Top all-time · #6044
RyotaK
Personal blog · blog.ryotak.mesecurityprogramming
RyotaK's personal blog at blog.ryotak.me covers security and programming. Since 2021, 12 different Hacker News readers have linked it 14 times, most often “Remote code execution in Homebrew by compromising the official Cask repository”. It is still writing: the last post was on 2025-04-14, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link RyotaK's security research posts on supply-chain and remote code execution flaws, such as the cdnjs RCE and the Homebrew Cask compromise. Commenters cite them as examples of real-world attacks.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
技術的な話とか
Most-linked posts?
- Remote code execution in Homebrew by compromising the official Cask repository5 people · 5 mentions · first linked 2021-04-21
- Remote code execution in cdnjs of Cloudflare4 people · 4 mentions · first linked 2021-07-16
- Potential remote code execution in PyPI3 people · 3 mentions · first linked 2021-07-31
What Hacker News says?
I don't think any of these side channels are really easy to pull off without the technical capabilities of a nation state or something similar. I personally think embedding a malicious script in a CDN (e.g. https://blog.ryotak.me/post/cdnjs-remote-code-execution-en/ ) that serves a script for a large website, or something similar ( https://blog.igorescobar.com/2016/08/21/ive-the-chance-to-tr... ), is more realistic…
Comment linking /post/cdnjs-remote-code-execution-en/
on “Hertzbleed Attack”Submitted Remote code execution in Homebrew by compromising the official Cask repository as a story · 387 points
HN discussionHere’s the corresponding blog post from the researcher, describing how they discovered the vulnerability: https://blog.ryotak.me/post/cdnjs-remote-code-execution-en/
Comment linking /post/cdnjs-remote-code-execution-en/
on “Cloudflare's Handling of an RCE Vulnerability in Cdnjs”Submitted Remote code execution in cdnjs of Cloudflare as a story · 335 points
HN discussionSources and References: [1] 20% traffic in 2021 claim https://twitter.com/AxelrodG/status/1447938954758705155 [1] 10% traffic in 2017 claim https://www.cloudflare.com/press-releases/2017/cloudflare-in... [3] 43% of traffic https://www.sandvine.com/blog/netflix-vs.-google-vs.-amazon-... [4] cdnjs vulnerability https://blog.ryotak.me/post/cdnjs-remote-code-execution-en/ [4] TAO https://en.wikipedia.org/wiki/Tailored_A…
Comment linking /post/cdnjs-remote-code-execution-en/
on “Cloudflare is a threat to Internet Privacy”Submitted Remote code execution in Homebrew by compromising the official Cask repository as a story · 4 points
HN discussionSimilar issues: - Hacking 3,000,000 apps at once through CocoaPods - https://justi.cz/security/2021/04/20/cocoapods-rce.html - Remote code execution in Homebrew by compromising the official Cask repository - https://blog.ryotak.me /post/homebrew-security-incident-en/ - Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies - https://medium.com/@alex.birsan/dependency-confusion-4a5d60f…
Comment linking /
on “Supply Chain Attack on Composer”Submitted Remote code execution in Homebrew by compromising the official Cask repository as a story · 4 points
HN discussionSubmitted Remote code execution in Homebrew by compromising the official Cask repository as a story · 4 points
HN discussionSubmitted Potential remote code execution in PyPI as a story · 3 points
HN discussionSubmitted Tampering with arbitrary packages in types scope of NPM as a story · 1 points
HN discussionSubmitted Another Supply-Chain Vulnerability: RCE in Python's PyPI Repo as a story · 1 points
HN discussionSubmitted Potential remote code execution in PyPI as a story · 1 points
HN discussionSubmitted Remote code execution in Homebrew by compromising the official Cask repository as a story · 1 points
HN discussion
