Top all-time · #1312
Bishop Fox
Company blog · bishopfox.com/blogsecurity
Bishop Fox is the company blog at bishopfox.com, writing about security. Since 2013, 54 different Hacker News readers have linked it 91 times, most often “An Exploration of JSON Interoperability Vulnerabilities”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (23) to say how often HN recommends it.?
Why HN links it
Security firm blog linked for JSON parser interoperability vulnerabilities, plus posts on hash collisions, BGP hijacking, RFID/NFC attacks, and the raink LLM ranking tool. Commenters cite posts as support.
Summarised by Claude from a sample of 23 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Bishop Fox offensive security services help you find and fix vulnerabilities before they become incidents. We simulate real-world attacks across your…
Most-linked posts?
- An Exploration of JSON Interoperability Vulnerabilities8 people · 8 mentions · first linked 2021-12-26
- Multiple Heap Buffer Overflows In the Windows DNS Client3 people · 3 mentions · first linked 2017-10-10
- Raink: Use LLMs for Document Ranking2 people · 4 mentions · first linked 2025-01-14
- Fishing the AWS IP Pool for Dangling Domains2 people · 2 mentions · first linked 2015-10-07
- Star Wars: I Find Your Lack of Network Segmentation Disturbing2 people · 2 mentions · first linked 2016-12-05
- /resources/tools/other-free-tools/md4md5-collision-code/2 people · 2 mentions · first linked 2015-01-17
- Hello World Introducing the Bishop Fox Cybersecurity Style Guide2 people · 2 mentions · first linked 2018-02-16
- LinkedIn ‘Intro’duces Insecurity2 people · 2 mentions · first linked 2013-10-24
- The Active Directory Kill Chain: Is Your Company at Risk?2 people · 2 mentions · first linked 2015-09-09
- Fishing the AWS IP Pool for Dangling Domains (2015)2 people · 2 mentions · first linked 2018-05-08
What Hacker News says?
I don't think that's true. This site from 2006 claims they could find collisions in an average of 45 minutes on a 1.6 Ghz Pentium 4: http://www.bishopfox.com/resources/tools/other-free-tools/md... If you account for speed increases over the last 10 years and assume the password thief has access to a botnet, then it wouldn't surprise me if they've found collisions for the entire list. Edit: Nevermind, the link finds…
Comment linking /resources/tools/other-free-tools/md4md5-collision-code/
on “Yahoo discloses hack of 1B accounts”Submitted LinkedIn ‘Intro’duces Insecurity as a story · 565 points
HN discussionBishop Fox ( https://www.bishopfox.com ) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time | Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navi…
Comment linking /
on “Ask HN: Who is hiring? (November 2016)”Submitted Don't use text pixelation to redact sensitive information as a story · 485 points
HN discussionBishop Fox ( https://www.bishopfox.com ) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time | Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navi…
Comment linking /
on “Ask HN: Who is hiring? (October 2016)”Submitted If You Can’t Break Crypto, Break the Client: Recovery of Plaintext iMessage Data as a story · 282 points
HN discussionBishop Fox ( https://www.bishopfox.com ) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time | Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navi…
Comment linking /
on “Ask HN: Who is hiring? (July 2016)”Submitted Multiple Heap Buffer Overflows In the Windows DNS Client as a story · 83 points
HN discussionBishop Fox ( https://www.bishopfox.com ) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time | Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navi…
Comment linking /
on “Ask HN: Who is hiring? (September 2016)”Submitted ‘Anonymous’ Chat App Hijacks Contact Data as a story · 73 points
HN discussion100% JSON wasn't some magical, made-on-the-fly format that makes Crockford some kind of genius. It was simply the standard Javascript object literal notation with some added constraints. I think some of those constraints make sense (i.e. are there any other languages that support both single and double quotes for string literals?), but funnily enough, some of the biggest issues with JSON interoperability is it is ve…
Comment linking /blog/json-interoperability-vulnerabilities
on “JSON5 – JSON for Humans”Submitted Don't use pixelation for redacting text (2022) as a story · 62 points
HN discussionHere's the case [1]. Looks like they targeted a single /24 so that's likely why it wasn't a bigger issue. [1] https://bishopfox.com/blog/bgp-hijacking-technical-post-mort...
