Top all-time · #6706
Ben's Blog
Personal blog · benmmurphy.github.io/blogsecurityprogramming
Ben's Blog is a personal blog at benmmurphy.github.io about security and programming. Since 2015, 12 different Hacker News readers have linked it 12 times, most often “Rails Webconsole DNS Rebinding”. The last post was in 2018, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this security research blog for its write-ups, such as the dependency confusion attack and a Rails web console exploit on localhost. Commenters cite the posts as sources rather than praising them.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
This is an experiment where we try to find out how much faster Postgres will run if patch it to support non-durable reads. Postgresql supports a …
Most-linked posts?
- Rails Webconsole DNS Rebinding5 people · 5 mentions · first linked 2016-07-11
- ZDI-13-075 (2013) Java 1.7.0_09 Sandbox Bypass via ConcurrentHashMap2 people · 2 mentions · first linked 2015-11-26
- Arbitrary Kernel Memory Reads on Illumos2 people · 2 mentions · first linked 2017-01-10
What Hacker News says?
The File example is a good illustration of why Java is _not_ a capability-secure language. Every File object in Java has a getParentFile() method that allows you to navigate up the hierarchy right to the root and then from there access every file on the filesystem. Java’s standard library is full of these kinds of design flaws. So in practice you can only apply capability-based thinking to small subsets of a codebas…
Comment linking /blog/2015/10/21/zdi-13-075-2013-java-1-dot-7-0-09-sandbox-bypass/
on “Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies”Submitted Redis Hot Patch as a story · 92 points
HN discussionSmartOS provides Zones, and if you need it a KVM instance within a Zone. Hypervisors have their own security issues. They're just programs. That's why there've been all the patching over the years for Xen and for KVM. Last year, an independent researcher did find an issue related to Dtrace that Joyent patched. However, the security and engineering that backs Zones is way more than with other kernels. https://www.joy…
Comment linking /blog/2017/01/06/arbitrary-kernel-memory-reads-on-illumos/
on “AWS EC2 Virtualization 2017: Including Nitro”Submitted Redis Lua sandbox escape as a story · 55 points
HN discussion1) Subdomains. If you're app utilises subdomains, you need to use a TLD. 2) Integration with development tools like http://pow.cx/ or https://github.com/puma/puma-dev allow you to automatically startup and shutdown apps. This is useful when you're juggling multiple apps. 3) Security. Using a standard domain/port for local development opens you up to exploits like http://benmmurphy.github.io/blog/2016/07/11/rails-web…
Comment linking /blog/2016/07/11/rails-webconsole-dns-rebinding/
on “Ask HN: What TLD do you use for local development?”Submitted Rails Webconsole DNS Rebinding RCE as a story · 4 points
HN discussionThis works for default configurations of Ruby on Rails and macOS. Technical details: http://benmmurphy.github.io/blog/2016/07/11/rails-webconsole...
Comment linking /blog/2016/07/11/rails-webconsole-dns-rebinding/
on “This website will open the calculator if you're running `rails server` on macOS”Submitted Arbitrary Kernel Memory Reads on Illumos as a story · 3 points
HN discussionSubmitted Rails Webconsole DNS Rebinding – Ben's Blog as a story · 2 points
HN discussionSubmitted Rails Webconsole DNS Rebinding as a story · 2 points
HN discussionSubmitted Rails Webconsole DNS Rebinding as a story · 1 points
HN discussionSubmitted ZDI-13-075 (2013) Java 1.7.0_09 Sandbox Bypass via ConcurrentHashMap as a story · 1 points
HN discussion
