Top all-time · #146
Errata Security
Personal blog · blog.erratasec.comsecurityprogramming
Errata Security is a personal blog at blog.erratasec.com about security and programming. Since 2013, 297 different Hacker News readers have linked it 499 times, most often “Secret Dots from Printer Outed NSA Leaker (2017)”. The last post was in 2024, but the archive is still widely read.
Rarely recommended · 1 of 40 sampled comments recommend it?
Why HN links it
HN readers link Robert Graham's Errata Security posts as technical corrections and sources in security and x86 discussions, especially on the x86-as-high-level-language point, Superfish, and debunking NSA and crypto claims.
- Recommended for · 1 comments
- One commenter calls a linked Graham post 'a highly recommended read'.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Secret Dots from Printer Outed NSA Leaker (2017)8 people · 8 mentions · first linked 2018-06-08
- How the Intercept Outed Reality Winner7 people · 8 mentions · first linked 2017-06-06
- x86 is a high-level language (2015)6 people · 6 mentions · first linked 2015-03-25
- Extracting the SuperFish certificate5 people · 5 mentions · first linked 2015-02-19
- Satoshi: how Craig Wright's deception worked5 people · 5 mentions · first linked 2016-05-03
- You are committing a crime right now (2012)4 people · 7 mentions · first linked 2013-09-08
- C can be memory safe4 people · 6 mentions · first linked 2023-02-02
- Bash 'shellshock' scan of the Internet4 people · 5 mentions · first linked 2014-09-24
- /2015/03/x86-is-high-level-language.html4 people · 5 mentions · first linked 2018-05-18
- /2014/07/validating-xkeyscore-code.html4 people · 5 mentions · first linked 2014-07-05
What Hacker News says?
Apparently Bezos's mistress's password is in haveibeenpwned.com so this very likely didn't require a government entity. https://blog.erratasec.com/2019/02/how-bezos-dick-pics-might...
Comment linking /2019/02/how-bezos-dick-pics-mightve-been-exposed.html
on “No Thank You, Mr. Pecker”Submitted Extracting the SuperFish certificate as a story · 867 points
HN discussion"x86 is a high-level language": https://blog.erratasec.com/2015/03/x86-is-high-level-languag... / https://news.ycombinator.com/item?id=9264195 Everything's an API at the end of the day. There was an article on here recently about the practical effects of the TLS 1.3 drafts, and how they broke proxies. I can't find it. It was talking about how the proxies choked because so many variable wire bits in TLS 1.2 stayed st…
Comment linking /2015/03/x86-is-high-level-language.html
on “The Stuxnet worm may be the most sophisticated software ever written”Submitted Some notes about HTTP/3 as a story · 561 points
HN discussionAaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...
Comment linking /2015/02/extracting-superfish-certificate.html
on “Lenovo Caught Installing Adware on New Computers”Submitted NBC Story about Hacking at Sochi is 100% Fraudulent as a story · 497 points
HN discussionAnd it has been successfully cracked[1], revealing (potential) associations with a dodgy SSL redirector [2]. [1] http://blog.erratasec.com/2015/02/extracting-superfish-certi... [2] http://www.komodia.com
Comment linking /2015/02/extracting-superfish-certificate.html
on “Lenovo Caught Installing Adware on New Computers”Submitted Secret Dots from Printer Outed NSA Leaker as a story · 478 points
HN discussionNote that the findings referenced by your first link are total B.S.: http://blog.erratasec.com/2015/04/no-75-are-not-vulnerable-t...
