Top all-time · #143
Daemonic Dispatches
Personal blog · daemonology.net/blogsystemssecurityprogramming
Daemonic Dispatches is a personal blog at daemonology.net about systems, security and programming. Since 2007, 303 different Hacker News readers have linked it 618 times, most often “Hacker News Daily”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
HN readers link Colin Percival's blog for security and cryptography write-ups, including CPU side-channel attacks such as hyperthreading, Tarsnap, and his HN Daily digest of top Hacker News stories.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Hacker News Daily50 people · 67 mentions · first linked 2010-07-14
- Tarsnap critical security bug19 people · 19 mentions · first linked 2011-01-18
- Cryptographic Right Answers14 people · 16 mentions · first linked 2009-06-11
- Binary diff/patch utility14 people · 14 mentions · first linked 2007-11-22
- FreeBSD on EC2 status9 people · 12 mentions · first linked 2011-10-23
- Playing chicken with cat.jpg8 people · 18 mentions · first linked 2012-01-19
- Encrypt-then-MAC8 people · 9 mentions · first linked 2009-06-24
- Cache Missing for Fun & Profit7 people · 9 mentions · first linked 2008-10-02
- Hyper-Threading Considered Harmful (2005)7 people · 9 mentions · first linked 2011-09-20
- /hn-daily/7 people · 8 mentions · first linked 2021-02-22
What Hacker News says?
Try this: http://www.daemonology.net/hn-daily/
Comment linking /hn-daily/
on “Tell HN: New features and a moderator”Submitted On the Use of a Life as a story · 1275 points
HN discussionI should at first point out that I am by no definition an expert on CPU design, operating systems, or infosec. But I just remembered that years ago the FreeBSD developers discovered a vulnerability in Intel's Hyperthreading that could allow a malicious process to read other processes' memory.[1] To the degree that I understand what is going on here, that sounds very similar to the way the current vulnerabilities wor…
Comment linking /hyperthreading-considered-harmful/
on “Reading privileged memory with a side-channel”Submitted On the use of a life (2020) as a story · 422 points
HN discussionDoes S3 count as a SaaS? Or is that too low level? How about tarsnap? https://www.daemonology.net/blog/2014-04-02-tarsnap-price-cu...
Comment linking /blog/2014-04-02-tarsnap-price-cut.html
on “LLM Inevitabilism”Submitted A plan for open source software maintainers as a story · 403 points
HN discussionColin Percival found a similar problem with Intel's implementation of "HyperThreading" back in 2005: http://www.daemonology.net/hyperthreading-considered-harmful...
Comment linking /hyperthreading-considered-harmful/
on “Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown”Submitted A year of funded FreeBSD development as a story · 382 points
HN discussionBy the way, didn't cperciva point out this vuln way back in 2005? http://www.daemonology.net/papers/htt.pdf Actually that seems to be rather different, but still similar-ish. They both use threads to exploit memory caches in an unexpected way. I thought he deserved a mention since no one really took it seriously back then. https://it.slashdot.org/story/05/05/13/0520214/hyperthreadin... http://freerepublic.com/focus/…
Comment linking /papers/htt.pdf
on “Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown”Submitted Don't trust me: I might be a spook as a story · 371 points
HN discussionColin Percival hasn't been the FreeBSD Security Officer for two years. He stepped down from the role because Tarsnap was taking too much of his time: http://www.daemonology.net/blog/2012-05-21-new-freebsd-secur...
