Top all-time · #25446
Justin Gerhardt
Personal blog · security.gerhardt.linksecurity
Justin Gerhardt writes Gerhardt Security Blog, a personal blog at security.gerhardt.link about security. Since 2017, 3 different Hacker News readers have linked it 3 times, most often “Remote code execution vulnerability in Factorio”. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link these posts on game and software security, including remote code execution through Factorio mods and a DOM fuzzing contest. The comments cite them as examples of risks from user-provided data and mods.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A Collection of reports detailing vulnerabilities found by Justin Gerhardt.
Most-linked posts?
- Remote code execution vulnerability in Factorio3 people · 3 mentions · first linked 2017-07-26
What Hacker News says?
I bet there are a few security vulns lurking in games that involve user-provided data (e.g. maybe you can customize your clan by uploading a logo). The boundary between trusted and untrusted in games with mods is especially porous ( e.g. https://security.gerhardt.link/RCE-in-Factorio/ ).
Comment linking /RCE-in-Factorio/
on “The Great DOM Fuzz-Off of 2017”Submitted Remote code execution vulnerability in Factorio as a story · 1 points
HN discussionWith bounds checks: game crashes, meaningless error message given to the user. Without bounds checks: I join a multiplayer lobby, and the next thing I know my computer is part of a botnet. This isn't an imaginary fear, it has happened many times. Some examples from a brief search: https://gridinsoft.com/blogs/rce-vulnerability-in-gta-online... https://www.polygon.com/22898895/dark-souls-pvp-exploit-mult... https://s…
Comment linking /RCE-in-Factorio/
on “Zig's Curious Multi-Sequence for Loops”