Top all-time · #5513
Robert Xiao
Personal blog · robertxiao.ca · on HN as nneonneosecurityprogramming
Robert Xiao's personal blog at robertxiao.ca covers security and programming. Since 2018, 14 different Hacker News readers have linked it 28 times, most often “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”. It is still writing: the last post was on 2025-07-15, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link Robert Xiao's site for its CTF and reverse-engineering writeups, such as the DragonCTF 2019 CPU adventure, and for his LocationSmart write-up on exposed carrier location data.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time6 people · 10 mentions · first linked 2018-05-17
- Reverse engineering a custom CPU from a single program4 people · 4 mentions · first linked 2019-09-25
- Doublethink – 8-Architecture Assembly Polyglot3 people · 4 mentions · first linked 2018-08-19
- Cryptanalysis of the Sarah2 Pen-and-Paper Cipher3 people · 3 mentions · first linked 2020-01-12
What Hacker News says?
My scenario in 2036 may not even be a brilliant virus designer, but just one person with Python scripting skills and a bit too much access to the government control system. After the LocationSmart vulnerability, that seems very plausible. (If you haven't seen it: https://www.robertxiao.ca/hacking/locationsmart/ )
Comment linking /hacking/locationsmart/
on “The Stuxnet worm may be the most sophisticated software ever written”Submitted LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time as a story · 1209 points
HN discussionI modified a request in a fairly predictable way and bypassed the consent stage. See the full writeup here: https://www.robertxiao.ca/hacking/locationsmart/
Comment linking /hacking/locationsmart/
on “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”Submitted Reverse engineering a custom CPU from a single program as a story · 339 points
HN discussionI've posted a full writeup here: https://www.robertxiao.ca/hacking/locationsmart/
Comment linking /hacking/locationsmart/
on “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”Submitted LocationSmart API Vulnerability as a story · 4 points
HN discussionhttps://www.robertxiao.ca/hacking/locationsmart/ provides the technical details. In short: much more likely the latter than the former. And this /try/ page has been up at least since Jan 2017 (~18 months).
Comment linking /hacking/locationsmart/
on “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”Submitted Doublethink – 8-Architecture Assembly Polyglot as a story · 2 points
HN discussionI have now published a writeup here: https://www.robertxiao.ca/hacking/locationsmart/ Hopefully this answers some of the technical questions about the exploit :)
Comment linking /hacking/locationsmart/
on “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”Submitted Cryptanalysis of the Sarah2 Pen-and-Paper Cipher as a story · 2 points
HN discussionThanks! I just finished the writeup, posted here: https://www.robertxiao.ca/hacking/locationsmart/ In short: it was a fairly straightforward modification of the usual API flow, to omit the secondary API call that requests consent, then request a JSON location payload instead of an XML payload. For whatever reason, that bypassed the usual consent check and just dumped the phone's location.
Comment linking /hacking/locationsmart/
on “LocationSmart Leaked Location Data for All Major U.S. Carriers in Real Time”Submitted Cryptanalysis of the Sarah2 Pen-and-Paper Cipher as a story · 2 points
HN discussionIt's not just T-Mobile, it was most US carriers. Some examples: - Vice paid a bounty hunter $300 to track a phone number [1] - Police have paid these services to avoid warrant requirements, and corrections facilities use aggregator services to track numbers that inmates have calls with [2][3] Apparently carriers claim to have stopped after getting fined $200m last year [4]. It was typically done through aggregators.…
Comment linking /hacking/locationsmart/
on “A hacker got all my texts for $16”Submitted Doublethink – 8-Architecture Assembly Polyglot as a story · 2 points
HN discussionThe real version of this, which is actually 1021 bytes, is here: http://www.p01.org/MONOSPACE/monospace.htm . It uses the very clever trick of compressing the JavaScript code as the pixels of a PNG image (which uses Deflate internally), then including the page itself in an <img> tag and decompressing the JS code from the resulting pixels. Unfortunately , the developer made a bit of a mistake when uploading this file…
Comment linking /misc/monospace.htm
on “Monospace: A JavaScript demo in 1021 bytes, winner of the demo competition”Submitted CPU Adventure – Unknown CPU Reversing as a story · 1 points
HN discussionNot only are accelerometers precise enough for data transfer, me and my colleagues demonstrated data transfer at ~200 bps (after error correction) through the user’s finger to a wristworn smartwatch. Take a look: https://www.robertxiao.ca/research/viband/
Comment linking /research/viband/
on “Quiet for Android – TCP over sound”Submitted Solving the 5-Part SSTIC Challenge as a story · 1 points
HN discussionI also enjoyed this story: https://www.robertxiao.ca/hacking/dsctf-2019-cpu-adventure-u...
Comment linking /hacking/dsctf-2019-cpu-adventure-unknown-cpu-reversing/
on “LGP-30 found in basement, the same model of drum computer programmed by “Mel””Submitted Cryptanalysis of the Sarah2 Pen-and-Paper Cipher as a story · 1 points
HN discussionAh, LGP-30! A few years back I had the chance to write some code for LGP-30 (emulated) as part of a CTF challenge: https://www.robertxiao.ca/hacking/defcon2018-assembly-polygl... It’s such a weird architecture by modern standards - self-modifying code is the norm and you have to pay attention to the rotational speed of the drum. I can only imagine what programming on a real one must’ve been like :)
Comment linking /hacking/defcon2018-assembly-polyglot/
on “LGP-30 found in basement, the same model of drum computer programmed by “Mel””Submitted QR Code Recovery as a story · 1 points
HN discussionThey have their website [0] in their profile, which has some interesting background. [0] https://robertxiao.ca
Comment linking /
on “Blackrota: obfuscated backdoor written in Go”Oh hey, I did something like this for DEF CON CTF one year, with eight architectures all slammed together: https://www.robertxiao.ca/hacking/defcon2018-assembly-polygl... That was definitely fun to put together.
Comment linking /hacking/defcon2018-assembly-polyglot/
on “Polyglot Assembly – assembly code that runs on multiple architectures”Oh hey, I was the one who cracked the encryption scheme on Agrippa. A fun afternoon diversion! My writeup is here: https://www.robertxiao.ca/hacking/agrippa/
Comment linking /hacking/agrippa/
on “Agrippa (A Book of the Dead)”Somewhat related: How to recover a broken QR by hand. https://www.robertxiao.ca/hacking/ctf-writeup/mma2015-qrcode...
Comment linking /hacking/ctf-writeup/mma2015-qrcode/
on “How to Decode QR Code on Your Own (Without Camera Scan)”Shout out to CPUAdventure challenge from DragonCTF 2019, which were basically this. If you like the slides, you should find this writeup entertaining: https://www.robertxiao.ca/hacking/dsctf-2019-cpu-adventure-u...
Comment linking /hacking/dsctf-2019-cpu-adventure-unknown-cpu-reversing/
on “Reverse Engineering Programs with Unknown Instruction Sets [pdf]”That is widely known about and freely available to the public, maybe. There are multiple options available for pseudo-LE types with relatively lax access prerequisites. https://www.robertxiao.ca/hacking/locationsmart/ is an example of one provider's public demo (requiring only a phone number) being used to provide non-consensual location data.
Comment linking /hacking/locationsmart/
on “ChatGPT is falsely recommending us for a service we don't provide”
