Top all-time · #4844
Marc Rogers
Personal blog · marcrogers.orgsecurity
Marc Rogers writes Marc's Security Ramblings, a personal blog at marcrogers.org about security. Since 2014, 15 different Hacker News readers have linked it 19 times, most often “Why the Sony hack is unlikely to be the work of North Korea”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
Security writing, mainly on the 2014 Sony hack, arguing North Korea was unlikely to be behind it, plus pieces on the Superfish adware and DEF CON security. HN readers cite these posts as analysis.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Security News and Commentary from @marcwrogers - comments in this blog don't reflect the view of my employer.
Most-linked posts?
- Why the Sony hack is unlikely to be the work of North Korea5 people · 5 mentions · first linked 2014-12-18
- Why I still don't think it's likely North Korea hacked Sony4 people · 4 mentions · first linked 2014-12-21
- Komodia SSL certificates are in many products2 people · 2 mentions · first linked 2015-02-19
- My thoughts on FaceID2 people · 2 mentions · first linked 2017-11-14
What Hacker News says?
>The fact that the code was written on a PC with Korean locale & language actually makes it less likely to be North Korea. Not least because they don’t speak traditional “Korean” in North Korea, they speak their own dialect and traditional Korean is forbidden. This is one of the key things that has made communication with North Korean refugees difficult. I would find the presence of Chinese far more plausible. http:…
Comment linking /2014/12/18/why-the-sony-hack-is-unlikely-to-be-the-work-of-north-korea/
on “Update on Sony Investigation”Submitted Why the Sony hack is unlikely to be the work of North Korea as a story · 388 points
HN discussion"It is not clear how the United States determined that Mr. Kim’s government had played a central role in the Sony attacks. " I really don't think North Korea has the sophistication to do this. This is perfect explanation: http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlike...
Comment linking /2014/12/18/why-the-sony-hack-is-unlikely-to-be-the-work-of-north-korea/
on “Theater Chains Decline to Show Sony’s ‘The Interview,’ Citing Threats”Submitted Komodia SSL certificates are in many products as a story · 138 points
HN discussionMarc Rogers makes a convincing case that North Korea was almost certainly not behind the attack, and that a disgruntled (former?) employee was. His analysis makes the terrorism threat seem even hollower. http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlike...
Comment linking /2014/12/18/why-the-sony-hack-is-unlikely-to-be-the-work-of-north-korea/
on “Reaction to the Sony Hack Is 'Beyond the Realm of Stupid'”Submitted Why I still don't think it's likely North Korea hacked Sony as a story · 5 points
HN discussion(posted in another thread, but applies here too) From https://marcrogers.org/2018/08/13/open-letter-to-the-hacker-... . (linked in the article): "Yes hotel staff NEED to check rooms but if we, who can change the very building blocks of life, can’t come up with a safer way to do this then we really aren’t trying hard enough." No, they don't. They have thousands of security cameras set up, and I'd be shocked if they d…
Comment linking /2018/08/13/open-letter-to-the-hacker-..
on “When Security Compromises Security – The Caesars/Defcon debacle”Submitted An open letter to the Hacker Community as a story · 2 points
HN discussionThose "experts" were not experts in attribution, and the consensus is that they were wrong. One is from Norse, a widely discredited and now defunct security firm, ironically infamous for their false attributions. Two are journalists. Enough said. One is Seth Rogen the actor. Enough said. One is Sabu from LulzSec, a script kid turned FBI snitch, who is way out of his league commenting on this. One is Marc Rogers, who…
Comment linking /2015/01/24/wrapping-up-the-whole-sony-thing-for-now/
on “Marriott Data Breach Traced to Chinese Hackers, US Readies Crackdown on Beijing”Submitted My thoughts on FaceID as a story · 2 points
HN discussion> Not that Lenovo is a bad company persay The argument can certainly be made though. At least regarding their consumer laptop decision circa 2015 when, in addition to the quality issues, they were shipping the Superfish ad-ware which was installing a notably insecure self-signed root certificate to deliberately Man-in-the-Middle HTTPS connections so it could inject display ads. See: - https://marcrogers.org/2015/02/…
Comment linking /2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/
on “Restoration of an IBM Thinkpad 701C Butterfly-keyboard laptop”Submitted Marc Rogers on FaceID as a story · 2 points
HN discussionCrazy, the default language is 'ko'. I thought only South Koreans used that? http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlike...
Comment linking /2014/12/18/why-the-sony-hack-is-unlikely-to-be-the-work-of-north-korea/
on “Notes on Red Star OS 3.0”Submitted Lenovo installs adware on customer laptops and compromises ALL SSL as a story · 2 points
HN discussionIt's discussed here http://marcrogers.org/2014/12/21/why-i-still-dont-think-its-...
Comment linking /2014/12/21/why-i-still-dont-think-its-likely-that-north-korea-hacked-sony/
on “North Korea's Official Statement”From a corporate perspective, Hortensius approved the bundling of adware (so he's ok with it) from what he thought was a reputable third-party software company. He was wrong! http://marcrogers.org/2015/02/19/will-the-madness-never-end-...
Comment linking /2015/02/19/will-the-madness-never-end-komodia-ssl-certificates-are-everywhere/
on “Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs”At the moment that I'm writing, not one of the ten highest-ranked comments here addresses any of the technical detail or substance in the counterarguments which white hat experts have raised. Bruce Schneier is one of these skeptical experts. http://motherboard.vice.com/read/the-best-thing-we-can-do-ab... The IP address blog post by Dr Krypt3ia makes the FBI look silly beyond words. http://krypt3ia.wordpress.com/2014…
Comment linking /2014/12/21/why-i-still-dont-think-its-likely-that-north-korea-hacked-sony/
on “Some experts don't buy the FBI claim that North Korea hacked Sony”I love comments about the "anti-hacker community" though the underlying link to marco's blog (as this entire article is just commentary on original source material) http://marcrogers.org/2014/12/21/why-i-still-dont-think-its-... gives his entire opinion. I dont think its news to most of us here that the NK connection to the hack is circumstantial; Sony's security has been penetrated by non-state actors before, and w…
Comment linking /2014/12/21/why-i-still-dont-think-its-likely-that-north-korea-hacked-sony/
on “Some experts don't buy the FBI claim that North Korea hacked Sony”From https://marcrogers.org/2018/08/13/open-letter-to-the-hacker-... (linked in the article): "Yes hotel staff NEED to check rooms but if we, who can change the very building blocks of life, can’t come up with a safer way to do this then we really aren’t trying hard enough." No, they don't. They have thousands of security cameras set up, and I'd be shocked if they didn't have technologies like facial recognition bui…
Comment linking /2018/08/13/open-letter-to-the-hacker-community/
on “Caesars Palace security intimidates DEF CON goers, seize soldering irons”
