Top all-time · #19238
Joxean Koret
Personal blog · joxeankoret.com/blogsecurityprogramming
Joxean Koret's personal blog at joxeankoret.com covers security and programming. Since 2014, 4 different Hacker News readers have linked it 4 times. It is still writing: the last post was on 2025-04-12, and you can follow it by feed.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link Joxean Koret's blog for his research on breaking antivirus software, including a 44con talk on AV products. Commenters point to that work when discussing AV emulators.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Joxean Koret's personal website
Most-linked posts?
- /download/breaking_av_software_44con.pdf2 people · 2 mentions · first linked 2015-12-28
What Hacker News says?
To my knowledge every single major AV packages a local emulator. We have long, long moved beyond a world where AV does basic pattern matching. Frankly, I am far less concerned with the js interpreter than I am the rest of the codebase. http://computervirus.uw.hu/ch11lev1sec4.html https://www.blackhat.com/presentations/bh-europe-08/Feng-Xue... http://joxeankoret.com/download/breaking_av_software_44con.p...
Comment linking /download/breaking_av_software_44con.pdf
on “AvastSvc.exe contains a full, unsandboxed JavaScript/DOM implementation”Submitted A New Control Flow Graph Based Heuristic for Diaphora as a story · 3 points
HN discussionthis one? http://joxeankoret.com/download/breaking_av_software_44con.p...
Comment linking /download/breaking_av_software_44con.pdf
on “AVG: “Web TuneUP” extension multiple critical vulnerabilities”Submitted A vulnerability that wasn’t (An SMT solver example) as a story · 1 points
HN discussion