Top all-time · #966
The Invisible Things Blog
Personal blog · blog.invisiblethings.orgsecuritysystems
The Invisible Things Blog is a personal blog at blog.invisiblethings.org about security and systems. Since 2015, 68 different Hacker News readers have linked it 114 times, most often “A survey of attacks against Intel x86 over last 10 years (2015) [pdf]”. It is still writing: the last post was on 2026-02-02, and you can follow it by feed.
Sometimes recommended · 10 of 40 sampled comments recommend it?
Why HN links it
HN readers link Joanna Rutkowska's blog for security writing on x86 hardware trust, Intel ME, and stateless laptops, including the 'x86 considered harmful' and 'State considered harmful' papers.
- Recommended for · 10 comments
- Called worth reading, enlightening, an eye-opener and essential reading; a plausible way to limit trust in peripherals.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
My personal blog and website (see http://blog.invisiblethings.org/)
Most-linked posts?
- A survey of attacks against Intel x86 over last 10 years (2015) [pdf]14 people · 18 mentions · first linked 2016-12-04
- Intel x86 considered harmful [pdf]10 people · 12 mentions · first linked 2015-10-28
- State Considered Harmful – A Proposal for a Stateless Laptop8 people · 8 mentions · first linked 2015-12-23
- Converting untrusted PDFs into trusted ones: The Qubes Way (2013)6 people · 8 mentions · first linked 2020-11-26
- State considered harmful – A proposal for a stateless laptop (2015) [pdf]5 people · 10 mentions · first linked 2017-07-11
- Anti Evil Maid (2011)5 people · 5 mentions · first linked 2018-04-29
- Intel x86 considered harmful – survey of attacks against x86 over last 10 years5 people · 5 mentions · first linked 2015-10-27
- /2011/04/23/linux-security-circus-on-gui-isolation.html4 people · 4 mentions · first linked 2018-03-19
- State considered harmful: A proposal for a stateless laptop (2015)3 people · 3 mentions · first linked 2017-04-29
- Partitioning my digital life into security domains (2011)2 people · 3 mentions · first linked 2025-04-13
What Hacker News says?
For a very good explaination on that topic, see the following 32C3 presentation: "Towards (reasonably) trustworthy x86 laptops" https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor... Also, the paper by the author is worth a read: "State considered harmful - A proposal for a stateless laptop" https://blog.invisiblethings.org/papers/2015/state_harmful.p...
Comment linking /papers/2015/state_harmful.pdf
on ““We have obtained fully functional JTAG for Intel CSME via USB DCI””Submitted Intel x86 considered harmful – survey of attacks against x86 over last 10 years as a story · 276 points
HN discussionJoanna has proposed a model where we minimize the trust we put in x86 with a peripheral. Seems like a plausible path forward to me. http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
Comment linking /2015/12/23/state_harmful.html
on “Freedom and security issues on x86 platforms”Submitted State Considered Harmful – A Proposal for a Stateless Laptop as a story · 226 points
HN discussionEarlier posts around the same topic: http://blog.invisiblethings.org/2015/10/27/x86_harmful.html http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
Comment linking /2015/12/23/state_harmful.html
on “Freedom and security issues on x86 platforms”Submitted State considered harmful: A proposal for a stateless laptop (2015) as a story · 138 points
HN discussionPlease read x86 considered harmful by the security researcher Joanna rutkowska. It highlights the x86 flaws. https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
Comment linking /papers/2015/x86_harmful.pdf
on “Disabling the Intel Management Engine”Submitted Converting untrusted PDFs into trusted ones: The Qubes Way (2013) as a story · 117 points
HN discussionThere's some value over other laptops, notably that it's tested with Linux as the main target and uses recent hardware that is virtualization friendly (+15" which is a personal requirement for me). Configuring a laptop like that takes a nontrivial amount of time from my experience. What interests me is that it will run Qubes OS before the 15" ships if that statement is to be trusted. It is one of the more interestin…
Comment linking /papers/2015/x86_harmful.pdf
on “We Need a Better PC”Submitted A survey of attacks against Intel x86 over last 10 years (2015) [pdf] as a story · 86 points
HN discussionWell, the Pi blob can be replaced… almost… soon… https://news.ycombinator.com/item?id=11703842 / https://github.com/christinaa/rpi-open-firmware Not a ready drop-in replacement yet, but running ARM code with access to the SD card and the UART console is possible! edit: By the way! The Pi loads all the firmware from the SD card — no reflashable memory on the board AFAIK – which would make it excellent from the "State…
Comment linking /2015/12/23/state_harmful.html
on “The Intel ME subsystem can take over your machine, can't be audited”Submitted Security challenges for the Qubes build process as a story · 64 points
HN discussionNote that the video is also available on media.ccc.de (this is the source, youtube is just a "bad" mirror): https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor... This is her corresponding blog post: http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...
