Top all-time · #1127
Filippo Valsorda
Personal blog · filippo.io · on HN as FiloSottilesecurityprogramming
Filippo Valsorda's personal blog at filippo.io covers security and programming. Since 2013, 64 different Hacker News readers have linked it 84 times, most often “Searchable Linux Syscall Table for x86 and x86_64”. It is still writing: the last post was on 2026-10-16, and you can follow it by feed.
Most-linked posts?
- Searchable Linux Syscall Table for x86 and x86_6410 people · 10 mentions · first linked 2014-08-14
- Test your server for the Heartbleed bug7 people · 8 mentions · first linked 2014-04-08
- A simple test for Lenovo users, to check if they are affected by Superfish5 people · 5 mentions · first linked 2015-02-19
- Fake HN titles generated by GPT-34 people · 5 mentions · first linked 2022-11-26
- The “Behind The Sofa” Certificate Transparency Log4 people · 4 mentions · first linked 2017-04-30
- /Heartbleed/3 people · 3 mentions · first linked 2014-11-23
- /3 people · 3 mentions · first linked 2021-05-27
- PSA: enable automatic updates. Please2 people · 2 mentions · first linked 2014-11-10
- /linux-syscall-table2 people · 2 mentions · first linked 2016-06-08
- OpenSSL.org is affected by the OpenSSL Heartbleed bug2 people · 2 mentions · first linked 2014-04-08
What Hacker News says?
heartbleed.com itself is still using a vulnerable OpenSSL, according to http://filippo.io/Heartbleed/#heartbleed.com
Comment linking /Heartbleed/
on “The Heartbleed Bug”Submitted Why Go is elegant and makes my code elegant as a story · 153 points
HN discussionSomeone wrote this: http://filippo.io/Heartbleed/
Comment linking /Heartbleed/
on “The Heartbleed Bug”Submitted Test your server for the Heartbleed bug as a story · 96 points
HN discussionI've built a web tester for this bug, find it at http://filippo.io/Heartbleed/ It actually exploit the bug, since it was quite trivial, and echo some memory. It's written in Go, no more than 100 lines. I'll release code in some time.
Comment linking /Heartbleed/
on “The Heartbleed Bug”Submitted A simple test for Lenovo users, to check if they are affected by Superfish as a story · 59 points
HN discussionIf they've installed Windows themselves (as I suspect many enterprises have) it's probable, but I wouldn't say it's correct to assume. There's a test going I've seen being shared around by people who are fairly trusted in the tech community that uses an image (supposedly) signed with the private key to see if the certificate is installed: https://filippo.io/Badfish/ . If I were you I'd at least check that out.
Comment linking /Badfish/
on “Lenovo Caught Installing Adware on New Computers”Submitted The “Behind The Sofa” Certificate Transparency Log as a story · 58 points
HN discussionA cloudflare developer (I think) has put a test site up here: https://filippo.io/Badfish/ The idea is something like <img src="haveproblem.gif" onError="this.src='noproblem.gif'/> where haveproblem.gif is signed with the superfish cert (so you'll get an error if your machine does not have it, triggering the onError JS).
Comment linking /Badfish/
on “Lenovo Caught Installing Adware on New Computers”Submitted Native scrolling and iTerm2 as a story · 35 points
HN discussion[1] Tanya Khovanova, Soviet-American mathematician who became the second female gold medalist at the International Mathematical Olympiads. https://www.tanyakhovanova.com/ [2] Filippo Valsorda (cryptography) https://filippo.io/ [3] David Wong (cryptography) https://www.cryptologie.net/ [4] OpenBSD everything https://www.undeadly.org/ [5] blog with some funny articles https://idlewords.com/ [6] Might need a proxy/VPN…
Comment linking /
on “Ask HN: Favorite Blogs by Individuals?”Submitted Heartbleed vulnerability tester as a story · 15 points
HN discussionThe tip4commit website is vulnerable to Heartbleed: https://filippo.io/Heartbleed/#tip4commit.com Don't sign in or register or you may have more to worry about than undesired tax liabilities. EDIT: It's fixed now.
