Top all-time · #1714
Gynvael Coldwind
Personal blog · gynvael.coldwind.pl · on HN as gynvaelsecurityprogramming
Gynvael Coldwind writes gynvael.coldwind//vx.log (pl), a personal blog at gynvael.coldwind.pl about security and programming. Since 2009, 42 different Hacker News readers have linked it 49 times, most often “Xz/liblzma: Bash-stage Obfuscation Explained”. It is still writing: the last post was on 2026-05-19, and you can follow it by feed.
Too few sampled comments (16) to say how often HN recommends it.?
Why HN links it
HN readers link Gynvael Coldwind's blog for technical write-ups on reverse engineering, the xz/liblzma backdoor, CPython and Windows internals, and old-computer emulation.
- Recommended for · 5 comments
- Called a "great analysis" and said the xz backdoor write-up "covers it well"; posts described as "always interesting" and "very often innovating".
Summarised by Claude from a sample of 16 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Mostly technical blog of Gynvael Coldwind, a security researcher and progammer.
Most-linked posts?
- Xz/liblzma: Bash-stage Obfuscation Explained7 people · 7 mentions · first linked 2024-03-30
- Hello World Under the Microscope3 people · 3 mentions · first linked 2022-11-11
- The tragedy of low-level exploitation3 people · 3 mentions · first linked 2024-08-04
- Hello World in C without libraries or similar dependencies3 people · 3 mentions · first linked 2019-03-09
- The Tale of Syndicate Wars Port (2010)2 people · 2 mentions · first linked 2016-04-26
- Hello World Under the Microscope2 people · 2 mentions · first linked 2022-10-12
What Hacker News says?
I think you're probably missing a lot context about the situation. Here's some useful links https://x0f.org/@FreePietje/112187047353892463 also https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted Xz/liblzma: Bash-stage Obfuscation Explained as a story · 535 points
HN discussionSE Linux comment by @poettering, https://news.ycombinator.com/item?id=39867126 > Libselinux pulls in liblzma too and gets linked into tons more programs than libsystemd. And will end up in sshd too (at the very least via libpam/pam_selinux). And most of the really big distros tend do support selinux at least to some level. Hence systemd or not, sshd remains vulnerable by this specific attack. Devuan comment by @capi…
Comment linking /?lang=en&id=782
on “XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."”Submitted 8-bit number to binary string as a story · 158 points
HN discussionThat’s what the compromised build stage did. It’s really interesting to read if you want to see the details of how a sophisticated attacker works: https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b... https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “Xzbot: Notes, honeypot, and exploit demo for the xz backdoor”Submitted The tragedy of low-level exploitation as a story · 66 points
HN discussion"xz/liblzma: Bash-stage Obfuscation Explained" covers it well https://gynvael.coldwind.pl/?lang=en&id=782
Comment linking /?lang=en&id=782
on “Xzbot: Notes, honeypot, and exploit demo for the xz backdoor”Submitted 8-bit number to binary string (2013) as a story · 63 points
HN discussionIf you're interested in dives that deep, you might like Gynvael Coldwind's hello world in Python on Windows dive [1]. Goes through CPython internals, Windows conhost, font rasterization, and GPU rendering, among others. [1]: https://gynvael.coldwind.pl/?id=754
Comment linking /?id=754
on “Hello World”Submitted An informal review of CTF abuse as a story · 53 points
HN discussionlcamtuf is just a great man. Take a look at his biography and inventions. I love this works same as Gynvaels http://gynvael.coldwind.pl/?blog=1&lang=en When they post something, it's always interesting and very often innovating.
Comment linking /?blog=1&lang=en
on “I lost my OpenBSD full-disk encryption password”Submitted Hello World Under the Microscope as a story · 28 points
HN discussionNo. This ZIP bomb workings rely on two important facts: 1. ZIP archive has multiple files. 2. ZIP is an "index+pointers" based format (meaning the Central Directory index of archive files is basically a table of pointers - or rather offsets - telling where to look for data inside the file). Thanks to these two properties David could create a very clever compressed stream that could be (partially) re-used by multiple…
Comment linking /?id=533
on “A better zip bomb”Submitted Xz/liblzma: Bash-stage Obfuscation Explained as a story · 6 points
HN discussionAlso known as "bswap ax", and research shows that it does something surprising but consistent on almost all hardware: It zeros the register. https://www.ragestorm.net/blogs/?p=141 https://gynvael.coldwind.pl/?id=268 However, this page, now gone, suggests that some CPUs (early 486s?) did something different: http://web.archive.org/web/20071231192014/http://www.df.lth.... Unfortunately I have not found any evidence no…
Comment linking /?id=268
on “Things I learned while writing an x86 emulator (2023)”Submitted Tragedy of low-level exploitation (So you want to make a career in exploit dev?) as a story · 4 points
HN discussionGynvael Coldwind made a great analysis about it: https://gynvael.coldwind.pl/?lang=en&id=782 https://news.ycombinator.com/item?id=39878681 xz/liblzma: Bash-stage Obfuscation Explained
Comment linking /?lang=en&id=782
on “OpenSSH Backdoors”Submitted Hello World Under the Microscope as a story · 4 points
HN discussionHi Philip. Would you be able to share with me just a few anonymized user IDs (random ones are fine)? I wanted to double-check their format, since I'm pretty sure their method is broken. My email address is there → https://gynvael.coldwind.pl/?id=50 (contact section)
Comment linking /?id=50
on “Discord Unveiled: A Comprehensive Dataset of Public Communication (2015-2024)”Submitted An informal review of CTF abuse as a story · 3 points
HN discussionGynvael ( http://gynvael.coldwind.pl/ ) is a C++ person who does streams on youtube. I learned a lot about Virtual Machines from his livestreams. :)
Comment linking /
on “Lessons from my first year of live coding on Twitch (2017)”Submitted Python “Sandbox” Escape (2013) as a story · 3 points
HN discussionPick up the subject of old 8 bit computers, games and browsers. Get ready for the 20 KB JS shooter competition. https://gynvael.coldwind.pl/?id=686
Comment linking /?id=686
on “JSBeeb – JavaScript BBC Micro Emulator”Submitted How to document your knowledge (in a CV/resume) as a story · 3 points
HN discussionHere you go: http://gynvael.coldwind.pl/?id=279
Comment linking /?id=279
on “Syndicate Wars Port”Submitted How to learn reverse-engineering? as a story · 3 points
HN discussion> For security stuff it's 100% twitter It saddens me that this is the case. Security types are techies, so should be all over RSS feeds. For example I follow the usual suspects on RSS: * https://www.schneier.com/feed/atom/ * https://gru.gq/feed/ * https://gynvael.coldwind.pl/rss_en.php Ideally please post on Twitter AND an RSS feed.
Comment linking /rss_en.php
on “Ask HN: What websites do you use to find cutting edge information?”Submitted Int a = 5; a = a++ + ++a; a =? (2011) as a story · 2 points
HN discussionThis reminds me of a tool that came out 10 or 15 years ago, which allowed you to feed it arbitrary binary data that it could display in 3D. I remember reading a Slashdot article on it in which one of the examples was a 3D, freely-rotating view of the Linux kernel binary. Does anyone know what I'm talking about? I can't seem to recall the name of the project or find it. Also related: http://vimeo.com/110257380 http:/…
Comment linking /?id=199
on “Visualizing Entropy in Binary Files”Submitted Hello World in C without libraries or similar dependencies as a story · 2 points
HN discussion
