Top all-time · #2341
Tavis Ormandy
Personal blog · blog.cmpxchg8b.comsecurityprogrammingsystems
Tavis Ormandy's personal blog at blog.cmpxchg8b.com covers security, programming and systems. Since 2012, 32 different Hacker News readers have linked it 38 times, most often “Fun with Constrained Programming”. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (18) to say how often HN recommends it.?
Why HN links it
HN readers link Tavis Ormandy's security blog for critiques of SMS two-factor authentication and reproducible builds, plus write-ups of RAR/WinRAR internals, bytecode and vulnerabilities.
- Recommended for · 2 comments
- Called the reproducible-builds debunking "a very good" piece and the RAR virtual machine article "really interesting".
Summarised by Claude from a sample of 18 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Vulnerability Discovery, Mitigation and Exploitation.
Most-linked posts?
- Fun with Constrained Programming6 people · 6 mentions · first linked 2012-09-28
- You don’t need reproducible builds5 people · 5 mentions · first linked 2021-06-20
- You don’t need reproducible builds4 people · 4 mentions · first linked 2020-07-29
- Finding a console Word Processor (2020)3 people · 3 mentions · first linked 2022-04-06
- Tavis Ormandy: You don’t need reproducible builds2 people · 2 mentions · first linked 2020-07-29
- Blackberry exploit that allows arbitrary reading and writing of %APPDATA%2 people · 2 mentions · first linked 2013-11-12
- You don’t need SMS-2FA2 people · 2 mentions · first linked 2020-07-29
- You don’t need SMS-2FA2 people · 2 mentions · first linked 2020-07-29
- Security Software Certification2 people · 2 mentions · first linked 2016-03-13
What Hacker News says?
I don't see a single comment doubting the value of reproducibility, so I'll be the resident skeptic :) I think build reproducibility is a cargo cult. The website says reproducibility can reduce the risk of developers being threatened or bribed to backdoor their software, but that is just ridiculous. Developers have a perfect method for making their own software malicious: bugdoors. A bugdoor (bug + backdoor) is a de…
Comment linking /2020/07/you-dont-need-reproducible-builds.html
on “Nixos-unstable’s ISO_minimal.x86_64-Linux is 100% reproducible”Submitted You don’t need reproducible builds as a story · 126 points
HN discussionThis continues to be debated by so many, but like this person, the debate is meaningless in the face of realities. I'd refer everyone back to @taviso's work up of SMS "2FA". [0] The amount of 'splaining going on in this discussion helps illustrate the trouble. If SMS2FA were actually fit for purpose it would not require so many internet defenders. [0] https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm...
Comment linking /2020/07/you-dont-need-sms-2fa.html?m=1
on “Tell HN: SMS-based two-factor authentication is not secure”Submitted You don’t need SMS-2FA as a story · 34 points
HN discussion1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html
Comment linking /2020/07/you-dont-need-sms-2fa.html
on “Stopping phishing campaigns with Bash”Submitted You don’t need SMS-2FA as a story · 33 points
HN discussionThere's also dynamic generation of output by specifying a custom filter in a RAR archive that is executed during decompression: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
Comment linking /2012/09/fun-with-constrained-programming.html
on “Biggest image in the smallest space”Submitted Debian/Ubuntu root privilege escalation as a story · 8 points
HN discussion> As an example of where this central point of failure becomes problematic, attackers can modify a package to include malware in what is known as a digital supply chain attack. What we really want, and what no package manager can give us today, is reproducibility. Tavis Ormandy of Google Project Zero wrote a very good debunking of this supposed security benefit of reproducible builds: https://blog.cmpxchg8b.com/2020…
Comment linking /2020/07/you-dont-need-reproducible-builds.html
on “Nix: An idea whose time has come”Submitted You don’t need reproducible builds as a story · 5 points
HN discussion> If Signal-the-app did a WhatsApp and started blocking forwarded messages, or blocking messages that contained a blacklisted domain etc, I think very little would happen and it might take a while for people to even notice. Why would it be different for, say, Sendmail? I mean, I agree, but isn’t this the heart of why “open source” is not a meaningful differentiator? (Taviso wrote something similar about reproducible…
Comment linking /2020/07/you-dont-need-reproducible-builds.html
on “Re: Moxie on Web3”Submitted Finding a console Word Processor (2020) as a story · 4 points
HN discussiondosemu2 is perfect for old software like this, it's not just an emulator but has a mode that translates VGA text mode operations into terminal operations so becames almost like a native application in your terminal I did this with WordPerfect for DOS thanks to a guide posted here years ago https://blog.cmpxchg8b.com/2020/09/finding-console-word-proc...
