How I Hacked Hacker News (with arc security advisory) • Hacker News Board

Re: How I Hacked Hacker News (with arc security advisory)

#41

Post by req2 » Wed, Jun 03, 2009, 7:31 PM UTC

tptacek wrote: post #31

dfranke wrote: post #29

Earlier quoted context omitted.

Thanks, I think that's the most elaborate compliment I've ever gotten.

Also, like Brad Pitt, you have beautiful, silky, manageable hair.

You're just making it harder for me to decide which #1 crypto post for today is my favorite.

Re: How I Hacked Hacker News (with arc security advisory)

#42

Post by dfranke » Wed, Jun 03, 2009, 7:42 PM UTC

ShellDragon wrote: post #38

Brilliant sir! I'm your slave.

sudo make me a sandwich.

Re: How I Hacked Hacker News (with arc security advisory)

#43

Post by biohacker42 » Wed, Jun 03, 2009, 7:49 PM UTC

This reminds me of the exploits I used to read in phrack back when I was still in college. There should be a book that collects great hacks like this one.

Re: How I Hacked Hacker News (with arc security advisory)

#44

Post by notdarkyet » Wed, Jun 03, 2009, 7:58 PM UTC

Off topic yes, I cruised through his profile to see what else he was involved with or does and found this small piece he wrote that I found to quite good. I would recommend checking it out.

http://dfranke.us/cfod.html

Re: How I Hacked Hacker News (with arc security advisory)

#45

Post by soegaard » Wed, Jun 03, 2009, 8:00 PM UTC

> This, obviously, is not a cryptographically strong PRNG.

Why is this obvious?

The generator used is L'Ecuyer's MRG32k3a : http://www.iro.umontreal.ca/~lecuyer/myftp/papers/streams00s...

Is there a known weakness?

Re: How I Hacked Hacker News (with arc security advisory)

#46

Post by dfranke » Wed, Jun 03, 2009, 8:02 PM UTC

jgrahamc wrote: post #36

Very nicely done. This is precisely the attack that I described in a HN post a month ago. Glad to hear that it would have worked if I'd had time: http://news.ycombinator.com/item?id=596126

Wow. This post has been sitting on my hard drive for a little under a month waiting for arc3's release, and the hack itself was a few evenings' work, so this was simultaneous discovery damn near to the day. I'm not sure who was first; I never saw that comment at the time.

Re: How I Hacked Hacker News (with arc security advisory)

#47

Post by akamaka » Wed, Jun 03, 2009, 8:18 PM UTC

Aside from being a good hack, I really enjoyed reading your write-up!

Re: How I Hacked Hacker News (with arc security advisory)

#48

Post by noonespecial » Wed, Jun 03, 2009, 8:45 PM UTC

I've always been a dfranke fan. Ever since reading his "Code free or die()" essay. He used "beg the question" correctly. I got misty eyed. That's good peeps.

And, oh look, he's also a fantastic hacker.

Thanks for taking the time to write this out. This is the kind of hack I enjoy most. Watching the combination of obscure facts and astute observations come together into a coherent and powerful whole is a pleasure.

Re: How I Hacked Hacker News (with arc security advisory)

#49

Post by cturner » Wed, Jun 03, 2009, 8:54 PM UTC

chanux wrote: post #32

Who says open source code is less secure?

Isn't it cool that with free software your users can have the rush of the hack and demonstrate the fix without having to screw your production server?

Re: How I Hacked Hacker News (with arc security advisory)

#50

Post by [deleted] » Wed, Jun 03, 2009, 9:01 PM UTC

[deleted]