Top all-time · #8385
lvh
Personal blog · lvh.io/posts · on HN as lvhsecurityprogramming
lvh is a personal blog at lvh.io about security and programming. Since 2014, 9 different Hacker News readers have linked it 24 times, most often “Nonce misuse resistance 101”. The last post was in 2019, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link lvh's cryptography and security writing, including the Crypto 101 ebook, nonce misuse resistance explainers, and an overview of auth and API tokens. Commenters cite these as helpful resources.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
lvh's blog
Most-linked posts?
- Nonce misuse resistance 1013 people · 4 mentions · first linked 2016-05-20
- Introducing Teleport (modern SSH infrastructure management)2 people · 2 mentions · first linked 2016-03-24
- Don't expose the docker socket, even to a container2 people · 2 mentions · first linked 2015-09-24
- Supersingular elliptic curve isogeny Diffie-Hellman 1012 people · 2 mentions · first linked 2016-05-03
What Hacker News says?
lvh ( https://lvh.io ), care to weigh in? I was under the impression he was formally educated in cryptography. This ebook has been cited by many computer security university courses.
Comment linking /
on “Crypto 101 – Introductory course on cryptography”Submitted 2016 Retina MacBook Pro Caveats as a story · 265 points
HN discussionThis is pretty good! The arithmetic of elliptic curves gets very complex, but I like how you arrived at points on an elliptic curve just by defining groups and fields. It might be a slight improvement to give a short, Rudin-style explanation of the difference between a set and a field. You could do this from first principles of set theory without being so terse as to be incomprehensible or diving into the axioms; I…
Comment linking /posts/supersingular-isogeny-diffie-hellman-101.html
on “Elliptic Curve Cryptography for Beginners”Submitted Don't expose the docker socket, even to a container as a story · 133 points
HN discussionThe JVM has a number of cool features that enable you to efficiently drop down into C (FFI) yourself: these tricks aren't just for built-ins. A quick overview: - First there was JNI. JNI means that you write method stubs with the "native" keyword. Then you run javah, which gives you some C glue code that you eventually need to compile. This is very fast, but it's annoying because now you need a tool chain everywhere…
Comment linking /CCryptoClojure/
on “How the JVM compares strings on x86 using pcmpestri”Submitted Supersingular elliptic curve isogeny Diffie-Hellman 101 as a story · 130 points
HN discussionIf you think Sudoku solvers are cool, check out (constraint) logic programming, e.g. https://github.com/clojure/core.logic/wiki/Examples#sudoku You can take that pretty far! I used it to solve Regex Crossword [0]: https://www.lvh.io/posts/solving-regex-crosswords/ https://regexcrossword.com/
Comment linking /posts/solving-regex-crosswords/
on “SQL query to generate the Mandelbrot set as ASCII art”Submitted They do take security seriously as a story · 66 points
HN discussionAlso https://www.lvh.io/posts/introducing-teleport.html via https://news.ycombinator.com/item?id=11356008 .
Comment linking /posts/introducing-teleport.html
on “Show HN: Teleport – SSH for Clusters and Teams”Submitted Nonce misuse resistance 101 as a story · 29 points
HN discussionTo answer my own question, this is a good resource: https://www.lvh.io/posts/nonce-misuse-resistance-101.html In summary, it makes the nonce a function of the message as well, so you always get the same nonce for the same message. Presumably, the attacker only sees duplicate messages rather than plaintext because XORing a message with itself yields zero. This is one of the things that make you ask "why didn't I thin…
Comment linking /posts/nonce-misuse-resistance-101.html
on “AES-GCM-SIV: AES-GCM with some forgiveness”Submitted Nonce-misuse resistant cryptography 101 as a story · 9 points
HN discussionReading this first was helpful for me: https://www.lvh.io/posts/nonce-misuse-resistance-101.html
Comment linking /posts/nonce-misuse-resistance-101.html
on “AES-GCM-SIV: Specification and Analysis [pdf]”Submitted Introducing Teleport (modern SSH infrastructure management) as a story · 8 points
HN discussionFor an overview, you might like these two articles: https://www.lvh.io/posts/a-childs-garden-of-inter-service-au... https://fly.io/blog/api-tokens-a-tedious-survey/
Comment linking /posts/a-childs-garden-of-inter-service-authentication-schemes/
on “Ask HN: Any comprehensive courses on Auth?”Submitted Solving regex crosswords with logic programming and Clojure as a story · 4 points
HN discussionSubmitted Tradeoffs in crypto API design as a story · 4 points
HN discussionSubmitted QuerySelectorAll from an element probably doesn't do what you think it does as a story · 3 points
HN discussionSubmitted Whatever You Do, Don't Expose the Docker Socket to a Container (2015) as a story · 2 points
HN discussionSubmitted Crypto APIs and JVM byte types as a story · 2 points
HN discussionSubmitted QuerySelectorAll from an element probably doesn't do what you think it does as a story · 2 points
HN discussionSubmitted Reverse ungineering as a story · 2 points
HN discussionSubmitted Today's OpenSSL bug (for techies without infosec chops) as a story · 1 points
HN discussionSubmitted Conflicting threat models as a story · 1 points
HN discussion
