gocryptfs is an encrypted overlay filesystem implemented in Go that mounts an encrypted "cipher" directory and exposes a decrypted view without modifying the underlying storage. Built on the go-fuse library and inspired by EncFS, it was designed to fix EncFS's security weaknesses while preserving or improving performance. Development reached 1.0 in 2016 and underwent a formal security audit in 2017; release tags from v0.4 onward are signed. The project emphasizes correct behavior under stress and compatibility with filesystem test suites (including a FUSE-adapted xfstests), provides tooling to decrypt files without FUSE or to encrypt directories offline, and advises keeping a printed master key backup to recover data if configuration or passwords are lost.
The repository documents practical details: Linux is the primary platform with beta macOS support and a Windows reimplementation (cppcryptfs). Installation options include distro packages or prebuilt binaries; building requires Go (1.13+) and optionally OpenSSL for faster AES-GCM on CPUs without AES-NI. Storage overhead is small (empty files 0 bytes, an 18-byte header for non-empty files, ~32 bytes per 4KB block for nonce+auth tag). Performance benchmarks show hundreds of MB/s for AES-GCM and XChaCha20 with configurable backends; a stable CLI ABI aids automation. Active maintenance and a detailed changelog record fixes and feature work (reverse mode, ownership flags, btrfs workarounds, macOS fixes, etc.).
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.