Comment linking /blog/bgp-hijacking-technical-post-mortem
on “Cloudflare was down”Submitted XMPP: An Under-Appreciated Attack Surface as a story · 25 points
HN discussionI actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-po...
Comment linking /blog/2015/10/fishing-the-aws-ip-pool-for-dangling-domains/
on “A Recycled IP Address Caused Me to Pirate Books by Accident”Submitted In the News: A BGP Hijacking Technical Post-Mortem as a story · 17 points
HN discussionhttps://bishopfox.com/blog/json-interoperability-vulnerabili...
Comment linking /blog/json-interoperability-vulnerabilities
on “IETF should keep XMPP as IM standard, instead of Matrix”Submitted Google Hacking Diggity Project as a story · 15 points
HN discussionI didn't realise this was true - https://www.bishopfox.com/resources/tools/other-free-tools/m...
Comment linking /resources/tools/other-free-tools/md4md5-collision-code/
on “SHA1 collisions make Git vulnerable to attacks”Submitted LinkedIn "Intro" Hijacks Email as a story · 11 points
HN discussion> No attacker is going to start out by trying to break the crypto, unless it's obviously broken. Emphasis mine. I agree with ryanlol here. Why bother with active attacks when you can just steal their private key from a code execution? Similar to this, but with the priority flipped: https://www.bishopfox.com/blog/2016/04/if-you-cant-break-cry...
Comment linking /blog/2016/04/if-you-cant-break-crypto-break-the-client-recovery-of-plaintext-imessage-data/
on “Viber adds end-to-end encryption”Submitted Multiple Heap Buffer Overflows in the Windows DNS Client as a story · 10 points
HN discussionThat's a completely different from just wanting the e2e crypto source, which is useless by itself. https://www.bishopfox.com/blog/2016/04/if-you-cant-break-cry...
Comment linking /blog/2016/04/if-you-cant-break-crypto-break-the-client-recovery-of-plaintext-imessage-data/
on “Viber adds end-to-end encryption”Submitted Fishing the AWS IP Pool for Dangling Domains as a story · 7 points
HN discussionIt's not hard to find quite recent json parsing vulnerabilities, e.g. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b... A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json Here is a n…
Comment linking /blog/json-interoperability-vulnerabilities
on “Useful Old Technologies: ASN.1 (2013)”Submitted Star Wars: I Find Your Lack of Network Segmentation Disturbing as a story · 5 points
HN discussionThis may help: http://www.bishopfox.com/blog/2013/10/linkedin-intro/ and the blog post announcing it: https://engineering.linkedin.com/mobile/linkedin-intro-doing...
Comment linking /blog/2013/10/linkedin-intro/
on “Intro for iPhone – No Longer Supported”Submitted Raink: Use LLMs for Document Ranking as a story · 4 points
HN discussionYou can also use https://github.com/noperator/raink to brainstorm TLDs that are relevant to some topic you care about. For example: curl -s https://data.iana.org/TLD/tlds-alpha-by-domain.txt | raink -f /dev/stdin -p 'which of these TLDs is most related to the concept of "hacking"?' | jq -r 'map(.value)[:10]' [ "BLACK", "COMSEC", "TOOLS", "SECURITY", "ZERO", "EXPOSED", "FORUM", "SHELL", "BOT", "SOFTWARE" ] Those are…
Comment linking /blog/raink-llms-document-ranking
on “Tldx – CLI tool for fast domain name discovery”Submitted Show HN: Broken Hill: A Productionized GCG Attack Tool for Use Against LLMs as a story · 4 points
HN discussion
