Top all-time · #165
The Trail of Bits Blog
Company blog · blog.trailofbits.com · on HN as tob_scott_asecurityprogramming
The Trail of Bits Blog is the company blog at blog.trailofbits.com, writing about security and programming. Since 2008, 273 different Hacker News readers have linked it 619 times, most often “RSA is a fragile cryptosystem”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Sometimes recommended · 8 of 40 sampled comments recommend it?
Why HN links it
HN readers cite Trail of Bits posts on the Apple-FBI iPhone unlock dispute, RSA versus ed25519, the Algo VPN, and tools like Graphtage and McSema, and point to the blog for security and reverse engineering.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Since 2012, Trail of Bits has helped secure some of the world's most targeted organizations and products. We combine high-end security research with a real world attacker mentality to reduce risk and fortify code.
Most-linked posts?
- RSA is a fragile cryptosystem20 people · 21 mentions · first linked 2019-07-08
- Meet Algo, the VPN that works17 people · 21 mentions · first linked 2016-12-12
- Apple can comply with the FBI court order10 people · 10 mentions · first linked 2016-02-17
- AMD Flaws: Technical Summary7 people · 7 mentions · first linked 2018-03-15
- We beat Google's zero-knowledge proof of quantum cryptanalysis6 people · 6 mentions · first linked 2026-04-17
- The sorry state of skill distribution5 people · 5 mentions · first linked 2026-06-03
- Our Full Report on the Voatz Mobile Voting Platform5 people · 5 mentions · first linked 2020-03-13
- VMs won't contain cyber-capable agents5 people · 5 mentions · first linked 2026-08-26
- How We Fared in the Cyber Grand Challenge5 people · 5 mentions · first linked 2015-07-20
- Graphtage: A New Semantic Diffing Tool5 people · 5 mentions · first linked 2020-08-28
What Hacker News says?
I found this article about this [1] to be rather enlightening. 1) http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “A Message to Our Customers”Submitted Our audit of Homebrew as a story · 845 points
HN discussionThe point is there currently is no backdoor. FBI wants Apple to create (and sign) an OS update with a backdoor and install it onto the suspect's phone. Specifically the backdoor is to remove the rate limiting and 10 attempts limitation on trying the passcode. If you have a very strong passphrase (not a 6-digit code) then even that should be unbreakable even with brute force. Of course, most users have the 6 digit co…
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “A Message to Our Customers”Submitted RSA is a fragile cryptosystem as a story · 708 points
HN discussionTotally agree with the sentiment of your statement, but RSA is probably a terrible choice, especially if you want to get it done in 20 lines of code. This article explains it pretty well: https://blog.trailofbits.com/2019/07/08/fuck-rsa/
Comment linking /2019/07/08/fuck-rsa/
on “Attorney General will ask Zuckerberg to halt plans for end-to-end encryption”Submitted Weaponizing image scaling against production AI systems as a story · 494 points
HN discussionI don't know what "(at best) research level stuff" means. Here's a well-regarded LLVM lifter by a very well-regarded vuln research team that's open source: https://blog.trailofbits.com/2014/08/07/mcsema-is-officially... There are a bunch of other lifters, not all of them to LLVM. Already, with the idea of IR lifting, we're at a point where we're no longer talking about reading assembly but rather a higher-level lang…
Comment linking /2014/08/07/mcsema-is-officially-open-source/
on “There is no WhatsApp 'backdoor'”Submitted SAML: A fractal of bad design as a story · 354 points
HN discussionMy issue with Streisand is that it spins up a dozen different services, of which I would like 1-2. Indeed, I then stumbled across Algo [1], which cited this as one of the motivating reasons for existing. It does 50% of what I'm after in setting up an IPSec VPN and does it all whilst generating my mobileconfigs. Now all I need to do is manually set up a shadowsocks server and I'll be sorted. But I'd rather tackle tha…
Comment linking /2016/12/12/meet-algo-the-vpn-that-works/
on “Do you need a VPN?”Submitted Stranger Strings: An exploitable flaw in SQLite as a story · 337 points
HN discussionGuaranteed termination isn't the only analysis worth having, especially since if your aim is termination (as opposed to leveraging that simplicity for other analysis) it's much easier to simply impose termination and be done with it. So, WASM isn't entirely unconstrained, and those constraints do allow some interesting analyses that true native code cannot support, e.g. symbolic execution: https://blog.trailofbits.c…
Comment linking /2020/01/31/symbolically-executing-webassembly-in-manticore/
on “How io_uring and eBPF Will Revolutionize Programming in Linux”Submitted Apple can comply with the FBI court order as a story · 328 points
HN discussionThis post reminded me of the Trail Of Bits post about Graphtage: https://blog.trailofbits.com/2020/08/28/graphtage/ Graphtage is written in Python and can be used as a library. But it seems Difftastic can be used as a git diff tool directly.
