Top all-time · #1852
Gynvael Coldwind
Personal blog · gynvael.coldwind.pl · on HN as gynvaelsecurityprogramming
Gynvael Coldwind writes gynvael.coldwind//vx.log (pl), a personal blog at gynvael.coldwind.pl about security and programming. Since 2009, 42 different Hacker News readers have linked it 49 times, most often “Xz/liblzma: Bash-stage Obfuscation Explained”. It is still writing: the last post was on 2026-05-19, and you can follow it by feed.
Mostly technical blog of Gynvael Coldwind, a security researcher and progammer.
Most-linked posts?
- Xz/liblzma: Bash-stage Obfuscation Explained7 people · 7 mentions · first linked 2024-03-30
- Hello World in C without libraries or similar dependencies3 people · 3 mentions · first linked 2019-03-09
- The tragedy of low-level exploitation3 people · 3 mentions · first linked 2024-08-04
- Hello World Under the Microscope3 people · 3 mentions · first linked 2022-11-11
- The Tale of Syndicate Wars Port (2010)2 people · 2 mentions · first linked 2016-04-26
- Hello World Under the Microscope2 people · 2 mentions · first linked 2022-10-12
What Hacker News says?
I think you're probably missing a lot context about the situation. Here's some useful links https://x0f.org/@FreePietje/112187047353892463 also https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted Xz/liblzma: Bash-stage Obfuscation Explained as a story · 535 points
HN discussionSE Linux comment by @poettering, https://news.ycombinator.com/item?id=39867126 > Libselinux pulls in liblzma too and gets linked into tons more programs than libsystemd. And will end up in sshd too (at the very least via libpam/pam_selinux). And most of the really big distros tend do support selinux at least to some level. Hence systemd or not, sshd remains vulnerable by this specific attack. Devuan comment by @capi…
Comment linking /?lang=en&id=782
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted 8-bit number to binary string as a story · 158 points
HN discussionThat’s what the compromised build stage did. It’s really interesting to read if you want to see the details of how a sophisticated attacker works: https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b... https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “Xzbot: Notes, honeypot, and exploit demo for the xz backdoor”Submitted The tragedy of low-level exploitation as a story · 66 points
HN discussion"xz/liblzma: Bash-stage Obfuscation Explained" covers it well https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “Xzbot: Notes, honeypot, and exploit demo for the xz backdoor”Submitted 8-bit number to binary string (2013) as a story · 63 points
HN discussionIf you're interested in dives that deep, you might like Gynvael Coldwind's hello world in Python on Windows dive [1]. Goes through CPython internals, Windows conhost, font rasterization, and GPU rendering, among others. [1]: https://gynvael.coldwind.pl/?id=754
Comment linking /?id=754
on “Hello World”Submitted An informal review of CTF abuse as a story · 53 points
HN discussionlcamtuf is just a great man. Take a look at his biography and inventions. I love this works same as Gynvaels http://gynvael.coldwind.pl/?blog=1&lang=en When they post something, it's always interesting and very often innovating.
Comment linking /?blog=1&lang=en
on “I lost my OpenBSD full-disk encryption password”Submitted Hello World Under the Microscope as a story · 28 points
HN discussionNo. This ZIP bomb workings rely on two important facts: 1. ZIP archive has multiple files. 2. ZIP is an "index+pointers" based format (meaning the Central Directory index of archive files is basically a table of pointers - or rather offsets - telling where to look for data inside the file). Thanks to these two properties David could create a very clever compressed stream that could be (partially) re-used by multiple…
Comment linking /?id=533
on “A better zip bomb”Submitted Xz/liblzma: Bash-stage Obfuscation Explained as a story · 6 points
HN discussionAlso known as "bswap ax", and research shows that it does something surprising but consistent on almost all hardware: It zeros the register. https://www.ragestorm.net/blogs/?p=141 https://gynvael.coldwind.pl/?id=268 However, this page, now gone, suggests that some CPUs (early 486s?) did something different: http://web.archive.org/web/20071231192014/http://www.df.lth.... Unfortunately I have not found any evidence no…
Comment linking /?id=268
on “Things I learned while writing an x86 emulator (2023)”Submitted Tragedy of low-level exploitation (So you want to make a career in exploit dev?) as a story · 4 points
HN discussionGynvael Coldwind made a great analysis about it: https://gynvael.coldwind.pl/?lang=en&id=782 https://news.ycombinator.com/item?id=39878681 xz/liblzma: Bash-stage Obfuscation Explained
Comment linking /?lang=en&id=782
on “OpenSSH Backdoors”Submitted Hello World Under the Microscope as a story · 4 points
HN discussionHi Philip. Would you be able to share with me just a few anonymized user IDs (random ones are fine)? I wanted to double-check their format, since I'm pretty sure their method is broken. My email address is there → https://gynvael.coldwind.pl/?id=50 (contact section)
Comment linking /?id=50
on “Discord Unveiled: A Comprehensive Dataset of Public Communication (2015-2024)”Submitted An informal review of CTF abuse as a story · 3 points
HN discussionGynvael ( http://gynvael.coldwind.pl/ ) is a C++ person who does streams on youtube. I learned a lot about Virtual Machines from his livestreams. :)
Comment linking /
on “Lessons from my first year of live coding on Twitch (2017)”Submitted Python “Sandbox” Escape (2013) as a story · 3 points
HN discussionPick up the subject of old 8 bit computers, games and browsers. Get ready for the 20 KB JS shooter competition. https://gynvael.coldwind.pl/?id=686
Comment linking /?id=686
on “JSBeeb – JavaScript BBC Micro Emulator”Submitted How to document your knowledge (in a CV/resume) as a story · 3 points
HN discussionHere you go: http://gynvael.coldwind.pl/?id=279
Comment linking /?id=279
on “Syndicate Wars Port”Submitted How to learn reverse-engineering? as a story · 3 points
HN discussion> For security stuff it's 100% twitter It saddens me that this is the case. Security types are techies, so should be all over RSS feeds. For example I follow the usual suspects on RSS: * https://www.schneier.com/feed/atom/ * https://gru.gq/feed/ * https://gynvael.coldwind.pl/rss_en.php Ideally please post on Twitter AND an RSS feed.
Comment linking /rss_en.php
on “Ask HN: What websites do you use to find cutting edge information?”Submitted Int a = 5; a = a++ + ++a; a =? (2011) as a story · 2 points
HN discussionThis reminds me of a tool that came out 10 or 15 years ago, which allowed you to feed it arbitrary binary data that it could display in 3D. I remember reading a Slashdot article on it in which one of the examples was a 3D, freely-rotating view of the Linux kernel binary. Does anyone know what I'm talking about? I can't seem to recall the name of the project or find it. Also related: http://vimeo.com/110257380 http:/…
Comment linking /?id=199
on “Visualizing Entropy in Binary Files”Submitted Hello World in C without libraries or similar dependencies as a story · 2 points
HN discussion
