Top all-time · #2408
Joshua Rogers
Personal blog · joshua.hu · on HN as mmscsecurityprogrammingsystems
Joshua Rogers's personal blog at joshua.hu covers security, programming and systems. Since 2023, 34 different Hacker News readers have linked it 76 times, most often “Hacking with AI SASTs: An Overview of 'AI Security Engineers' / 'LLM Security S”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Joshua Rogers is an Australian technologist, sysadmin, security engineer, and pentester sharing long-form writeups on hacking, binary web and infra security, programming, technology, politics, and life itself.
Most-linked posts?
- Hacking with AI SASTs: An Overview of 'AI Security Engineers' / 'LLM Security S17 people · 18 mentions · first linked 2025-09-21
- No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability3 people · 3 mentions · first linked 2023-12-16
- Breaking decompilers with single-function, and no-main() C codebases2 people · 2 mentions · first linked 2025-10-02
- The many different ways I've backdoored your dependencies2 people · 2 mentions · first linked 2024-05-04
- Another AI slop story: ChatGPT vs. Human2 people · 2 mentions · first linked 2025-12-05
- Speeding up NMAP service scanning 16x2 people · 2 mentions · first linked 2023-08-13
- SSH-Snake: Automatic traversal of networks using SSH private keys2 people · 2 mentions · first linked 2024-01-10
What Hacker News says?
that's still a huge waste of time and resources. Rather, Daniel has focused on promoting good use of AI that has yielded good results for curl: https://mastodon.social/@bagder/115241241075258997 https://joshua.hu/llm-engineer-review-sast-security-ai-tools...
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “You did this with an AI and you do not understand what you're doing here”Submitted Okta's NextJS-0auth troubles as a story · 372 points
HN discussionUsing a direct link to Google’s 2FA setup will allow a Yubikey to be setup as 2FA instead of a Passkey, too: https://joshua.hu/enrolling-hardware-keys-2fa-google-workspa...
Comment linking /enrolling-hardware-keys-2fa-google-workspace
on “Passkeys: A shattered dream”Submitted No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability as a story · 359 points
HN discussion>self-host your dependencies behind a CDN service you control (just bunny/cloudflare/akamai/whatever is fine and cheap). This is not always possible, and some dependencies will even disallow it (think: third-party suppliers). Anyways, then that CDN service's BGP routes are hijacked. Then what? See "BGP Routes" on https://joshua.hu/how-I-backdoored-your-supply-chain But in general, I agree: websites pointing to rando…
Comment linking /how-I-backdoored-your-supply-chain
on “Polyfill supply chain attack hits 100K+ sites”Submitted Magic Switch: Share Apple Magic keyboard/track-pad/mouse between two Macs as a story · 90 points
HN discussionI wrote a cynical take on "how it happened" at the time: https://joshua.hu/losing-sight-vision-mission-of-your-role I think it comes from the divorce of what people are hired to do versus what their work actually contributes to. I also remember the countless cloudflare turnstiles that I've had to get through one way or another on airlines' websites which reset every minute (looking at you, airserbia, for being the w…
Comment linking /losing-sight-vision-mission-of-your-role
on “What You Get After Running an SSH Honeypot for 30 Days”Submitted SSH-Snake: Automatic traversal of networks using SSH private keys as a story · 85 points
HN discussionThe linked blog post https://joshua.hu/llm-engineer-review-sast-security-ai-tools... shows that most of the used tools can be run in ci and comment on the PRs.
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted Making Firefox's right-click not suck with about:config as a story · 62 points
HN discussionLink should be updated to this https://joshua.hu/llm-engineer-review-sast-security-ai-tools...
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted The many different ways I've backdoored your dependencies as a story · 7 points
HN discussionthere's a blog link https://joshua.hu/llm-engineer-review-sast-security-ai-tools... that has Products chapter I guess mastodon link is simply a confirmation that bugs were indeed bugs, even with wrong code snippets?
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted LLMs are destroying art: the art of code, literature, and culture as a story · 6 points
HN discussionI haven't read it yet, but later in the mastodon thread, stenberg says "this is [the contributor's] (long) blog post on his work: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... ".
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted Breaking decompilers with single-function, and no-main() C codebases as a story · 6 points
HN discussionI did not read it, but this article from the contributor should contain more details: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... (mentioned in https://mastodon.social/@bagder/115241413210606972 ).
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted Hacking with AI SASTs: An Overview of 'AI Security Engineers' / 'LLM Security S as a story · 6 points
HN discussionThe PDF slide deck that accompanies that post includes some screenshots of the tools that were used: https://joshua.hu/files/AI_SAST_PRESENTATION.pdf
Comment linking /files/AI_SAST_PRESENTATION.pdf
on “Potential issues in curl found using AI assisted tools”Submitted Gixy-ng: gixy fork with updated, improved, and new check [ LLMs for plagiarisin as a story · 5 points
HN discussionSee Joshua's post for details: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... Tools included ZeroPath, Corgea and Almanax.
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted LLM Security Scanners for Penetration Testers and Security Teams as a story · 5 points
HN discussionThis should probably link to the original blog post by Joshua Rogers: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... ("Hacking with AI SASTs: An overview of 'AI Security Engineers' / 'LLM Security Scanners' for Penetration Testers and Security Teams")
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted Proxy_pass: Nginx's Dangerous URL Normalization of Paths as a story · 4 points
HN discussionIf something is found by Valgrind, we can reproduce it ourselves. Here we get private bug reports found by "his set of AI assisted tools". The set seems to be: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... So he likes ZeroPath. Does that get us any further? No, the regular subscription costs $200 and the free one-time version looks extremely limited and requires yet another login. Also of course, a…
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Potential issues in curl found using AI assisted tools”Submitted Always 'Copy Clean Link' When Possible on Firefox, with UserChrome.css as a story · 3 points
HN discussionUltimately, one of the cameras in my iPhone 7 failed, and I replaced it with an SE3 - which was indistinguishable from the 7 - but another issue was patches. With very little skill, I found I could duplicate this issue on my iPhone 7 running the latest supported version of iOS: https://joshua.hu/apple-ios-patched-unpatched-vulnerabilitie...
Comment linking /apple-ios-patched-unpatched-vulnerabilities
on “Apple Debuts iPhone 16e”Submitted Making Firefox's right-click not suck, more, with userChrome.css as a story · 3 points
HN discussionI'm using them, but frankly only for things where my quality bar is lower. I've seen little evidence that anyone is routinely getting work that's comparable to competent humans, excepting incredibly recent work like Joshua Rodgers' [0]. And I'll note that even Joshua's work was mainly successful in identifying issues, but actually fixing them involved much more human intervention. [0] https://joshua.hu/llm-engineer-…
Comment linking /llm-engineer-review-sast-security-ai-tools-pentesters
on “Deloitte to refund the Australian government after using AI in $440k report”Submitted Another AI slop story: ChatGPT vs. Human as a story · 3 points
HN discussion
