The videos, books, blogs and podcasts Hacker News keeps recommending, all in one place.

VideosBooksBlogsPodcastsAboutPrivacySettings

Data from Hacker News, HackerTube, HackerBooks, HackerBlogs and Open Library. Credits · Not affiliated with Y Combinator.

HomeVideosBooksBlogsPodcasts
Ctrl K

    Graham Cluley

    grahamcluley.com · Personal blog · on HN since 2008

    Graham Cluley, a longtime security analyst, writes news and commentary on malware, breaches, ransomware and online security practices.

    Visit blogRSSHN submissions
    Security
    What HN says

    One commenter calls it the one personal infosec blog besides Krebs, though 'watered down'; others cite it for password guidance and Stack Overflow code risks.

    Stats for nerds
    151HN people shared it
    144linked in comments
    2Kstory points
    Dec 2025last shared
    2008people per year2025

    Top posts on HN

    1. 1
      49% of workers, forced to change passwords, reuse same one with minor change
      1 person · 410 points · first shared 2019 · 306 comments on HN
    2. 2
      I can no longer recommend MailChimp
      1 person · 224 points · first shared 2017 · 146 comments on HN
    3. 3
      Feedly gets hit by DDoS attack, refuses to give in to blackmail
      1 person · 219 points · first shared 2014 · 134 comments on HN
    4. 4
      First actual computer bug was found today, 66 years ago
      1 person · 170 points · first shared 2013 · 44 comments on HN
    5. 5
      LG says it will push out firmware update for spy TVs, but no apologies
      1 person · 99 points · first shared 2013 · 51 comments on HN
    6. 6
      Bank refuses to pay ransom to hackers, sends dick pics instead
      1 person · 93 points · first shared 2022 · 9 comments on HN
    7. 7
      Insurance giant AXA hit by ransomware attack after it stops covering ransoms
      2 people · 69 points · first shared 2021 · 4 comments on HN
    8. 8
      Security researchers rewarded $12.50 voucher to buy Yahoo T-shirt
      2 people · 65 points · first shared 2013 · 20 comments on HN
    9. 9
      Metasploit website hijacked via fax
      1 person · 60 points · first shared 2013 · 21 comments on HN
    10. 10
      After raid on Covid whistleblower, it’s revealed password was on FL DoH website
      1 person · 44 points · first shared 2020 · 21 comments on HN

    What HN people wrote when they linked it

    • whoopdedoApr 2015

      To say that the "Chinese government" is involved I think understates the situation. We know as fact that their army has invested considerable time and money in a cyberwarfare unit. And that the company that operates the Firewall is a military contractor.

      When Sony was hacked a few months ago, the media couldn't wait to label it a "terrorist act" by North Korea.

      I just now searched Google News for "github terrorism".

      1. http://www.itpro.co.uk/security/24319/github-falls-victim-to-possible-chinese-cyber-attack

      2. https://grahamcluley.com/2015/03/github-ddos-attack/

      That's all, even though the evidence appears more clear that the Chinese government is involved. Whereas North Korea's responsibility was in doubt. The silence speaks volumes.

      But is "terrorism" even the correct word for this? When Saddam invaded Kuwait, was that a terrorist act? Consider this quote written by a Chinese military analyst 30 years ago:

      those who take part in information war are not all soldiers. Anybody who
      understands computers may become a "fighter" on the network. Think tanks
      composed of non-governmental experts may take part in decision-making;
      rapid mobilization will not just be directed to young people; information-
      related industries and domains will be the first to be mobilized and enter
      the war..

      (From http://fmso.leavenworth.army.mil/documents/chinarma.htm)

      However, the Chinese may respond by claiming this was a preemptive defense. That GreatFire.com was designed to…

    • bootloadJul 2008

      "... "I think the Mac user base will end up becoming polluted by some of the same people who have been infected time and time again in the Windows environment,” Mr Cluley says. “It's mainly the same people who buy a computer primarily to download porn and visit file-sharing sites." ..."

      quote from security specialist ~ http://www.grahamcluley.com

      "... 'I think Apple will start to become a victim of its own success. I think hackers will see this community as a soft target.' The particularly craven hackers, phishing fraudsters and malware writers ply the trade for cash, not kicks. They follow the big fish, looking to infiltrate victims' ..."

