Top all-time · #1149
Veracode
Company blog · veracode.com/blogsecurityprogramming
Veracode is the company blog at veracode.com, writing about security and programming. Since 2009, 61 different Hacker News readers have linked it 78 times, most often “Exploiting JNDI Injections in Java (2019)”. No feed was found, so read it on the site itself.
Too few sampled comments (19) to say how often HN recommends it.?
Why HN links it
Application security vendor's blog, cited on HN for Log4j/JNDI exploitation details and fix versions, a vulnerable-methods analysis, and data on security flaws in AI-generated code.
Summarised by Claude from a sample of 19 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Manage application security risks effectively with Veracode's Application Risk Management platform, built for today's AI-driven world.
Most-linked posts?
- Exploiting JNDI Injections in Java (2019)7 people · 7 mentions · first linked 2019-01-03
- Mobile Apps Invading Your Privacy: A Technical Analysis of Pandora2 people · 2 mentions · first linked 2011-04-07
- GenAI Code Security Report [pdf]2 people · 2 mentions · first linked 2025-07-31
- We Asked 100 AI Models to Write Code2 people · 2 mentions · first linked 2025-08-01
What Hacker News says?
While the specific exploit may not be possible in 8u191 and later, I am not convinced they are safe from all RCEs using this vulnerability. It does make it harder to exploit, and hit or miss depending on what is available in the classpath. See https://www.veracode.com/blog/research/exploiting-jndi-injec...
Comment linking /blog/research/exploiting-jndi-injections-java
on “Log4j RCE Found”Submitted Executable Archaeology: The Case Of The Stupid Thing Eating All My RAM as a story · 242 points
HN discussion8u121 seems to address the RMI vector but not LDAP (per https://www.veracode.com/blog/research/exploiting-jndi-injec... ).
Comment linking /blog/research/exploiting-jndi-injections-java
on “Log4j RCE Found”Submitted State of Software Security: open-source Edition as a story · 26 points
HN discussionhttps://www.veracode.com/blog/research/exploiting-jndi-injec...
Comment linking /blog/research/exploiting-jndi-injections-java
on “Log4j: Between a rock and a hard place”Submitted State of Software Security Flaw Frequency by Language [pdf] as a story · 8 points
HN discussionI get that this is a big deal (any remote code execution that is prevalent is a big deal). But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java. From https://www.veracode.com/blog/security-news/urgent-analysis-... JVM version - if lower than: Java 6 – 6u212 (java6 first released in 2006, this version appears unreleased?) Java 7 – 7u202 (java7 first released in 2011…
Comment linking /blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228
on “Log4j: Between a rock and a hard place”Submitted Anti-Debugging - A Developers View as a story · 8 points
HN discussionSourceClear | Front-End, Back-End, Sr. Full Stack | San Francisco | sourceclear.com Our SourceClear platform scans thousands of applications a day at every stage of the software development process. We strive to be the index of the worlds open source library and vulnerability data and use this data to give our customers actionable insights. Software composition analysis (SCA) isn’t just about telling customers about…
Comment linking /about/careers
on “Ask HN: Who is hiring? (September 2018)”Submitted Golang's Context Aware HTML Templates (2013) as a story · 4 points
HN discussionVeracode, Burlington MA Lots of open positions. http://www.veracode.com/about/careers Feel free to send email to mpreshman@veracode.com with any questions.
Comment linking /about/careers
on “Ask HN: Who is hiring? (April 2015)”Submitted The history of programming languages (infographic) as a story · 4 points
HN discussionGood to see Govulncheck doing a vulnerable methods analysis for surfacing only the relevant issues. Many app sec vendors do it now for languages like Java and .NET. I originally created the vulnerable methods analysis back in 2015 - https://www.veracode.com/blog/managing-appsec/vulnerable-met... the same idea has been now implemented by WhiteSource (Mend), Snyk etc.
