Top all-time · #2237
corsix.org
Personal blog · corsix.orgprogrammingsystemshardware
corsix.org is a personal blog at corsix.org about programming, systems and hardware. Since 2009, 36 different Hacker News readers have linked it 73 times, most often “Malicious LuaJIT bytecode”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Most-linked posts?
- Malicious LuaJIT bytecode5 people · 7 mentions · first linked 2015-11-11
- Corsix – A whirlwind tour of AArch64 vector instructions4 people · 4 mentions · first linked 2023-06-06
- RISC-V Conditional Moves4 people · 4 mentions · first linked 2025-09-28
- What even is a pidfd anyway?3 people · 3 mentions · first linked 2024-05-16
- Higher Quality Random Floats3 people · 3 mentions · first linked 2023-10-17
- For want of a relative path to ld.so2 people · 2 mentions · first linked 2024-06-04
- Faster CRC32-C on x862 people · 2 mentions · first linked 2022-08-01
- Malicious LuaJIT bytecode2 people · 2 mentions · first linked 2015-11-12
- Tenstorrent Wormhole Series2 people · 2 mentions · first linked 2024-12-31
- /content/look-lua-52-work32 people · 2 mentions · first linked 2011-12-17
What Hacker News says?
There's a problem---you can break out of Lua with malformed bytecode [1] and the Lua team don't want to spend the time trying to validate Lua byte code [2]. That's why the latest Lua version has an option to ignore precompiled Lua scripts. And sadly, I can see the same happening here. [1] https://www.corsix.org/content/malicious-luajit-bytecode [2] The overhead will eat any performance gained by using precompiled Lu…
Comment linking /content/malicious-luajit-bytecode
on “Towards a JavaScript Binary AST”Submitted Galois field instructions on 2021 CPUs as a story · 163 points
HN discussionA small history of LuaJIT sandbox escapes: - 5.2, 2016: https://apocrypha.numin.it/talks/lua_bytecode_exploitation.p... (9MB PDF) - 5.2, 2016: https://github.com/erezto/lua-sandbox-escape - 5.1, 2015: https://www.corsix.org/content/malicious-luajit-bytecode (warning: dense) There's a "luarop" link (boop.i0i0.me/blog.lua/luarop) referenced in the PDF, but the link sadly seems to have died (IA never crawled the domain…
Comment linking /content/malicious-luajit-bytecode
on “Tiny C Compiler”Submitted My favourite small hash table as a story · 159 points
HN discussionOut of curiosity, are you planning on (progressively, slowly) rolling your own JIT, or using something like DynASM ( https://luajit.org/dynasm_features.html ), libFirm ( https://pp.ipd.kit.edu/firm/Features.html ), or some other preexisting thing (eg https://github.com/wdv4758h/awesome-jit ) in the space? FWIW, I understand that LuaJIT gets some of its insane real-world performance from a JIT and VM design that's ef…
Comment linking /content/malicious-luajit-bytecode
on “MiniVM: A zero-dependency cross-language runtime on par with LuaJIT and C”Submitted Faster CRC32-C on x86 as a story · 107 points
HN discussionhttps://www.corsix.org/content/contrasting-intel-amx-and-app... compares this with Intel’s AMX
Comment linking /content/contrasting-intel-amx-and-apple-amx
on “Apple AMX instruction set (M1/M2 matrix coprocessor)”Submitted Linux/ELF .eh_frame from the bottom up as a story · 105 points
HN discussionUsing the notation from the article, N+K is sufficient for RS(N,K). One point of confusion is that different authors use different notation; some use RS(num data shards, num parity shards), some use RS(total num shards, num data shards), and some use RS(total num shards, num parity shards). Per the article, I'll use RS(num data shards, num parity shards). As for where the +1 comes from, the clue is in the "noting th…
Comment linking /content/reed-solomon-for-software-raid
on “The essence of Reed-Solomon coding”Submitted Converting floats to strings as a story · 97 points
HN discussionAlternatively, the following pair of articles, the first of which is already referenced as a footnote in the OP: http://www.corsix.org/content/galois-field-instructions-2021... http://www.corsix.org/content/reed-solomon-for-software-raid