      The article author ~ http://www.bernhardwarner.com/about.html
      It's always a good idea to get a picture of who writes this tripe - It's "crackers" not "hackers". Misuse of the term makes the title misleading.

    • lIl-IIIlOct 2024

      It's been a long time since I've been into this, so my tastes might have changed.

      But my favorites were:

      Photopia, 9:05, and I-0 by Adam Cadre

      The Enchanter trilogy. My first introduction to Enchanter was actually this unofficial sequel: https://ifdb.org/viewgame?id=x6ne0bbd2oqm6h3a, which I loved.

      Slouching Toward Bedlam: https://en.wikipedia.org/wiki/Slouching_Towards_Bedlam

      If you like Zork, "Janitor" will make you laugh: https://ifdb.org/viewgame?id=utic1iedvvnnsf3a

      Also have very fund memories of Humbug and Jacaranda Jim (wow it took me a very long internet search to find the names.. I forgot almost everything about what those games were about, and all I had to go on is that they were DOS executables and that the author was some anti-virus author).

      https://grahamcluley.com/misc/jacaranda-jim/

      https://grahamcluley.com/misc/humbug/

    • noir_lordJun 2015

      > My only audio recording device is my webcam and it is incapable of being in use without the light being on as far as I am aware.

      You assume that the light isn't controlled by the same software, that's not always the case, the FBI has admitted this.

      https://grahamcluley.com/2013/12/webcam-spying-without-turning-led-researchers-prove-possible/

      I take the view that anything under software control or the control of a chip I can't open is suspect, I've taped the webcam on laptops and physically disconnected built in microphones (I use a headset, built in ones suck).

      I'm not really happy about my Nexus 4 at all either, I think my next phone will be a dumb mobile.

      The sad thing is that I try to avoid paranoia with this stuff but the threat landscape is so large it's practically a full time job staying up to date with whats going on.

    • luchDec 2020

      I don't think this is a thing for two reasons :

      * firstly, not many people outside the security world knows that bugs are a valuable commodity for attackers. Same thing with internal orgs diagrams which are something you can sell to economic intelligence firms.

      * secondly, top-tier orgs like FAANG usually peppers a lot of telemetry around known bugs in production code in order to see if someone isn't exploiting them (or simply to better track down the root cause).

      That being said, attackers are reaaaaaally interested in getting access to internal bug trackers : https://grahamcluley.com/microsoft-bug-tracking-hack/

    • harryfMar 2018

      > because users OK all that when they sign up

      Reminds me of the "Facebook Security Simulator" game that was made around that time - https://www.grahamcluley.com/facebook-security-simulator/ and the term "privacy zuckering" was invented round about then to describe this UX dark pattern - https://darkpatterns.org/types-of-dark-pattern/privacy-zuckering

      So while Facebook may be on safe ground here _legally_ there was still an obvious train crash coming back then; when users they tricked into sharing everything find out what they actually agreed to

    Related

    Krebs on Securitykrebsonsecurity.com1.4k people

    Whistleblower: Ubiquiti Breach “Catastrophic”

    Krebs on Security
    Personal · last shared 2026
    Naked Securitynakedsecurity.sophos.com740 people

    Serious Chrome zero-day

    Naked Security
    Company · last shared 2023
    Check Point Research Blogblog.checkpoint.com80 people

    Malicious Subtitles Threaten Kodi, VLC and Popcorn Time Users

    Check Point Research Blog
    Company · last shared 2026
    Errata Securityblog.erratasec.com357 people

    Extracting the SuperFish certificate

    Errata Security
    Personal · last shared 2025
    Sophos Newsnews.sophos.com55 people

    ‘Fleeceware’ apps overcharge users for basic app functionality

    Sophos News
    Company · last shared 2025
    Dubfireparanoia.dubfire.net44 people

    Responding to Wired's ad hominem hatchet job

    Dubfire
    Personal · last shared 2023
    Last Week in AWSlastweekinaws.com184 people

    Why I Turned Down an AWS Job Offer

    Last Week in AWS
    Personal · last shared 2026
    Securelistsecurelist.com368 people

    Operation Triangulation: What you get when attack iPhones of researchers

    Securelist
    Company · last shared 2026