Comment linking /blog/2012-05-21-new-freebsd-security-officer.html
on “WhatsApp Co-Founder Donates $1M to FreeBSD Foundation”Submitted When security goes right as a story · 336 points
HN discussionI am not going to be debating what exact problems you had, but I must be extremely lucky if all those years I never had any kind of showstopper critical issue that made me think "Ok, I can't deal with this and I have to go back to a proprietary desktop". It's been at least since 2012 that I had installed Linux and couldn't connect a printer or scanner. Meanwhile my wife's laptop on windows asked to reinstall drivers…
Comment linking /blog/2020-05-22-my-new-FreeBSD-laptop-Dell-7390.html
on “Can't you just right click?”Submitted A Canadian payroll dependency chart as a story · 335 points
HN discussionwe're already seeing quite a few Apply HNs, so we'll add a link for those a la /ask and /show Quick poll for the community here: I run Hacker News Daily ( http://www.daemonology.net/hn-daily/ ) which many people know about; but also Ask HN Weekly ( http://www.daemonology.net/hn-weekly-ask/ ) and Show HN Weekly ( http://www.daemonology.net/hn-weekly-show/ ). In each case the methodology is the same: The 10 highest-sc…
Comment linking /hn-weekly-show/
on “Ask HN: Pick startups for YC to fund”Submitted Tarsnap price cut as a story · 320 points
HN discussionStripe's Terms of Service reveal that they use Coinbase in the backend to transact and exchange the bitcoins: https://stripe.com/bitcoin/terms If you are a small merchant planning to do less than $1-2 million dollars in sales, you might still prefer using Coinbase directly instead of Stripe though, because Coinbase waives all fees until the first $1 million dollars (then it's 1%), but Stripe charges a constant 0.5%…
Comment linking /blog/2014-03-27-tarsnap-bitcoin.html
on “Stripe: Bitcoin”Submitted Thoughts on Startup School as a story · 318 points
HN discussionPaper is here: https://www.daemonology.net/papers/cachemissing.pdf Your link is the website I put up for non-experts when I announced the issue.
Comment linking /papers/cachemissing.pdf
on “One of my papers got declined today”Submitted A very valuable vulnerability as a story · 315 points
HN discussionThe paper is here: http://www.daemonology.net/hyperthreading-considered-harmful... As its author noted, the paper has done fine ciation- and impact-wise.
Comment linking /hyperthreading-considered-harmful/
on “One of my papers got declined today”Submitted Zeroing buffers is insufficient as a story · 299 points
HN discussionNot all of them were known back then obviously, but there were definitely known timing-info-leak flaws with Pentium 4 hyper threading[1], its remarkable on that basis that the modern class of execution timing exploits has taken so long to arise, considering their approach and concept really isn't fundamentally any different. [1] http://www.daemonology.net/papers/htt.pdf by none other than our resident cpercival!
Comment linking /papers/htt.pdf
on “AMD lands Google, Twitter as customers with newest server chip”Submitted Playing chicken with cat.jpg as a story · 288 points
HN discussionThis is an accident waiting to happen. Whoever does this is doing it wrong. The case was well-made here by Colin Percival (the tarsnap guy) in his blog: "Playing chicken with cat.jpg" http://www.daemonology.net/blog/2012-01-19-playing-chicken-w... >> "The answer isn't for (any company) to prove that they can be trusted; the answer is to ensure that their customers don't need to trust them ... The best way to avoid p…
Comment linking /blog/2012-01-19-playing-chicken-with-cat-jpg.html
on “Path uploads your entire iPhone address book to its servers”Submitted The EC2 firewall is broken as a story · 286 points
HN discussion> by the way, that PoC was intense. Makes you wonder if the NSA knew about it all along :) Colin Percival found a very similar issue with Intel's implementation of SMT on the Pentium 4 in 2005: http://www.daemonology.net/papers/htt.pdf So the general idea of using timing attacks against the cache to leak memory has been known for at least that long. In 2016, two researchers from the University of Graz gave a talk at…
Comment linking /papers/htt.pdf
on “Meltdown Proof-of-Concept”Submitted How to zero a buffer as a story · 277 points
HN discussionThe original commenter said, "using RSA 1024 bit keys with exponent of 3" was a flaw in DRM systems he or she had reviewed. Your response was "e=3 is fine, so long as you remember to pad" and then "what kind of attacks remain when using proper padding (e.g. OAEP)?" I feel a bit queasy any time I read "just do this" as a solution to crypto flaws[1]. Such answers assume way too much about the system the proposed fix a…
Comment linking /blog/2011-01-18-tarsnap-critical-security-bug.html
on “Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING"”Submitted Everything you need to know about cryptography in 1 hour (2010) [pdf] as a story · 275 points
HN discussion