Comment linking /content/reed-solomon-for-software-raid
on “The essence of Reed-Solomon coding”Submitted On libunwind and dynamically generated code on x86-64 as a story · 96 points
HN discussionThe next article in blog order is one application: https://www.corsix.org/content/reed-solomon-for-software-rai... Another application is crypto: the SubBytes step of AES maps very neatly onto gf2p8affineinvqb, so algorithms that are similar to AES but not exactly AES could make use of gf2p8affineinvqb
Comment linking /content/reed-solomon-for-software-raid
on “Galois field instructions on 2021 CPUs”Submitted RISC-V Conditional Moves as a story · 79 points
HN discussionHe’s done some interesting work with crc32 ~recently: https://www.corsix.org/content/fast-crc32c-4k https://github.com/corsix/fast-crc32/
Comment linking /content/fast-crc32c-4k
on “My favourite small hash table”Submitted Alternatives to short unconditional jumps on x86 as a story · 66 points
HN discussionIf you learn AVX2 programming via highload, my impression is that NEON is quite similar. The main difference is the lack of movemask. You can read these[0] articles[1] about what to do instead. For SVE, prior to very recent versions of SVE, there was no tblq (pshufb equivalent) so I didn't have much hope for using it for general-purpose programming, though of course it would be fine for stuff like TFA. [0]: https://…
Comment linking /content/whirlwind-tour-aarch64-vector-instructions
on “Counting bytes faster than you'd think possible”Submitted Contrasting Intel AMX and Apple AMX as a story · 65 points
HN discussionhttp://www.corsix.org/content/look-lua-52-work3 (#19) http://lua.2524044.n2.nabble.com/petition-to-keep-ipairs-ali... Edit: both are from 2010. This never became final perhaps?
Comment linking /content/look-lua-52-work3
on “Lua: Good, bad, and ugly parts”Submitted __VA_OPT__ Minutiae as a story · 59 points
HN discussionYou can start with this idea, and then make it _very_ performant by using bit counting instructions. See https://www.corsix.org/content/higher-quality-random-floats for an exposition.
Comment linking /content/higher-quality-random-floats
on “Perfect Random Floating-Point Numbers”Submitted What even is a pidfd anyway? as a story · 12 points
HN discussionNote that loading (maliciously crafted) bytecode is generally not safe in Lua; sandboxing can be escaped in more ways than what's possible when loading plaintext sourcecode, and there are no full mitigations for this currently as far as I know (and would probably be highly interpreter/version sensitive anyway)-- the only "real" mitigation strategy is to just not `load` bytecode at all. But this is probably a non-iss…
Comment linking /content/malicious-luajit-bytecode
on “Show HN: Ldump – serialize any Lua data”Submitted Tenstorrent Wormhole Series as a story · 9 points
HN discussionI'm completely naive, but even so I'm tentatively confident saying yes, it's a halting problem thing. My understanding of formal verification is a) that it doesn't eliminate bugs, it just reduces their probability by a percentage, and b) that it's academically very attractive (which is why HN is constantly hearing about it) but practically very expensive in terms of investment/return, in the sense that formal verifi…
Comment linking /content/malicious-luajit-bytecode
on “An FPGA-based In-line Accelerator for Memcached (2013) [pdf]”Submitted A simplified model of Fil-C as a story · 8 points
HN discussionARMv8.7 added some new instructions for int min/max to replace cmp+csel. (I'm surprised it took them so long to add popcnt.) https://www.corsix.org/content/arm-cssc
Comment linking /content/arm-cssc
on “RISC-V Conditional Moves”Submitted Estimating pi with LuaJIT as a story · 6 points
HN discussionAny links to info on 5.1.4 -> 5.2 changes? I can't seem to find any. EDIT: Found some information! http://www.corsix.org/content/look-lua-52-work3
Comment linking /content/look-lua-52-work3
on “[ANN] Lua 5.2.0 (final) now available”Submitted RISC-V Conditional Moves as a story · 5 points
HN discussion
