Top all-time · #757
Welcome.
Personal blog · lock.cmpxchg8b.com · on HN as tavisosecurityprogramming
Welcome. is a personal blog at lock.cmpxchg8b.com about security and programming. Since 2010, 86 different Hacker News readers have linked it 121 times, most often “Password Managers”. No feed was found, so read it on the site itself.
Rarely recommended · 4 of 40 sampled comments recommend it?
Why HN links it
Linked for Tavis Ormandy's security write-ups on password managers, browser extensions, Sophos and Anubis, plus retro DOS and Lotus software history. Most comments cite it as a source.
- Recommended for · 4 comments
- Called a pretty convincing argument on extensions and password managers, a strong case against Vivaldi Mail's advice, and a Lotus 1-2-3 post an amazing story.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Password Managers13 people · 14 mentions · first linked 2021-06-05
- Lotus 1-2-3 For Linux11 people · 12 mentions · first linked 2022-05-21
- Why are anime catgirls blocking my access to the Linux kernel?8 people · 8 mentions · first linked 2025-08-20
- /sophailv2.pdf6 people · 8 mentions · first linked 2012-12-04
- Lotus 1-2-3 arbitrary resolution6 people · 7 mentions · first linked 2021-03-01
- Reptar5 people · 6 mentions · first linked 2023-11-14
- Zenbleed5 people · 5 mentions · first linked 2023-07-24
- WordPerfect for UNIX (1992)5 people · 5 mentions · first linked 2022-07-18
- Console Spreadsheets3 people · 4 mentions · first linked 2020-11-26
- Rediscovering Lotus Agenda (MS-DOS, 1989)3 people · 4 mentions · first linked 2020-10-22
What Hacker News says?
That's really cool. I made a terrible one for SHA1 years ago, yours is 1000x better. https://lock.cmpxchg8b.com/sha1/visualize.html I read a paper at the time where someone described a tool they made to find a near-collision, they explained they were just flipping bits and visually observing the affects. That sounded kinda fun, but they didn't release it, so I tried to replicate it from their description!
Comment linking /sha1/visualize.html
on “Show HN: SHA-256 explained step-by-step visually”Submitted Why are anime catgirls blocking my access to the Linux kernel? as a story · 839 points
HN discussionThis dance to get access is just a minor annoyance for me, but I question how it proves I’m not a bot. These steps can be trivially and cheaply automated. I think the end result is just an internet resource I need is a little harder to access, and we have to waste a small amount of energy. From Tavis Ormandy who wrote a C program to solve the Anubis challenges out of browser https://lock.cmpxchg8b.com/anubis.html vi…
Comment linking /anubis.html
on “GPT-5.2”Submitted Lotus 1-2-3 For Linux as a story · 703 points
HN discussionThere can be vulnerabilities, this is clearly the hottest attack surface of password managers. I remember a few years ago Tavis Ormandy from Google Project Zero found such vulnerabilities in a bunch of the most popular password managers which allowed to steal credentials from a rogue website. I'd still recommend using a password manager, as overall and in practice the risk of phishing and (re)using (weak) passwords…
Comment linking /passmgrs.html
on “Passkeys: A shattered dream”Submitted Lotus 1-2-3 arbitrary resolution as a story · 520 points
HN discussionliterally the top link when I search for his exact text "why are anime catgirls blocking my access to the Linux kernel?" https://lock.cmpxchg8b.com/anubis.html Maybe travis needs more google-fu. maybe that includes using duckduckgo?
Comment linking /anubis.html
on “Why are anime catgirls blocking my access to the Linux kernel?”Submitted Password Managers as a story · 460 points
HN discussionHe wrote a review of it: https://lock.cmpxchg8b.com/spreadsheet.html#borland-quattro-...