Comment linking /Heartbleed/
on “Please remove mitsuhiko/*”Submitted On Keybase.io and encrypted private key uploading as a story · 13 points
HN discussionFilippo here. I'm sad that I didn't have the time to contribute to ytdl much recently, but it was my first time playing a role in a big and popular project, and I'm terribly grateful for that trust. (Thanks Ricardo, thanks Philipp!) Also, what always impressed me is the incredible amount of random contributions from the community. Ever since we introduced a super-simple plugin system [0], support for the most dispar…
Comment linking /add-support-for-a-new-video-site-to-youtube-dl/
on “Youtube-dl”Submitted How the new Gmail image proxy actually works and what does this mean for you as a story · 9 points
HN discussionIt's very nice to see a project I started reach the front page of HN. I remember starting the project around 2006. Back then, I had a dial-up connection and it wasn't easy for me to watch a video I liked a second time. It took ages. There were Greasemonkey scripts for Firefox that weren't working when I tried them, so I decided to start a new project in Python, using the standard urllib2. I made it command line beca…
Comment linking /Heartbleed/
on “Youtube-dl”Submitted Ticketbleed (CVE-2016-9244) as a story · 6 points
HN discussionAnother useful website is: https://filippo.io/Badfish/
Comment linking /Badfish/
on “Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]”Submitted Salt and Pepper, please: a note on password storage as a story · 5 points
HN discussionA value in the range between -4095 and -1 indicates an error, it is -errno. The syscall/errno stuff has always seemed unusual, inelegant, and inefficient --- instead of just returning a negative error code directly, the function returns the vague "an error has occurred" -1, and you have to then check errno separately after that. It only adds insult to injury when you realise that the kernel itself isn't doing it, bu…
Comment linking /linux-syscall-table/
on “Writing C software without the standard library”Submitted OpenSSL.org is affected by the OpenSSL Heartbleed bug as a story · 5 points
HN discussionIndeed. And the readme and the usage output makes no mention of streaming, buffering, on-line, authentication, or anything related. This is a potential security relevant behavior that most users-- who haven't written or analyzed tools like this-- would find surprising. For those following along, I went and tested it-- since the behavior wasn't documented or clear from the code. If it encounters midstream corruption…
Comment linking /age/report
on “Age: A simple, modern and secure file encryption tool”Submitted Fake HN titles generated by GPT-3 as a story · 4 points
HN discussionThe Badfish page at https://filippo.io/Badfish/ seems to be down. Any other place where I can direct people to check for invalid security certificates?
Comment linking /Badfish/
on “Download.com and Others Bundle Superfish-Style HTTPS Breaking Adware”Submitted Searchable Linux Syscall Table for x86 and x86_64 as a story · 4 points
HN discussionI also attended the Recurse Center years ago, but it didn’t quite click for me, which was surprising because everyone I spoke to had such positive experiences there. Even now, I find it hard to pinpoint exactly why it didn’t feel worthwhile for me. Perhaps it was the location. New York City is expensive, and although I had enough savings to justify taking unpaid leave from work, many things seemed unreasonably price…
Comment linking /
on “Put the DVD logo in the corner (2023)”Submitted Searchable Linux Syscall Table for x86 and x86_64 as a story · 3 points
HN discussion> Like how does one create a compatible abi _for all of linux_??? You look at Linux's syscall table[0], read through the documentation to figure out the arguments, data types, flags, return values, etc., and then implement that in your kernel. The Linux ABI is just its "library" interface to userspace. It's probably not that difficult; writing the rest of the kernel itself is more challenging, and, frankly, more int…
Comment linking /linux-syscall-table/
on “Asterinas: OS kernel written in Rust and providing Linux-compatible ABI”Submitted Searchable Linux Syscall Table for x86 and x86_64 as a story · 2 points
HN discussion
