Top all-time · #10092
Tencent Xuanwu Lab
Company blog · xlab.tencent.com/ensecurityhardware
Tencent Xuanwu Lab is the company blog at xlab.tencent.com, writing about security and hardware. Since 2016, 8 different Hacker News readers have linked it 10 times, most often “JavaScript Spectre Check Implementation”. It is still writing: the last post was on 2026-07-17, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Tencent Xuanwu Lab's security research, mainly its Spectre and Meltdown check pages and JavaScript implementation. Other linked posts cover the BadBarcode ATM exploit and Return Flow Guard.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- JavaScript Spectre Check Implementation2 people · 2 mentions · first linked 2018-01-09
- Spectre CPU Vulnerability Online Checker2 people · 2 mentions · first linked 2018-01-09
What Hacker News says?
This is the first implementation in Javascript I have seen so far: http://xlab.tencent.com/special/spectre/js/check.js
Comment linking /special/spectre/js/check.js
on “Reading privileged memory with a side-channel”Submitted CVE-2019-8014: The Vulnerability Ignored 6 Years Ago as a story · 5 points
HN discussionThis is the closest thing to a javascript implementation I have seen: http://xlab.tencent.com/special/spectre/js/check.js from: http://xlab.tencent.com/special/spectre/spectre_check.html
Comment linking /special/spectre/spectre_check.html
on “Meltdown Proof-of-Concept”Submitted Spectre CPU Vulnerability Online Checker as a story · 2 points
HN discussionAs far as I remember that's roughly how that exploit against an ATM worked: https://xlab.tencent.com/badbarcode/ Also, perhaps folks working in data centers can and confirm/deny, but from what I know it's usually strictly forbidden to bring any USB devices into a data center area.
Comment linking /badbarcode/
on “No one, not even the Secret Service, should randomly plug in a strange USB stick”Submitted JavaScript Spectre Check Implementation as a story · 1 points
HN discussionSorry, you are correct. I was actually thinking of clang's SafeStack ( https://clang.llvm.org/docs/SafeStack.html ) and Microsoft's Return Flow Guard ( http://xlab.tencent.com/en/2016/11/02/return-flow-guard/ ). Both use shadow or alternate stacks. Regarding cost, a few years back, I implemented a shadow stack system via static binary rewriting. The overhead was very low, 1-2%. SafeStack claims < 0.1%.
Comment linking /en/2016/11/02/return-flow-guard/
on “Retguard: OpenBSD/Clang”Submitted Abusing Special Cases in Exception Handling for Vulnerability Exploitation as a story · 1 points
HN discussionI forgot to test Chrome 63 with https://xlab.tencent.com/special/spectre/spectre_check.html but 64 says Not Vulnerable. Anybody got 63 and want to check?
Comment linking /special/spectre/spectre_check.html
on “Chrome 64 Out – Spectre Mitigations Not Visible”