Comment linking /2015/04/no-75-are-not-vulnerable-to-heartbleed.html
on “How is NSA breaking so much crypto?”Submitted X86 is a high-level language as a story · 319 points
HN discussionThanks for the explanation. I can half-agree, but think the meta-discussion about the role of Twitter and Facebook in shaping the US politics is worthy of discussion even if the NY Post article turns out to be a wholesale fabrication. You might be interested that I also posted this article [ https://blog.erratasec.com/2020/10/yes-we-can-validate-leake... ] which talks about the relative ease of validating the emails…
Comment linking /2020/10/yes-we-can-validate-leaked-emails.html
on “Twitter and Facebook's action over Joe Biden article reignites bias claims”Submitted Pin-pointing China's attack against GitHub as a story · 305 points
HN discussion[I'm not a microarchitecture expert] I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195 , http://blog.erratasec.com/2015/03/x86-is-high-level-language... ). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpret…
Comment linking /2015/03/x86-is-high-level-language.html
on “Disabling Intel ME 11 via undocumented mode”Submitted Bash 'shellshock' bug is wormable as a story · 299 points
HN discussionThe article at Errata Security [1] is better. There is an HN submission for it [2], but it hasn't drawn any attention. In particular, it addresses technical issues not covered in the Techdirt article that are relevant to many of the existing comments here on HN. [1] http://blog.erratasec.com/2016/02/some-notes-on-apple-decryp... [2] https://news.ycombinator.com/item?id=11115251
Comment linking /2016/02/some-notes-on-apple-decryption-san.html
on “Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone”Submitted Can I drop a pacemaker 0day? as a story · 299 points
HN discussionRobert Graham (Errata Security)'s notes on this: http://blog.erratasec.com/2016/02/some-notes-on-apple-decryp...
Comment linking /2016/02/some-notes-on-apple-decryption-san.html
on “Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone”Submitted Systemd is bad parsing as a story · 276 points
HN discussionRelated: https://twitter.com/csoghoian/status/549328365422145537 And: http://blog.erratasec.com/2014/12/that-spiegel-nsa-story-is-... Which isn't to say the NSA isn't legitimately participating in IETF and taking such notes ... but that codenames can be taken out of context. ;-)
Comment linking /2014/12/that-spiegel-nsa-story-is-nonsense.html
on “Inside the NSA's War on Internet Security”Submitted Why we have to boycott RSA as a story · 271 points
HN discussionTo "catch a serial killer" you'd need each retailer selling printers to track the ID and model number on a receipt, to be submitted to a central government agency and saved in a database. This is not what's happening in your country either, am I correct? Instead this ordeal makes it possible for the government agencies, who do keep track of their own inventory to follow the tracks of those, who decided to leak docum…
Comment linking /2017/06/how-intercept-outed-reality-winner.html
on “Many of the Pokemon playtest cards were likely printed in 2024”Submitted Reading the Silk Road configuration as a story · 247 points
HN discussionHis crime was that he ran hashcat https://blog.erratasec.com/2019/04/assange-indicted-for-brea... > Had he just been accepting docs as he was initially that would have been fine. They would just invent something else.
Comment linking /2019/04/assange-indicted-for-breaking-password.html
on “Key witness in Assange case admits to lies in indictment”Submitted We may have witnessed a NSA "Shotgiant" TAO-like action as a story · 235 points
HN discussionInteresting comment under the post: >The problem is fairness in the presence of network congestion. To a large extent it depends on most TCP implementations using the same congestion control algorithm, or at least algorithms that have the same general behavior. Google's developed a new algorithm called BBR that is robust, but also unfair. When a TCP connection implementing the NewReno algorithm shares a congested li…
Comment linking /2018/11/some-notes-about-http3.html?showComment=1542664152300&m=1
on “Some notes about HTTP/3”Submitted You are committing a crime right now (2012) as a story · 182 points
HN discussionAre you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
Comment linking /2014/09/bash-shellshock-scan-of-internet.html
on “CVE-2014-7169: Bash Fix Incomplete, Still Exploitable”Submitted How to decrypt WhatsApp end-to-end media files as a story · 166 points
HN discussionReading things like http://blog.erratasec.com/2013/02/custom-stack-it-goes-to-11... suggests that it's probably simply the case that the OS itself is sort of a side-issue once you need performance since you're going to be bypassing the normal network stack anyway. At that point ease of management or package installation probably matters more to developers and it might simply come down to things like driver support a…
Comment linking /2013/02/custom-stack-it-goes-to-11.html
on “How to receive a million packets per second”- id · 2014-07-06
Submitted Jamming XKeyScore as a story · 163 points
HN discussion
