Top all-time · #19237
Brandon Azad
Personal blog · bazad.github.iosecuritysystems
Brandon Azad's personal blog at bazad.github.io covers security and systems. Since 2016, 4 different Hacker News readers have linked it 4 times. The last post was in 2018, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN commenters cite Brandon Azad's posts on Apple kernel vulnerabilities, such as a 2016 macOS use-after-free write-up, as background for discussions of Pegasus and iOS exploits.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Brandon Azad's security blog
What Hacker News says?
Pointer authentication has been around for several years already. As with many things in hardware, though, it takes time for the software ecosystem around it to mature. Still, I've found it to be quite influential. Here are a couple "real world" examples-- Project Zero had a blogpost about some of the weaknesses on the original Pointer Auth spec [0], and even had a follow up [1]. Here is an example of what some miti…
Comment linking /presentations/BlackHat-USA-2020-iOS_Kernel_PAC_One_Year_Later.pdf
on “AWS Graviton 3 Instances”Submitted Analyzing the iOS 12 kernelcache's tagged pointers as a story · 2 points
HN discussionOnce again demonstrating that the term "zero day" is horribly overused and misused and probably should be eliminated from the lexicon, the OSUnserializeBinary bug doesn't appear to be new. Brandon Azad[1] says he discovered it last year. It was fixed in OS X in May. Or maybe the fix didn't work since they had to make another patch this week. [1] https://bazad.github.io/2016/05/mac-os-x-use-after-free/
Comment linking /2016/05/mac-os-x-use-after-free/
on “PEGASUS iOS Kernel Vulnerability Explained”Submitted CVE-2017-13868: A fun XNU infoleak as a story · 2 points
HN discussion