Comment linking /2015/12/23/state_harmful.html
on “The Intel ME subsystem can take over your machine, can't be audited”Submitted Partitioning my digital life into security domains (2011) as a story · 47 points
HN discussionJoanna Rutkowska has written a nice paper on the topic, highly recommended: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Edit: There's also a talk from 32c3 for those more inclined to watch a video. I am pretty worried ever since I watched that: https://www.youtube.com/watch?v=rcwngbUrZNg (which is why I have researched non-Intel laptop alternatives..cliffnotes: GPUs without BLOBs are hard to find and…
Comment linking /papers/2015/x86_harmful.pdf
on “The Intel ME subsystem can take over your machine, can't be audited”Submitted Converting untrusted PDFs into trusted ones: The Qubes Way (2013) as a story · 23 points
HN discussionRemember that we have no idea whether Windows and Intel processors with IME (and AMD processors since Ryzen ?) don't have built-in backdoors (And Macs have been using Intel exclusively for years now, haven't-they ?). So nothing very new here, really... https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
Comment linking /papers/2015/x86_harmful.pdf
on “Apple apps on Big Sur bypass some firewalls and VPNs”Submitted A proposal for a stateless laptop as a story · 18 points
HN discussionThis is exactly why Intel's upcoming SGX worries me greatly, too. NSA could get the "key" to all SGX machines and therefore to all applications using SGX to secure themselves properly (ironically enough) [1]. Intel really needs to figure out how to protect the SGX system against such a key robbery, and not by promising to only give access to a couple of employees in the whole company who know a very special hand-sha…
Comment linking /2013/09/23/thoughts-on-intels-upcoming-software.html
on “The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle”Submitted Intel x86 considered harmful [pdf] as a story · 7 points
HN discussionAs a sysadmin at a Windows shop, I don't know what to make of this. Has Intel commented on this, yet? Any OEM? Joanna Rutkowska, who is a renowned security researcher, warned of something like this happening sooner or later[1], so I don't think I can afford to just ignore this. But without something more specific to act on, there is nothing I can do, except wait firmware updates to be released by various vendors. If…
Comment linking /papers/2015/x86_harmful.pdf
on “Intel platforms from 2008 onwards have a remotely exploitable security hole”Submitted Intel x86 considered harmful [pdf] as a story · 7 points
HN discussionQubesOS has a "TrustedPDF converter" [0] that sanitizes a PDF to the extreme level for ultimate security - it converts the entire PDF to RGB pixmaps in an isolated virtual machine. The author has a blog post at [1]. Obviously you lose the ability to use the menu, search, copy or paste, but it's as 0day-proof as you can get for a horrifying file format. [0] https://github.com/QubesOS/qubes-app-linux-pdf-converter [1]…
Comment linking /2013/02/21/converting-untrusted-pdfs-into-trusted.html
on “Horrifying PDF Experiments”Submitted Qubes OS 3.1 has been released as a story · 6 points
HN discussionBack in 2011, security researcher, Joanna Rutkowska wrote a very enlightening article on the inherent security deficiencies of the X server architecture which allows allows any windowed application to control any other one: http://blog.invisiblethings.org/2011/04/23/linux-security-ci...
Comment linking /2011/04/23/linux-security-circus-on-gui-isolation.html
on “BSD vs. Linux (2005)”Submitted Converting untrusted PDFs into trusted ones: The Qubes Way (2013) as a story · 4 points
HN discussionI never used snaps, so I don't understand what you mean here. Here's a couple of typical Qubes usage patterns: https://www.qubes-os.org/news/2022/10/28/how-to-organize-you... , https://blog.invisiblethings.org/2011/03/13/partitioning-my-...
Comment linking /2011/03/13/partitioning-my-digital-life-into.html
on “Malicious versions of Nx and some supporting plugins were published”Submitted Intel x86 considered harmful [pdf] as a story · 4 points
HN discussionI think you mean this paper: https://blog.invisiblethings.org/papers/2015/state_harmful.p...
Comment linking /papers/2015/state_harmful.pdf
on “Qubes OS: A reasonably secure operating system”Submitted Introducing graphene-ng: running arbitrary payloads in SGX enclaves as a story · 3 points
HN discussion
