Zen is a free, MIT-licensed desktop tool that blocks advertising, trackers, and some malware across Windows, macOS, and Linux - not just in a single browser. It works with major browsers and many desktop apps, filtering individual web requests and removing empty ad spaces from pages. This lets it target specific URLs, unlike DNS blockers that generally block entire domains, while covering apps that browser extensions cannot reach. The project says it has more than 90,000 downloads, accepts community contributions, and includes regional filter lists alongside rules for ads, tracking, and malware.
Zen runs a proxy on the computer and routes system traffic through it, checking requests against filter lists; its decisions stay local, and it says it neither collects nor transmits browsing data. To inspect encrypted HTTPS traffic, it asks users to install a locally generated root certificate, which can be removed in settings. That system-wide approach has trade-offs: some apps bypass system proxy settings or use certificate pinning, and filter rules can disrupt websites or apps, requiring exclusions or changes to lists. Zen adds some processing to requests, though blocking unwanted downloads may reduce page traffic. It supports use with VPNs in many configurations and offers installers or setup options for different operating systems and hardware.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Apple is automatically blocking certificates tied to eight compromised eMudhra intermediate CAs, including TLS certificates that could impersonate websites. Most users need do nothing, but some Mac command-line tools may still accept them until a software update; administrators can remove affected roots from /etc/ssl/cert.pem sooner. (support.apple.com)
Google’s Gmail settings can allow email data to inform ad personalization. Users can turn off the relevant personalization and smart-feature settings to limit that use. (proton.me)
A viral post claims Claude Code found TikTok, Instagram, Facebook, and Snapchat recording conversations in the background, but provides no verifiable evidence. The allegations are unsubstantiated; users can review microphone permissions and background activity in their phone settings. (twitter.com)
Discover-Tech, previously linked to zero-click spyware delivery, was the top bidder for Starlink ad impressions in 105 countries, prompting researchers to warn of a possible surveillance operation targeting users. The activity may focus on countries where Starlink is banned or restricted, though the findings do not establish who is behind the effort or its exact purpose. (gizmodo.com)
A critical memory-corruption flaw in TianoCore EDK II UEFI firmware lets attackers run code during startup, before defenses such as Secure Boot take effect. The flaw affects firmware used by most server vendors and data centers, and attackers could use it to install persistent boot-time malware. (arstechnica.com)
Anthropic says its unreleased Claude model found and chained critical vulnerabilities in widely used software, including a one-click Chrome exploit that achieved remote code execution. The company reported the flaws to vendors; Google assigned and patched 62 related Chrome CVEs. (anthropic.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.