Top all-time · #1897
Unhandled Expression
Personal blog · unhandledexpression.com · on HN as gealsecuritycareer
Unhandled Expression is a personal blog at unhandledexpression.com about security and career. Since 2010, 41 different Hacker News readers have linked it 63 times, most often “Telegram, a.k.a. “Stand back, we have Math PhDs””. The last post was in 2019, but the archive is still widely read.
Most-linked posts?
- Telegram, a.k.a. “Stand back, we have Math PhDs”16 people · 17 mentions · first linked 2013-12-17
- Why you should, actually, rewrite some of it in Rust5 people · 5 mentions · first linked 2017-07-10
- Using LLVM’s profile guided optimization in Rust3 people · 3 mentions · first linked 2016-04-15
- How to rewrite you project in Rust3 people · 3 mentions · first linked 2017-07-12
- Nom 5: parser combinators for Rust2 people · 2 mentions · first linked 2019-06-24
- /2013/12/17/telegram-stand-back-we-know-maths/2 people · 2 mentions · first linked 2016-06-28
- PoC: compiling to eBPF from Rust2 people · 2 mentions · first linked 2018-02-05
- The Geal test, extending the Joel test2 people · 2 mentions · first linked 2011-02-18
What Hacker News says?
In the case of Telegram, MTProto’s implementation leaves a lot to be desired[1][2]. Additionally, home rolled crypto does not usually get the kind of security review from the cryptography community which makes it very likely that bugs of all kinds exist. [1] https://words.filippo.io/dispatches/telegram-ecdh/ [2] http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Telegram has launched a pretty intense campaign to malign Signal as insecure”Submitted FOSS is free as in toilet as a story · 214 points
HN discussionhttp://unhandledexpression.com/2013/12/17/telegram-stand-bac...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Open Sourcers Race to Build Better Versions of Slack”Submitted Why you should, actually, rewrite some of it in Rust as a story · 200 points
HN discussionI guess stuff like that: http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Wire – Modern Communications Network”Submitted Tips to accelerate SSL as a story · 158 points
HN discussionWindows suffers some famous dain bramage wrt to DLL loading paths: http://unhandledexpression.com/2010/08/23/fixing-the-dll-loa... Basically, even when "safe" DLL loading is turned on, the search path still includes the current directory. I'm guessing that Notepad and friends all look for some (legacy?) DLL that isn't always installed, so if an attacker puts a malicious DLL by its same name in the same path as the f…
Comment linking /2010/08/23/fixing-the-dll-loading-vulnerability/
on “Opening *.txt file is dangerous on Windows”Submitted Crypto problems you actually need to solve as a story · 118 points
HN discussion> For self-referential datastructures (your first point above), using an Rc or Arc shouldn't have any overhead. I agree that it would be nice to be able to express this, but it's not really that big of a problem. I don't see how that could be true. It means using a separate heap allocation for each referenced piece (although the owning_ref thing steveklabnik mentioned might minimize that), a bit of extra RAM for the…
Comment linking /2016/04/14/using-llvm-pgo-in-rust/
on “The Path to Rust”Submitted Telegram, a.k.a. “Stand back, we have Math PhDs” as a story · 93 points
HN discussionfwiw, here's a rather relevant post: http://unhandledexpression.com/2014/04/07/revisiting-zookos-...
Comment linking /2014/04/07/revisiting-zookos-triangle/
on “Turkish government takes down YouTube too”Submitted Why you should, actually, rewrite it in Rust as a story · 8 points
HN discussionTelegram clients (ios,andriod,windows,osx,linux) are open source. Server is closed but client code and protocol provides user with verified secrecy. Most criticism seems emotion based but no smoking guns. See comments on http://unhandledexpression.com/2013/12/17/telegram-stand-bac... also see response to the post you linked to http://telegramteam.tumblr.com/post/70588130319/telegrams-cr... anyway i dont work for the…
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Vkontakte Founder Flees Russia”Submitted Using LLVM’s profile guided optimization in Rust as a story · 8 points
HN discussion1. It's not end-to-end encrypted by default. 2. No group chat, even a small one between close friends is end-to-end encrypted. 3. Almost all desktop clients support no end-to-end encryption for 1:1 chats, meaning if you use the desktop client as part of your workflow, you're forced to drop using the end-to-end encrypted secret chats. 4. No cryptographers have ever worked in the company. 5. Horrible teething issues f…
Comment linking /crypto/general/security/2013/12/17/telegram-stand-back-we-know-maths.html
on “Matrix.org Will Migrate to MAS”Submitted The Geal test, extending the Joel test as a story · 6 points
HN discussionI still don't really understand this all discussion around Telegram. MTProto is used just with the regular chats and they decided to use a custom protocol "In order to achieve reliability on weak mobile connections as well as speed when dealing with large files (such as photos, large videos and files up to 1,5 GB)" (from the FAQ). There is also a pretty long discussion here http://unhandledexpression.com/2013/12/17/…
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “MTProto, the symmetric encryption scheme used in Telegram, is not IND-CCA secure”Submitted I hate installers as a story · 6 points
HN discussionA blog post on the protocol built by Telegram: http://unhandledexpression.com/2013/12/17/telegram-stand-bac... sigh
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Secure Messaging Scorecard”Submitted My ideal job posting as a story · 5 points
HN discussionThis is called profile-guided optimization.[0] Slightly off-topic, but even Rust has it, courtesy of LLVM.[1] It doesn't seem very popular unfortunately. Most web/tech companies are obsessive about capturing user interaction data for UX purposes, but it would be nice if that data could be fed back into a profile-guided optimizer. In theory the compiled WebAssembly output would always be optimized for the latest usag…
Comment linking /2016/04/14/using-llvm-pgo-in-rust/
on “A first look at WebAssembly performance”Submitted Nom 4.0: faster, safer, simpler parsers in Rust as a story · 4 points
HN discussionSome other good overviews: http://www.cryptofails.com/post/70546720222/telegrams-crypta... http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “$300k for Cracking Telegram Encryption”Submitted How to rewrite you project in Rust as a story · 4 points
HN discussionThis blog showcasts a way to orchestrate eBPF scripts in Rust, but the eBPF itself is still written in C. That's super cool, but if combined with [0], we would gain the ability to write the eBPF script itself in Rust. [0]: https://unhandledexpression.com/2018/02/02/poc-compiling-to-...
Comment linking /2018/02/02/poc-compiling-to-ebpf-from-rust/
on “Writing eBPF tracing tools in Rust”Submitted Why you should, actually, rewrite it in rust as a story · 4 points
HN discussionExcept, other than being a nice chat app, Telegram's encryption is snake oil http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “Encrypted Messaging Apps Face New Scrutiny Over Possible Role in Paris Attacks”Submitted The problem with the meritocracy as a story · 4 points
HN discussionI think the encryption has been known to be bunk for quite some time now [1] [1] https://eprint.iacr.org/2015/1177.pdf [2] http://www.alexrad.me/discourse/a-264-attack-on-telegram-and... [3] https://unhandledexpression.com/2013/12/17/telegram-stand-ba...
Comment linking /2013/12/17/telegram-stand-back-we-know-maths/
on “A Crypto Challenge for the Telegram Developers (2013)”Submitted Nom 5: parser combinators for Rust as a story · 3 points
HN discussion
