Positive Security
positive.security · Company blog · on HN since 2021
Positive Security is a security research firm that publishes vulnerability findings, including the AirTag-based data upload and Lodash prototype issues.
What HN saysHN commenters cite it for technical write-ups such as the Apple FindMy bypass, urlscan.io data leaks, and library vulnerabilities in Lodash, Ramda and Underscore.
23HN people shared it
11linked it in comments
20stories submitted
1.5Kstory points
3 months agolast shared
2021people per year2026
Most-shared posts
- 1Emulating AirTags to upload arbitrary data via Apple's FindMy network5 people · 491 points · first shared 2021 · 129 comments on HN
- 2Find You: Building a stealth AirTag clone3 people · 225 points · first shared 2022 · 102 comments on HN
- 3Urlscan.io’s SOAR spot: Chatty security tools leaking private data3 people · 65 points · first shared 2022 · 7 comments on HN
- 4BlinkenCity: From Art Project to Europe-Wide Blackout Scenario3 people · 19 points · first shared 2025 · 2 comments on HN
- 5Allow arbitrary URLs, expect arbitrary code execution3 people · 14 points · first shared 2021 · 1 comments on HN
- 6Linux marketplaces vulnerable to RCE and supply chain attacks2 people · 18 points · first shared 2021 · discussion on HN
- 7Ransacking your password reset tokens2 people · 9 points · first shared 2023 · discussion on HN
- 8Vulnerabilities in the hidden magic of Lodash, Ramda and Underscore2 people · 6 points · first shared 2025 · discussion on HN
- 9Hacking Auto-GPT and escaping its Docker container2 people · 5 points · first shared 2023 · 1 comments on HN
- 10Microsoft Teams: 1 feature, 4 vulnerabilities1 people · 340 points · first shared 2021 · 256 comments on HN
- 11Recovering redacted information from pixelated videos1 people · 203 points · first shared 2022 · 66 comments on HN
- 12Windows 10 RCE: The exploit is in the link1 people · 131 points · first shared 2021 · 56 comments on HN
- 13From XSS to RCE – dompdf 0-day1 people · 6 points · first shared 2022 · discussion on HN
- 14Banking AI XSS: The exploit is in the payment reference1 people · 2 points · first shared 2026 · discussion on HN
- 15Homepage1 people · first shared 2024
What HN people wrote when they linked it
ugjka · 2024-12-29
this seems their website https://positive.security/ not sure where they host their code
miduil · 2026-01-14
> Spain will need to make some very hard choices
Thankfully there is now more focus and financing available to elevate the network quality - right? Portugal has added 1% onto the electricity price for that purpose alone: https://www.energy-storage.news/portugal-to-invest-e400-million-into-g…
I've followed "expert testimonials" in the Austrian news over the past years, and even there the importance of grid safety is a common theme - there seems to be some gap, even in the networks that on the surface level appear to be tolerant.
> I know that the typical grid operator is extremely careful and pro-active on this subject
That's really good to hear, unfortunately standardization is extremely slow moving and even though a potentially "safe grid" may be much more at risk during "hybrid-war times" (or other civil unrest, as seen in Berlin this year).
https://positive.security/blog/blinkencity-38c3
jsheard · 2025-05-24
You'd be surprised: https://positive.security/blog/lodash-ramda-underscore-vulnerabilities
walterbell · 2024-07-08
> it’s often sufficient to generate a publicly available, unlisted/unindexed, hard to guess URL
Unless a service is leaking or spidering the URL into a public index.
https://positive.security/blog/urlscan-data-leaks
https://arstechnica.com/information-technology/2014/05/dropbox-disable…
https://security.stackexchange.com/questions/239762/how-are-hidden-pri…
ec109685 · 2024-06-01
Impressive. Here is the blog post (also linked from their github) that talks about the bypass (the tldr; is that they rotate through public keys in a deterministic way, so Apple’s protections think it’s a new device each time and thus don’t warn about a persistent tracker).
https://positive.security/blog/find-you
tobyjsullivan · 2024-03-07
I thought I read it in the article but I may have unconsciously extrapolated from and/or misread this part:
“I came across this wonderful analysis by Positive Security[0] who focused on urlscan.io and used canary tokens to detect potential automated sources (security tools scanning emails for potentially malicious [links])”
I don’t see any mention of messaging platforms generally. It only mentions email and does not suggest who might be operating the tooling (vendor or end users). So I seem to have miscredited that idea.
[0] https://positive.security/blog/urlscan-data-leaks
TechBro8615 · 2022-07-06
There is a whole class of attacks related to “deep linking” and custom URL schemes that the operating system can pass to any application that registers itself to match it. At that point the sanitization is up to the application.
I recently stumbled upon a nice write-up [0] that described this class of attack and surveyed which software was vulnerable to it. Many crypto clients were included.
[0] https://positive.security/blog/url-open-rce
wyager · 2021-06-04
We know exactly what goes in an airtag message. It’s very limited. https://positive.security/blog/send-my
sixhobbits · 2021-05-18
The linked blog post is more detailed and probably better to link to
https://positive.security/blog/send-my
jean-malo · 2021-05-15
The blog post [0] of the researcher - which this article is based on
[0] https://positive.security/blog/send-my
oxplot · 2022-02-22
Linked source: https://positive.security/blog/find-you