An exploration of Bluesky’s wider AT Protocol ecosystem finds that information stored by third-party apps can be publicly visible and easy to inspect, even when users may not expect that. AT Protocol accounts can store data on personal data servers, or PDSs, which can be browsed with tools such as PDSls.dev. While investigating feed readers, the author examined Skyreader users’ public records and discovered that each subscribed RSS feed is saved with its full URL in an openly accessible data record. That means a person’s account can reveal which feeds they follow, including feeds they might prefer not to associate with their name.
The exposure goes beyond individual browsing: by searching a Bluesky relay for Skyreader subscription records and then querying users’ PDSs, the author collected more than 1,300 feed URLs without authentication or meaningful restrictions. Among them were a private Club MacStories feed that provided access to its content, paywalled 404 Media feeds, Patreon backer feeds, and private GitLab feeds. The author also found Discord-like apps that publish messages and a Twitch-style service whose chats can be watched and searched. The central concern is that public-by-design infrastructure does not ensure users understand what they are disclosing: data can be aggregated and searched at a scale that makes otherwise obscure activity and private content easy to expose.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.