Bilingual

Show HN: Watch bots interact with an SSH honeypot in real time
6 days ago
- The dashboard provides live telemetry from an SSH honeypot for security research, threat intelligence, and education.
- Displayed data (IP addresses, usernames, passwords, commands, fingerprints, metadata) comes from inbound connections; IP addresses may not identify the actual attacker.
- Data includes attacker-supplied content (commands, credentials, URLs, malware) and should not be considered verified or safe to execute.
- Contact the site operator if any displayed data raises security, privacy, or abuse concerns for review and removal.
The Legal Risks That Chill Good-Faith Security Research
14 hours ago
- Anti-hacking laws like the U.S. CFAA and U.K. CMA are broad and ambiguous, failing to distinguish malicious hacking from good-faith security research, causing a 'chilling effect' that discourages valuable research.
- Contract law (e.g., terms of service) is the most cited legal risk, not anti-hacking laws; researchers face threats for violating terms when studying systems.
- Legal risks lead to 'stockpiling' of vulnerabilities, where researchers withhold findings due to fear of legal consequences, making them targets for hacking or coercion.
- Researchers report significant personal and emotional tolls, including fear, stress, and even incarceration, from legal threats arising from their work.
- Institutional lawyers often prioritize protecting the university over the researcher, while personal legal counsel can help de-escalate threats.
- The current political climate increases risks for researchers, with politically motivated legal threats and academic hostility, especially in social computing.
- Researchers are motivated by a sense of public service and duty to improve security, despite legal risks, and often rely on early legal advice and anonymity measures.
- Recommendations include developing contingency plans, company pledges, supportive publication policies, and government support for research disclosure.
Restructuring GitHub's bug bounty program
5 hours ago
- GitHub's bug bounty program is introducing a permanent VIP program for researchers who consistently deliver high-quality work, with higher payouts and faster response times.
- The public bounty program is being restructured to static payouts per severity level, reducing uncertainty and overhead.
- A signal requirement is being implemented on the public program to reduce low-effort and AI-generated reports, allowing initial submissions for newcomers.
- The program aims to incentivize quality over quantity, with a focus on deeper relationships and better findings.
- Existing reports submitted before July 27, 2026 will be honored under the previous bounty structure.
- GitHub is investing in faster response times, clearer severity reasoning, and more community engagement at conferences.

Hasty Briefsbeta

#security research

Show HN: Watch bots interact with an SSH honeypot in real time

The Legal Risks That Chill Good-Faith Security Research

Restructuring GitHub's bug bounty program