Live data from Hacker News

How I Hacked Hacker News (with arc security advisory)

news.ycombinator.com

51–60 of 84 posts

Re: How I Hacked Hacker News (with arc security advisory)

#51
post #21

Earlier quoted context omitted.

I think the "he" is dfranke in this context.

Yeah, but I looked through the rest of the list and the rest of the examples could have referred to the male context, so I simply was just making sure.

The sentence was grammatically unambiguous as written.

Re: How I Hacked Hacker News (with arc security advisory)

#52

> This, obviously, is not a cryptographically strong PRNG. Why is this obvious? The generator used is L'Ecuyer's MRG32k3a : http://www.iro.umontreal.ca/~lecuyer/myftp/papers/streams00s... Is there a known weakness?

It's not really a question of known weaknesses because it's not designed to be secure in the first place; it only performs a single round. Its purpose is to be fast and to be "random enough" for scientific applications.

Re: How I Hacked Hacker News (with arc security advisory)

#53
post #46

Very nicely done. This is precisely the attack that I described in a HN post a month ago. Glad to hear that it would have worked if I'd had time: http://news.ycombinator.com/item?id=596126

Wow. This post has been sitting on my hard drive for a little under a month waiting for arc3's release, and the hack itself was a few evenings' work, so this was simultaneous discovery damn near to the day. I'm not sure who was first; I never saw that comment at the time.

I'm not trying to be first. All the kudos goes to you.

Re: How I Hacked Hacker News (with arc security advisory)

#54
post #46

Earlier quoted context omitted.

Wow. This post has been sitting on my hard drive for a little under a month waiting for arc3's release, and the hack itself was a few evenings' work, so this was simultaneous discovery damn near to the day. I'm not sure who was first; I never saw that comment at the time.

I'm not trying to be first. All the kudos goes to you.

I'm not quibbling over credit; I just think this kind of simultaneity is a fascinating phenomenon. No doubt both of our thought processes got tweaked by the cluster of other security posts that were showing up on HN at the time.

Re: How I Hacked Hacker News (with arc security advisory)

#55
post #54

Earlier quoted context omitted.

I'm not trying to be first. All the kudos goes to you.

I'm not quibbling over credit; I just think this kind of simultaneity is a fascinating phenomenon. No doubt both of our thought processes got tweaked by the cluster of other security posts that were showing up on HN at the time.

Yeah. That is interesting. Pity I can't reconstruct my thought processes. I know that I'd been poking around inside the news.arc because I was looking for vulnerabilities because of my recent posts about 37 Signals and password hashing.

I wonder what set you off.

I do like the fact that here on HN there were at least two of us who thought of this way of hacking the site, one actually made it happen. It's a high quality community.

Re: How I Hacked Hacker News (with arc security advisory)

#56
post #54

Earlier quoted context omitted.

I'm not trying to be first. All the kudos goes to you.

I'm not quibbling over credit; I just think this kind of simultaneity is a fascinating phenomenon. No doubt both of our thought processes got tweaked by the cluster of other security posts that were showing up on HN at the time.

it's actually not that uncommon. I spoke with my patent attorney some time ago and he could attest that very often the exact same inventions are sent to the patent office only days apart. Sometimes even on the same day. Famously Elisha Gray sent in his patent application for the telephone at the same time as Alexander Graham Bell. A letter was sent out to the two parties asking them to defend their application in order to find out who should be awarded the patent. Gray's company didn't find it worth the trouble to respond, so the patent went to Bell.

The point is that people and the ideas they have are influenced by external factors, many of them unconscious. But we will pick up on the same clues, think about the same problems, and maybe come up with the same solutions based on external factors. Nothing can stop an idea whise time has come.

Re: How I Hacked Hacker News (with arc security advisory)

#57
post #10

Thanks to dfranke for giving us time to release a fix, and in fact writing part of it.

I hope you scoop him up for one of your YC teams. That hack was damned impressive for breadth and depth of knowledge, pretty rare in my experience.

I imagine Daniel wouldn't have trouble getting a job with a YC company, if he were so inclined. If we were hiring (couple more months...), we'd certainly talk to him.

Re: How I Hacked Hacker News (with arc security advisory)

#59
post #3

Very impressive. Are a you a professional security researcher or just a programmer who tilts that way?

The qualities that make a great developer and a great professional security researcher are about the same.

Both involve taking hardware, a programming language, an API, an application or something else that someone in the computing industry had one purpose for, and bending it in a way to produce a rather unexpected, very unique result.

A great developer builds Web 2.0 with something as novel and limited as JavaScript and HTML.

A great security researcher made your toaster catch fire from a different continent (didn't they always say our toasters would be internet connected?).

I, personally, think the latter is more fun provided it doesn't cause any actual damage (and I think that was demonstrated ... a whitehat makes his own toaster catch fire and sometimes tells everyone who has that model of toaster how to fix it).

Nicely done.

Re: How I Hacked Hacker News (with arc security advisory)

#60

Off topic yes, I cruised through his profile to see what else he was involved with or does and found this small piece he wrote that I found to quite good. I would recommend checking it out. http://dfranke.us/cfod.html

I enjoyed that essay, although he never cleared up my confusion as to what he meant by libertarian. I generally use it as a synonym for anarchist, but he sounds (and I could be wrong) more like a right libertarian. Is this right?
Post reply on HN