Top all-time · #10297
0xdabbad00
Personal blog · 0xdabbad00.comsecurityprogramming
0xdabbad00 is a personal blog at 0xdabbad00.com about security and programming. Since 2012, 7 different Hacker News readers have linked it 7 times, most often “Looking for security trouble spots in Go code”. The last post was in 2015, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Security posts on DNS rebinding and Host header checks in Go servers, YARA signatures for binary analysis, and DEP and ASLR in Windows apps. Commenters cite them as references, without judging them.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Looking for security trouble spots in Go code2 people · 2 mentions · first linked 2015-04-14
What Hacker News says?
It's a nice list of items, but I don't feel like it's informed from actual penetration tests on Go apps. Bad Content-Type headers and DNS rebinding affect almost every Go web application out there. Any naked Go server is usually vulnerable to DNS rebinding because it doesn't test the Host header. Edit: see also: http://0xdabbad00.com/2015/04/12/looking_for_security_troubl...
Comment linking /2015/04/12/looking_for_security_trouble_spots_in_go_code/
on “Securing Go web applications”Submitted Looking for security trouble spots in Go code as a story · 45 points
HN discussionFor static analysis to check for best practices, there aren't any free tools that come to mind that give you easily digestible info without usually doing some manual reversing and a lot of extra knowledge. HBGary once created a tool called FingerPrint that provided some of this extra info but that tool disappeared. I extracted out a lot of what it does into YARA signatures: http://0xdabbad00.com/2011/01/09/fingerpri…
Comment linking /2011/01/09/fingerprinting-using-yara/
on “Serene – best practice checks on executable binaries”Submitted Common Windows apps still without DEP and ASLR as a story · 36 points
HN discussionNo. Read my follow-up post: http://0xdabbad00.com/2012/12/07/dep-data-execution-preventi...
Comment linking /2012/12/07/dep-data-execution-prevention-explanation/
on “Common Windows apps still without DEP and ASLR”Submitted Drop Code Romance. Cheat as a story · 4 points
HN discussionSubmitted Root Certificate Authority research as a story · 1 points
HN discussion