Comment linking /blog/managing-appsec/vulnerable-methods-under-hood
on “Vulnerability Management for Go”Submitted Google vs. Facebook on Privacy and Security [Infographic] as a story · 4 points
HN discussionGreat article! For those interested in security debt and how it relates to startups, I wrote this in 2011: https://www.veracode.com/blog/2011/02/application-security-d... and presented it that year: https://www.youtube.com/watch?v=MKdiiXgvz_U This predates by a year the referenced security debt presentation which has much of the same material uncited.
Comment linking /blog/2011/02/application-security-debt-and-application-interest-rates
on “Learning from a Year of Security Breaches”Submitted We Asked 100 AI Models to Write Code as a story · 3 points
HN discussionIt’s still an issue with current JDKs in certain environments (e.g. Tomcat), see https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj... and https://www.veracode.com/blog/research/exploiting-jndi-injec... . Also, 8u121 was an incomplete fix, the complete fix (still with limitations as noted above) is in 8u191 (see second link above).
Comment linking /blog/research/exploiting-jndi-injections-java
on “Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide”Submitted GenAI Code Security Report [pdf] as a story · 3 points
HN discussion> its impossible for me to steal information from out of their brain (so far at least). It's easier than you think to steal passwords from people. Just ask for it! http://www.veracode.com/blog/2013/03/hacking-the-mind-how-wh...
Comment linking /blog/2013/03/hacking-the-mind-how-why-social-engineering-works/
on “Hack of Cupid Media dating website exposes 42 million plaintext passwords”Submitted Sophisticated NPM Attack Leveraging Unicode Steganography and Google Calendar C2 as a story · 3 points
HN discussionhttp://www.veracode.com/images/pdf/executive_summary_veracod... Spefically finding number 3: "Open Source projects have comparable security, faster remediation times, and fewer Potential Backdoors than Commercial or Outsourced software."
Comment linking /images/pdf/executive_summary_veracode_state_of_software_security_report_volume_1.pdf
on “Shut up and ship”Submitted How a Single Phone Call Can Compromise Your Company as a story · 3 points
HN discussionThe Veracode report at http://www.veracode.com/blog/2011/04/mobile-apps-invading-yo... has some more detailed analysis and decompiled code.
Comment linking /blog/2011/04/mobile-apps-invading-your-privacy/
on “Pandora app found to be sending DOB, gender and location info to ad servers”Submitted Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) as a story · 3 points
HN discussionIt doesn't really work that way in practice. I believe bounty programs are good, but they aren't a replacement for an actual security team. Its one of those things that doesn't scale all that well, one really talented tester can gain a deep understanding of an app and find loads and loads of opportunities for attack. Most bounty bug hunters on the other hand are hard to distinguish from usual internet background noi…
Comment linking /blog/2013/01/can-bug-hunters-keep-the-internet-safe-infographic/
on “Kim Dotcom puts up €10,000 bounty for first person to break Mega's security”Submitted AngularJS Expression Security Internals as a story · 3 points
HN discussion"I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast…
Comment linking /blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices
on “The PewDiePie Hackers: Could hacking printers ruin your life? [video]”Submitted The $42949672.95 error for not checking a return code as a story · 3 points
HN discussionI did an experiment in my town, placing my own qr codes over everything i could find. running for a month, with putting 80 or so qr codes through out town. the number of scans i got was around 10. no one scans QR codes I have been thinking about printing up my own posters, like "Scan the code below to donate to Toys for Tots", but i still don't think I'd get many scans. here's an article http://www.veracode.com/blog…
Comment linking /blog/2012/06/dangers-of-scanning-qr-codes-interview-with-eric-mikulas/
on “That square QR barcode on the poster? Check it's not a sticker”Submitted Malicious NPM Package Hides Pulsar .NET Malware Inside PNG Images as a story · 2 points
HN discussion
![Google vs. Facebook on Privacy and Security [Infographic]](http://www.veracode.com/images/media/google-facebook-privacy-security-veracode.png){kind=link}