Top all-time · #3322
X41 D-Sec
Company blog · x41-dsec.de/lab/blogsecurity
X41 D-Sec is the company blog at x41-dsec.de, writing about security. Since 2016, 23 different Hacker News readers have linked it 25 times, most often “Wire Cryptography Audit [pdf]”. It is still writing: the last post was on 2026-10-09, and you can follow it by feed.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link X41 D-Sec's security audit reports and advisories, including Mullvad VPN, Ruby on Rails, Wire and Git. Most comments link straight to the PDF reports.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
X41 D-Sec GmbH is a renowned expert provider from Aachen (Germany) for dedicated high quality security research, source code audits, application security services, penetration tests, and full red teaming.
Most-linked posts?
- Wire Cryptography Audit [pdf]3 people · 3 mentions · first linked 2017-02-09
- X41 and GitLab Release Security Audit of Git3 people · 3 mentions · first linked 2023-01-17
- Security Audit of Git2 people · 2 mentions · first linked 2023-01-17
- /lab/advisories/x41-2017-008-shadowsocks/2 people · 2 mentions · first linked 2018-08-22
- Telenot Complex: Insecure AES Key Generation2 people · 2 mentions · first linked 2022-01-18
- Security Review for Mullvad VPN [pdf]2 people · 2 mentions · first linked 2024-12-11
What Hacker News says?
Direct link to the PDF report: https://x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-... Titles of issues they found: 4.1.1 MLLVD-CR-24-01: Signal Handler’s Alternate Stack Too Small 4.1.2 MLLVD-CR-24-02: Signal Handler Uses Non-Async-Safe Functions 4.1.3 MLLVD-CR-24-03: Virtual IP Address of Tunnel Device Leaks to Net- work Adjacent Participant 4.1.4 MLLVD-CR-24-04: Deanonymization Through NAT 4.1.5 MLLVD-CR-…
Comment linking /static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf
on “Review of Mullvad VPN”Submitted Review of Mullvad VPN as a story · 476 points
HN discussionMay be even better to link it to the PDF? [1]. From the Changelog I am also guessing most of these are not fixed in 8.0.2? I wonder if they will come with Rails 8.1 which is still not released. [1] https://www.x41-dsec.de/static/reports/X41-Rails-Audit-Final...
Comment linking /static/reports/X41-Rails-Audit-Final-Report-PUBLIC.pdf
on “Ruby on Rails Audit Complete”Submitted nginx: 1-byte memory overwrite vulnerability in DNS resolver (CVE-2021-23017) as a story · 53 points
HN discussion>Outline is a security disaster, and I strongly recommend against using it. >- Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! > https://github.com/shadowsocks/shadowsocks-rust/issues/78 UDP seems to work properly with Outline without any issues. SOCKS proxies does all…
Comment linking /lab/advisories/x41-2017-008-shadowsocks/
on “Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN”Submitted Telenot Complex: Insecure AES Key Generation as a story · 32 points
HN discussionOutline is a security disaster, and I strongly recommend against using it. - Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! https://github.com/shadowsocks/shadowsocks-rust/issues/78 - Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw av…
Comment linking /lab/advisories/x41-2017-008-shadowsocks/
on “Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN”Submitted Exploitable Vulnerability in libotr as a story · 9 points
HN discussionTo add more: Not only 0, but also some other keys listed here https://cr.yp.to/ecdh.html which produce all-zero shared key. DJB argues you shouldn't validate public keys except for "some unusual non-Diffie-Hellman elliptic-curve protocols that need to ensure ``contributory'' behavior". So NaCl/TweetNaCl also don't do anything about it. Libsodium, on the other hand, returns an indicator when the shared key is all-zer…
Comment linking /reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf
on “Show HN: Monocypher: a small, easy to use crypto library”Submitted Wire Cryptography Audit [pdf] as a story · 4 points
HN discussionAlso many people forget its not just the VPN, its the combination of the VPN and your browser. There are many ways to unmask you even if the provider does everything right. They can't protect against attacks like dom battery monitoring, complex fingerprinting, UDP timing attacks, etc... read the Mullvad audit for more details. They cite the need to enable DAITA by default as a shortcoming. https://www.x41-dsec.de/st…
Comment linking /static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf
on “NordVPN says its new protocol can circumvent VPN blockers”Submitted X41 and GitLab Release Security Audit of Git as a story · 2 points
HN discussionThe recent libotr vulnerability is a good example of such a bug that appeared with 64 bit: https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/
Comment linking /lab/advisories/x41-2016-001-libotr/
on “Vulnerabilities induced by migrating to 64-bit platforms”Submitted Security Audit of Git by X41 as a story · 2 points
HN discussionhttps://x41-dsec.de/security/research/news/2023/01/17/git-se...
Comment linking /security/research/news/2023/01/17/git-security-audit-ostif/
on “Git Security Vulnerabilities Announced”Submitted Security Audit of Git as a story · 2 points
HN discussionDirect link to the report itself https://www.x41-dsec.de/reports/Kudelski-X41-Wire-Report-pha...
Comment linking /reports/Kudelski-X41-Wire-Report-phase1-20170208.pdf
on “Wire’s independent security review – Server source coming end Q1 2017”Submitted Security Audit of Hickory DNS as a story · 1 points
HN discussionIn general I would tend to agree, but have lately took a look at the gh dependencies this tool draws in today? [0] This is not a (classic) unix cli tool, as it was some month before. Do you think anyone will be ever able to make a codereview? Like done for git [1]? [0] https://github.com/cli/cli/blob/trunk/go.mod [1] https://x41-dsec.de/security/research/news/2023/01/17/git-se... On the other side: a simple and easy…
Comment linking /security/research/news/2023/01/17/git-security-audit-ostif
on “Show HN: I made a tool, create GitHub Repository from local directory directly”Submitted Security Audit of Backstage as a story · 1 points
HN discussionSubmitted Security Review for Mullvad VPN [pdf] as a story · 1 points
HN discussionSubmitted Source Code Audit on Git [pdf] as a story · 1 points
HN discussionSubmitted Security Audit of Git as a story · 1 points
HN discussionSubmitted Telenot Complex: Insecure AES Key Generation as a story · 1 points
HN discussionSubmitted Nginx DNS Resolver Off-by-One Heap Write Vulnerability as a story · 1 points
HN discussion
