Top all-time · #6024
GMO Flatt Security
Company blog · flatt.tech/researchsecurity
GMO Flatt Security is the company blog at flatt.tech, writing about security. Since 2021, 12 different Hacker News readers have linked it 20 times, most often “BatBadBut: You can't securely execute commands on Windows”. It is still writing: the last post was on 2026-10-21, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Flatt Security's research posts on command execution and escaping, such as the BatBadBut Windows cmd.exe argument-injection work. Commenters cite them in discussions of shell-command security.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
ソフトウェアプロダクトの開発組織とそこで働くエンジニアにとって最適なセキュリティサービスを提供し、「背中を預けられる」存在になることがGMO Flatt Securityの使命です。
Most-linked posts?
- BatBadBut: You can't securely execute commands on Windows4 people · 4 mentions · first linked 2024-04-09
- Single-packet race condition breaking the 65535 byte lim2 people · 2 mentions · first linked 2024-08-02
- Arbitrary code execution in Unity Runtime2 people · 2 mentions · first linked 2025-10-03
What Hacker News says?
> See the somewhat recent troubles in Rust: https://github.com/rust-lang/rust/security/advisories/GHSA-q... FYI this started out as a vulnerability in yt-dlp [1]. Later it was found to impact many other languages [2]. Rust, along with other languages, also considered it a vulnerability to fix, while some other languages only updated the documentation or considered it as wontfix. [1]: https://github.com/yt-dlp/yt-dlp…
Comment linking /research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
on “Windows NT vs. Unix: A design comparison”Submitted Compromising OpenWrt Supply Chain as a story · 584 points
HN discussionJava has a bunch of code which looks like it's trying to do the right kind of escaping for msvcrt vs cmd.exe: https://github.com/openjdk/jdk/blob/jdk-26%2B1/src/java.base... But i would be lying if i said i understood what was going on there. Some googling suggests this was added around 1.7, ie in the early 2010s. But then, that Rust CVE seems to originate in this work, and this guy claims Java said "won't fix", whi…
Comment linking /research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
on “The curious case of shell commands, or how "this bug is required by POSIX" (2021)”Submitted Arbitrary code execution in Unity Runtime as a story · 95 points
HN discussionhttps://flatt.tech/research/posts/batbadbut-you-cant-securel...
Comment linking /research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
on “The curious case of shell commands, or how "this bug is required by POSIX" (2021)”Submitted Single-packet race condition breaking the 65535 byte lim as a story · 93 points
HN discussionSubmitted BatBadBut: You can't securely execute commands on Windows as a story · 77 points
HN discussionSubmitted Detailed Report on Local Privilege Escalation in Ubuntu Desktop (Pwn2Own 2021) as a story · 52 points
HN discussionSubmitted Arbitrary Code Execution in Unity Runtime(CVE-2025-59489) as a story · 11 points
HN discussionSubmitted Expanding Single-Packet Attack with First Sequence Sync to Break 65K TCP Limit as a story · 6 points
HN discussionSubmitted Show HN: Takumi – An AI Security Engineer that found 10 zero-days (Vim, Next.js) as a story · 4 points
HN discussionSubmitted Bypassing DOMPurify with good old XML as a story · 4 points
HN discussionSubmitted Why XSS Persists in This Frameworks Era? as a story · 3 points
HN discussionSubmitted Non-Intrusive Web Recon via DevTools Recorder as a story · 3 points
HN discussionSubmitted Software Supply Chain Attack on subql/common as a story · 2 points
HN discussionSubmitted Pwning Claude Code in 8 Different Ways as a story · 2 points
HN discussionSubmitted LLM AuthZ Handbook: A Practical Guide for AI Builders and Users as a story · 2 points
HN discussionSubmitted Cybersecurity AI Agent as a story · 2 points
HN discussionSubmitted Your Git credentials could leak just by cloning a repository as a story · 2 points
HN discussionSubmitted Achieving RCE in an Electron app by chaining multiple issues as a story · 1 points
HN discussion
