Top all-time · #1728
codeblog
Personal blog · outflux.net/blogsecuritysystems
codeblog is a personal blog at outflux.net about security and systems. Since 2011, 42 different Hacker News readers have linked it 67 times, most often “Making C Less Dangerous [pdf]”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (14) to say how often HN recommends it.?
Why HN links it
HN readers link Kees Cook's codeblog for its kernel and security hardening posts, including grsecurity features reimplemented upstream in Linux, plus posts on wardriving, TPM randomness and RAID booting.
- Recommended for · 1 comments
- One commenter called the security series of posts on kernel hardening "a pretty excellent series" with much greater depth than other content.
Summarised by Claude from a sample of 14 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Making C Less Dangerous [pdf]5 people · 5 mentions · first linked 2018-08-27
- Security Things in Linux v5.83 people · 3 mentions · first linked 2021-02-09
- Security things in Linux v4.123 people · 3 mentions · first linked 2017-07-10
- Security things in Linux v4.82 people · 2 mentions · first linked 2016-10-05
- Security-related improvements in Linux 4.202 people · 2 mentions · first linked 2018-12-25
- Security Things in Linux v5.52 people · 2 mentions · first linked 2020-05-28
- Security Things in Linux v5.12 people · 2 mentions · first linked 2019-05-28
- security things in Linux v5.42 people · 2 mentions · first linked 2020-02-19
- Security Improvements in Linux 4.13 Kernel2 people · 2 mentions · first linked 2017-09-05
- Security things in Linux v5.32 people · 2 mentions · first linked 2019-11-15
What Hacker News says?
https://outflux.net/blog/archives/2010/01/24/google-is-wardr... If you don't have Wifi on, maybe you had it before, and Google saved your location based on it?
Comment linking /blog/archives/2010/01/24/google-is-wardriving/
on “Show HN: See a Satellite Tonight. No Telescope Required”Submitted Security things in Linux v4.8 as a story · 97 points
HN discussionKees Cook and others have been porting or reimplementing features exclusive to grsec in upstream linux. https://outflux.net/blog/archives/2016/09/26/security-things... https://outflux.net/blog/archives/2016/09/27/security-things... https://outflux.net/blog/archives/2016/09/28/security-things... https://outflux.net/blog/archives/2016/09/30/security-things... https://outflux.net/blog/archives/2016/10/03/security-thing…
Comment linking /blog/archives/2016/10/04/security-things-in-linux-v4-8/
on “FreeBSD 11.0 Now Available”Submitted Security bug lifetime as a story · 84 points
HN discussionI like data like this - it reminds me of the pleasant places maps[1]. That said - you have to be wary of both types of maps because it doesn't take into account other potentially annoying factors. The biggest being humidity - there's a huge difference between 90 degree phoenix and 90 degree miami. Then there's rainfall, and one a lot of people don't think about - wind. To add - if you're thinking about seriously com…
Comment linking /weather/noaa/index.php
on “Goldilocks Zone Finder – Find your ideal climate”Submitted Security things in Linux v4.3 as a story · 66 points
HN discussionDoes Google itself help? https://events19.linuxfoundation.org/wp-content/uploads/2017... https://outflux.net/slides/2019/lss/kspp.pdf Slides from 2018 and 2019 talks.
Comment linking /slides/2019/lss/kspp.pdf
on “Fuchsia overview”Submitted Control Flow Integrity (CFI) in the Linux Kernel [pdf] as a story · 56 points
HN discussionFor similar content but in much greater depth, this is a pretty excellent series of blog posts: https://outflux.net/blog/archives/2017/07/10/security-things...
Comment linking /blog/archives/2017/07/10/security-things-in-linux-v4-12/
on “Hardening the Kernel in Android Oreo”Submitted Security things in Linux v4.12 as a story · 56 points
HN discussionDoing one of these things may introduce a security vulnerability, depending on the rest of your environment. Some programs that use select(2) are known to assume that FD_SETSIZE is at least the maximum number of file descriptors available (instead of checking FD_SETSIZE). This lack of bounds checking may lead to a stack or heap overflow and a security vulnerability. More recently, if you build with fortified glibc o…
Comment linking /blog/archives/2014/06/13/5-year-old-glibc-select-weakness-fixed/
on “Improved default settings for Linux machines”Submitted Security things in Linux v4.14 as a story · 53 points
HN discussionIf you run pulseaudio you can use parec. It's fiddly but there is an example script here http://www.outflux.net/blog/archives/2009/04/19/recording-fr...