Comment linking /2020/08/28/graphtage/
on “Difftastic, the fantastic diff”Submitted How we applied fuzzing techniques to cURL as a story · 305 points
HN discussionThis post explains how a GPT agent broke out of qemu VM. It could not break out of firecracker. https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyb... Why? Firecracker mounts very few host systems into the VM, exposing minimal host code to malicious guests. Qemu and smolvm expose much more. So yeah, smolvm is more like a docker or qemu alternative, definitely useful but NOT relevant to the discussion of san…
Comment linking /2026/08/26/vms-wont-contain-cyber-capable-agents/
on “AX – Google’s Open Agentic Orchestrator”Submitted The cryptography behind passkeys as a story · 276 points
HN discussionYes, very much so. In addition stop using RSA[0] and use ed25519 with `ssh-keygen -t ed25519` [0]: https://blog.trailofbits.com/2019/07/08/fuck-rsa/
Comment linking /2019/07/08/fuck-rsa/
on “Do-nothing scripting: the key to gradual automation”Submitted Getting 2FA Right in 2019 as a story · 260 points
HN discussionThe pathway is obvious- build a signed image that lets you guess unlimited passwords at maximum speed. Apple doesn't have to do it to make it apparent it would work. The avenue is already in use: As many jailbreakers are familiar, firmware can be loaded via Device Firmware Upgrade (DFU) Mode. Once an iPhone enters DFU mode, it will accept a new firmware image over a USB cable. The special "backdoor" Apple has access…
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “Justice Department Wants Apple to Unlock Nine More iPhones”Submitted A deep dive into Linux's new mseal syscall as a story · 252 points
HN discussion>You may not need to crack the OS, or even upload a new firmware. You just need to disable the mechanism that wipes the device and delays how many wrong tries you get. So for example, if you can manage to corrupt, or patch the part of the system that does that, then you can try thousands of PINs without worrying about triggering the timer or wipe, and without needing to upload a whole new firmware. I disagree. The p…
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “Apple Is Said to Be Working on an iPhone Even It Can’t Hack”Submitted Unexpected security footguns in Go's parsers as a story · 234 points
HN discussionTrail of Bits has a nice summary[0] on that (they're discussing this[1] book). > As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi. --- [0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff...…
Comment linking /2019/01/14/on-bounties-and-boffins/
on “Teen Becomes First Hacker to Earn $1M Through Bug Bounties”Submitted Security assessment techniques for Go projects as a story · 230 points
HN discussionhttps://blog.trailofbits.com/2016/02/17/apple-can-comply-wit...
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “Answers to your questions about Apple and security”Submitted We build X.509 chains so you don't have to as a story · 221 points
HN discussionThe attack that the FBI is trying to facilitate by getting Apple to make a custom OS would only work up to the iPhone 5C and earlier models. Any iPhone with the TouchID and Secure Enclave would not be susceptible to this attack (it may be to other attacks). The Secure Enclave has a hardware enforced back-off delay that would stop the brute force attack. The older iPhone 5C does not have the Secure Enclave so the bru…
Comment linking /2016/02/17/apple-can-comply-with-the-fbi-court-order/
on “Answers to your questions about Apple and security”Submitted The cryptography behind electronic passports as a story · 200 points
HN discussionTrail of Bits! Topics include software security, control flow integrity, reverse engineering, program analysis, fuzzing, compilers, etc. https://blog.trailofbits.com
Comment linking /
on “Ask HN: Which companies have the best blogs written by their engineering team?”Submitted VMs won't contain cyber-capable agents as a story · 198 points
HN discussion