Comment linking /spreadsheet.html
on “Lotus 1-2-3 For Linux”Submitted WordPerfect for UNIX (1992) as a story · 243 points
HN discussionThat's funny, I was just playing around with making popup-ads in README.md this weekend! https://lock.cmpxchg8b.com/tektronix.html
Comment linking /tektronix.html
on “CSS in GitHub Readmes”Submitted Troubleshooting: Terminal Lag as a story · 227 points
HN discussionThis is great and probably a nice complement if I can get it working with my Visidata[0] workflow for data files. If you’re looking just for spreadsheets, Travis Ormandy somehow managed to get Lotus 1-2-3 to run on Linux a few years ago[1]. It’s a neat comparison point. [0] https://www.visidata.org/ [1] https://lock.cmpxchg8b.com/linux123.html
Comment linking /linux123.html
on “SCIM: Ncurses based, Vim-like spreadsheet”Submitted Hiew Hex Editor as a story · 194 points
HN discussion>unoptimized memcpy could anyone do any better on 68000? My incomplete history of CPU dedicated fast paths for moving data: - 1982 Intel 186/286 'rep movsw' at theoretical 2 cycles per byte (I think its closer to 4 in practice). Brilliant, then intel drops the ball for 20 years :| - 1986 WDC W65C816 Move Memory Negative (MVN), Move Memory Positive (MVP) at hilarious 7 cycles per byte. Slower than unrolled code, 2x s…
Comment linking /reptar.html
on “AMD Disables Zen 4's Loop Buffer”Submitted Unstripping Stripped Binaries as a story · 189 points
HN discussionI really liked the QNX Photon aesthetic, for a long time I maintained an absurdly complex FVWM configuration designed to look like it. This was a screenshot of my Gentoo desktop around 2004! https://lock.cmpxchg8b.com/img/fvwm_desktop.jpg
Comment linking /img/fvwm_desktop.jpg
on “The QNX Operating System”Submitted Ledger as a story · 183 points
HN discussionWordPerfect is an interesting example: https://lock.cmpxchg8b.com/wordperfect.html WordStar is another one, used by George RR Martin et al: https://arstechnica.com/information-technology/2017/03/words...
Comment linking /wordperfect.html
on “Ask HN: Interesting TUIs (text user interfaces), maybe forgotten ones?”Submitted Zenbleed as a story · 133 points
HN discussionTavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
Comment linking /passmgrs.html
on “1password is considering a self-hosted option to store vaults”Submitted Quest for my perfect watch as a story · 125 points
HN discussionThat's funny, I had this tab open this weekend while I was trying to make a silly terminal game, where each sprite is an ncurses window. I didn't really make much progress, but got the physics and sprite drawing working. https://lock.cmpxchg8b.com/img/ncurses.gif
Comment linking /img/ncurses.gif
on “Writing Programs with Ncurses”Submitted Rediscovering Lotus Agenda (MS-DOS, 1989) as a story · 74 points
HN discussionThere really is no good anti-virus software for Macs at the moment. Have a look at recent vulnerabilities in ESET and Sophos, for example: http://googleprojectzero.blogspot.com/2015/06/analysis-and-e... https://lock.cmpxchg8b.com/sophailv2.pdf
Comment linking /sophailv2.pdf
on “OS X sudoers exploit found in the wild”Submitted Console Spreadsheets as a story · 46 points
HN discussion> Maybe there's a way to distribute dissembler hints Tavis recently posted about using STABS for that < https://lock.cmpxchg8b.com/symbols.html > and has existing code that seems relevant: https://github.com/taviso/wpunix/blob/main/debug/idb2stabs.p... I've never used Ghidra in anger to know if it would work for their platform, nor whether the Ghidra database can be shipped separate from the binary
Comment linking /symbols.html
on “Reviving the Pakon film scanner”Submitted 140bit SHA-1 Near Collision Discovered (Javascript Visualization) as a story · 10 points
HN discussionThe test page is still vulnerable for me. https://lock.cmpxchg8b.com/SaiGhij5/lastpass.html Chrome 57.0.2987.110 (64-bit) Version: 4.1.42 Built: Thu Mar 09 2017 12:40:16 GMT-0500 (EST) Binary Component: true (Native Messaging version 4.1.34, built Jan 11 2017 01:45:24) Any idea why? I thought no user action was required? No custom error message for NXDOMAIN (I think?), I see the Lastpass site, then calc.exe opens. h…
Comment linking /SaiGhij5/lastpass.html
on “LastPass RCE vulnerability fixed”Submitted Troubleshooting: Terminal Lag as a story · 7 points
HN discussion