Comment linking /blog/archives/2009/04/19/recording-from-pulseaudio/
on “/dev/audio”Submitted Security Things in Linux v5.2 as a story · 46 points
HN discussionnot necessarily. there are software emulation -- examples would be W^X on OpenBSD[1] and Grsecurity/PaX on linux[2]. Ubuntu[3] and RedHat[4] also has (partial) NX-emulation thanks to ExecShield. As for OpenBSD and Linux without grsec/pax, one can bypass NX (whether the CPU has the NX-bit or not) by marking the region with the shellcode as executable, eg: mprotect(shellcode & -pagesize, len, PROT_EXEC); ( (void( )())…
Comment linking /blog/archives/2009/05/14/nx-emulation-in-ubuntu/
on “Writing my first shellcode”Submitted Security-related improvements in Linux 4.20 as a story · 8 points
HN discussionUpdate for the latest security issue: https://outflux.net/blog/archives/2016/10/20/cve-2016-5195/
Comment linking /blog/archives/2016/10/20/cve-2016-5195/
on “Security bug lifetime”Submitted Security things in Linux v4.20 as a story · 5 points
HN discussionAccording to http://www.outflux.net/blog/archives/2009/10/22/tpm-as-rng/#... , TPM may even be using PRNGs. So you're right that the quality of output need not be better than what a modern OS already provides. (I am not aware of any case where a properly-used /dev/random failed to produce sufficient entropy. Note that doing something sensible at boot is part of "properly-used" here.) It is possible to provide true r…
Comment linking /blog/archives/2009/10/22/tpm-as-rng/
on “Web server offers true random numbers via fluctuations of the quantum vacuum”Submitted Security things in Linux v4.7 as a story · 5 points
HN discussionAny risk is increased by sloppy implementation. For example, every single keystroke is being sent over HTTP without encryption. ( http://www.outflux.net/blog/archives/2012/11/09/product-sear... ) Today, if you want to de-Amazon Ubuntu, it's not just the shopping lens you have to disable, you should also remove Unity web app integration. ( https://news.ycombinator.com/item?id=4888234 ) If it gets to the point where y…
Comment linking /blog/archives/2012/11/09/product-search-in-ubuntu-12-10/
on “Ubuntu Community Manager: RMS's Post Seems a Bit Childish To Me and spreads FUD”Submitted Security Things in Linux v5.5 as a story · 4 points
HN discussionYou can boot from a MD RAID1 system that's degraded easily enough. Here's some info on how to implement it https://outflux.net/blog/archives/2018/04/19/uefi-booting-an...
Comment linking /blog/archives/2018/04/19/uefi-booting-and-raid1/
on “Btrfs in Linux 6.2 brings Performance Improvements, better RAID 5/6 Reliability”Submitted security things in Linux v5.4 as a story · 4 points
HN discussionIt's more accurate to use the MAC address of the Wifi spot. Google was triangulating the locations of Wifi spots and recording their MAC address while taking pictures for Google Maps Street View. https://outflux.net/blog/archives/2010/01/24/google-is-wardr... https://www.darkreading.com/risk-management/google-wardrivin... https://www.darkreading.com/risk-management/google-street-vi... http://transition.fcc.gov/DA-12…
Comment linking /blog/archives/2010/01/24/google-is-wardriving/
on “Ask HN: How does my android device know my weather without location perms?”Submitted Security things in Linux v5.3 as a story · 4 points
HN discussionSlides are available here, if you don't want to watch the full talk. https://outflux.net/slides/2022/lca/
Comment linking /slides/2022/lca/
on “Meaningful Bounds Checking in the Linux Kernel – Linux.conf.au”Submitted Making C Less Dangerous [pdf] as a story · 4 points
HN discussionSubmitted Security things in Linux v4.5 as a story · 4 points
HN discussionSubmitted Security Things in Linux v5.8 as a story · 3 points
HN discussion
