Top all-time · #8601
cr0 blog
Personal blog · blog.cr0.orgsecuritysystems
cr0 blog is a personal blog at blog.cr0.org about security and systems. Since 2009, 9 different Hacker News readers have linked it 9 times, most often “A few thoughts on Fuchsia security”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for posts on security topics such as Linux and Chrome sandboxing, seccomp, Fuchsia and Java flaws. Commenters cite it as background or support for their own points.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
a blog about IT security and other geek interests
Most-linked posts?
- A few thoughts on Fuchsia security3 people · 3 mentions · first linked 2021-06-12
- Javocalypse2 people · 2 mentions · first linked 2010-04-09
What Hacker News says?
Related: > Our kernel, Zircon, [is not in Rust]( https://twitter.com/cpuGoogle/status/1397265884251525122 ). Not yet anyway. But it is in [a nice, lean subset of C++]( https://fuchsia.dev/fuchsia-src/development/languages/c-cpp/... ) which I consider a vast improvement over C. https://blog.cr0.org/2021/06/a-few-thoughts-on-fuchsia-secur...
Comment linking /2021/06/a-few-thoughts-on-fuchsia-security.html
on “The Insecurity Industry”Submitted A few thoughts on Fuchsia security as a story · 176 points
HN discussionSeccomp does this in most kernel versions I believe: http://blog.cr0.org/2009/05/time-stamp-counter-disabling-odd...
Comment linking /2009/05/time-stamp-counter-disabling-oddities.html
on “Mitigations landing for new class of timing attack”Submitted Introducing Chrome's next-generation Linux sandbox as a story · 10 points
HN discussionLinks to http://blog.cr0.org/2010/04/javacalypse.html , which is much more informative.
Comment linking /2010/04/javacalypse.html
on “Java zero-day flaw under active attack”Submitted Javocalypse as a story · 5 points
HN discussion> b. Can you launch attack on other local network resources from within the compromised sandbox – read insecure filesystems, make tcp sockets to local resources etc – these are not prevented by OS sandboxing capabilities that Chrome depends on. Huh? Chrome on Linux uses a network namespace to remove all networking from the renderer process, and then uses seccomp to forbid most system calls, and can very easily preve…
Comment linking /2012/09/introducing-chromes-next-generation.html
on “CVE-2023-4863: Heap buffer overflow in WebP (Chrome)”Submitted Linux NULL pointer dereference due to incorrect proto_ops initializations as a story · 2 points
HN discussionSubmitted A few thoughts on Fuchsia security (2021) as a story · 1 points
HN discussion