Comment linking /2020/09/finding-console-word-processor.html
on “VisiCalc Executable for the IBM PC (1999)”Submitted You don’t need reproducible builds as a story · 4 points
HN discussionWatch out, the linked post [1] is blocked by my TrendMicro. [1] http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
Comment linking /2012/09/fun-with-constrained-programming.html
on “Hacking WinRAR for fun and profit”Submitted Security Debianisms as a story · 4 points
HN discussionRelated blog post http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
Comment linking /2012/09/fun-with-constrained-programming.html
on “Hacking WinRAR for fun and profit”Submitted Tavis Ormandy: You don’t need reproducible builds as a story · 3 points
HN discussionan article arguing that reproducible builds are a lot of effort, and the benefits are not that big: https://blog.cmpxchg8b.com/2020/07/you-dont-need-reproducibl...
Comment linking /2020/07/you-dont-need-reproducible-builds.html
on “Reproducible builds for Debian: a big step forward”Submitted Introduction to Windows Kernel Security Research as a story · 3 points
HN discussionRAR archives also contain a virtual machine used to implement custom compression filters: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
Comment linking /2012/09/fun-with-constrained-programming.html
on “Bytecode”Submitted Fun with Constrained Programming as a story · 3 points
HN discussionThe phishing scenario in the article allows the malicious actor to impersonate the victim simultaneously, while asking the victim for any 2FA codes. The attacker can be a man-in-the-middle and make the victim authorize a costly transaction (say $100), with the victim seeing a cost of $1. These is an example video here: https://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.htm... Of course, the real transaction ca…
Comment linking /2020/07/you-dont-need-sms-2fa.html
on “The short tale of an online scam”Submitted You don’t need reproducible builds as a story · 2 points
HN discussionWhenever I’ve used AV I have found it to be worse than useless. Only detections are false positives, uses tons of systems resources, breaks commonly used apps. I generally agree with Tavis Ormandy[1] that AV products often just increase the attack surface. Especially for applications that already have a high security focus (e.g. browsers). I’m somewhat surprised to see so many AV believers in the HN comments section…
Comment linking /2016/03/security-software-certification.html?m=1
on “Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'”Submitted You don’t need SMS-2FA as a story · 2 points
HN discussionProbably quite a few. There's also more than just division by 0 to be wary of: http://blog.cmpxchg8b.com/2013/02/the-other-integer-overflow...
Comment linking /2013/02/the-other-integer-overflow.html
on “Rust for C++ programmers – part 3: primitive types and operators”Submitted Automatically import native structures into bash as a story · 2 points
HN discussionThere's a really interesting article from Tavis Ormandy about the instruction set and virtual machine used in RAR: https://blog.cmpxchg8b.com/2012/09/fun-with-constrained-prog... . The docs for the toolchain he implemented ( https://github.com/taviso/rarvmtools ) allude to a number of bugs, but doesn't sound (??) like they're related to this vulnerability.
Comment linking /2012/09/fun-with-constrained-programming.html
on “High-severity WinRAR 0-day exploited for weeks by 2 groups”Submitted Security Software Certification as a story · 2 points
HN discussion
