Top all-time · #6613
Siguza.net
Personal blog · blog.siguza.netsecuritysystemshardware
Siguza.net is a personal blog at blog.siguza.net about security, systems and hardware. Since 2021, 12 different Hacker News readers have linked it 15 times, most often “ARM PAN”. It is still writing: the last post was on 2025-05-23, and you can follow it by feed.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers link Siguza's posts as deep dives into Apple platform security, mainly the Psychic Paper write-up on inconsistent plist parsers and the PAN post on execute-only memory. Most comments cite them as examples.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Siguza's Blog
Most-linked posts?
- /psychicpaper/5 people · 6 mentions · first linked 2021-12-15
- ARM PAN4 people · 5 mentions · first linked 2023-03-25
- Tachy0n: The Last 0day Jailbreak2 people · 2 mentions · first linked 2025-05-24
What Hacker News says?
One the one hand you've got people writing insanely complex hacks like this. On the other hand there's the guy who was doing whatever he wanted for years just by crafting dodgy plist files. https://blog.siguza.net/psychicpaper/
Comment linking /psychicpaper/
on “A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution”Submitted Tachy0n: The Last 0day Jailbreak as a story · 265 points
HN discussionhttps://blog.siguza.net/PAN/ has a nice summary of the PAN issue. Also, you can't load data under execute-only but you can execute it (e.g. by jumping there). If you are compiling under this scheme you need to tell your compiler that this is the case.
Comment linking /PAN/
on “OpenBSD Innovations”Submitted ARM PAN as a story · 6 points
HN discussionHaving multiple, potentially different parsers is incredibly dangerous. One person used the fact that different plist parsers in the macOS kernel choked in different ways when interpreting malformed xml, leading some to believe the plist was "safe" because it did not grant certain permissions, while others trusted this "safe" plist but believed it did grant these permissions. https://blog.siguza.net/psychicpaper/
Comment linking /psychicpaper/
on “Zoom: Remote Code Execution with XMPP Stanza Smuggling”Submitted Execute-only pages vs. PAN (privileged access never) on ARM64 as a story · 1 points
HN discussion> GitHub Copilot Chat had a very similar bug last year. Reminds me of "Tachy0n: The Last 0day Jailbreak" from yesterday: https://blog.siguza.net/tachy0n/ TLDR is: Security issue found, patched in a OS release, Apple seemingly doesn't do regression-testing so security researcher did, found that somehow the bug got unpatched in later OS releases.
Comment linking /tachy0n/
on “Remote Prompt Injection in Gitlab Duo Leads to Source Code Theft”Maybe you have worked with a different XML than I but I have only terrible memories of working with XML. Starting from the parser inconsistencies (that even led to security vulnerabilities in Apple, see https://blog.siguza.net/psychicpaper/ ). On a higher level, the fact that so much different kind of information could exist at each level was nothing but headaches. In YAML, or in JSON, it's pretty straight forward.…
Comment linking /psychicpaper/
on “Our Git Hash Bug”Lots of sandbox escapes on iOS, but my favorite was https://blog.siguza.net/psychicpaper/
Comment linking /psychicpaper/
on “Signal leaders warn agentic AI is an insecure, unreliable surveillance risk”> Why's it considered so bad? The human margin of error is greater in XML implementations and usage compared to say, JSON. Here's a famous 0-day in Apple devices due to inconsistencies between XML parsers: https://blog.siguza.net/psychicpaper/
Comment linking /psychicpaper/
on “Dino 0.4.3 – A Modern XMPP (“Jabber”) Chat Client Using GTK+/Vala”> Wonder if the author is aware of the reasons why this was disabled (it's functionally gone on both platforms). On iOS newer processors have PAC which provides much stronger guarantees against ROP and Linux disabled it because execute-only mappings bypass PAN: https://blog.siguza.net/PAN/ . Yes, of course he is. He even mentions PAN being broken in the recording. What doesn't make sense is the Android/Linux decisio…
Comment linking /PAN/
on “Theo de Raadt: Synthetic Memory Protections (CanSecWest 2023) [OpenBSD] [pdf]”> iOS is execute-only; Android tried a few years ago (abandoned) Wonder if the author is aware of the reasons why this was disabled (it's functionally gone on both platforms). On iOS newer processors have PAC which provides much stronger guarantees against ROP and Linux disabled it because execute-only mappings bypass PAN: https://blog.siguza.net/PAN/ . > Dumb applications that invent their own ABI (very few) I mean…
Comment linking /PAN/
on “Theo de Raadt: Synthetic Memory Protections (CanSecWest 2023) [OpenBSD] [pdf]”I think one of the big unstated challenges (but implied by the reference to needing a bootloader exploit) is that KTRR/CTRR [1] prevents new executable kernel code from being introduced after the device boots, even if the kernel is fully compromised. This is a hardware feature and is not one that has (publicly) been bypassed in recent memory. In other words, without a bootloader exploit it is not possible to map the…
Comment linking /KTRR/
on “Jailbroken iOS can't run macOS apps. I spent a week to find out why. (2021)”On the topic of disagreeing parsers, this is how the "Psychic Paper" iOS vulnerability worked: https://blog.siguza.net/psychicpaper/
Comment linking /psychicpaper/
on “When URL parsers disagree (CVE-2023-38633, librsvg)”Kinda a strange post that I don't quite agree with. Particularly: > You’re not an expert in your field, otherwise you wouldn’t be publishing in a blog, but writing papers and giving interviews. Blogs and self-pub are often the only ways some information is shared by nature of the fact that academic publications don't publish things that don't obviously advance the state-of-the-art. For example, one area I'm close wi…
Comment linking /APRR/
on “Nobody cares about your blog”
