captn3m0

I reversed Super Hexagon these last few weeks and ported it to the Playdate (the yellow console from Panic with a crank): https://old.reddit.com/r/PlaydateConsole/comments/1v1zxmt/i_...

The multiplier comes from being able to design arbitrary fast feedback loops - Claude wrote Python scripts to do decompilation matching for itself, and then use Frida traces from the original as a verification harness.

There are a lot of other implementations of this idea that don't necessarily rely on trust-on-first-use. The securedrop team explicitly includes malicious JS served by the primary-domain in the threat-model and made WEBCAT[0] as an outcome of that research. Their article on webcrypto is much better than this one.

The solution obviously is to go out-of-band:

When a user visits a website that has enrolled in WEBCAT, before the site can load the content is checked against a signed manifest to ensure that it has not been tampered with (more on enrollment later). If everything checks out, the page loads normally. If, however, any content does not match what’s expected, the page load is aborted and a warning is displayed, protecting the user from potentially malicious content before it can execute.

[0] https://securedrop.org/news/introducing-webcat-web-based-cod...

[1] https://securedrop.org/news/browser-based-cryptography/

This is a OS port (iOS) of an existing functional and maintained fork (MacOS) of the official release (Windows).

Most of these low-hanging bugs would have been caught upstream by now.

upstream is a MacOS+linux build. https://github.com/fbraz3/GeneralsX.

Do we know how Apple sends these? Is it just a notification, or also email?

There are 2 complete folds in the Isaac 0 video around 0:40, but speeded up: https://m.youtube.com/watch?v=KhImSR8GuCE

The about page claims 1000+ lbs of laundry folded every week.

10% apparently for .tk. I also remember .tv windfall, which is 8-9% of their GDP.

I wrote superbright to be able to force it: https://github.com/captn3m0/superbright (fork of BrightIntosh). The display does get hit after 10-15 minutes of this though.

When I read the title, I thought it would be for research papers.

Hooks are not a new standard. Package managers have always supported hooks. It is just a call to get us to parity.

The problem of everchanging malware isn't fixable by global policies and global rulesets.

But it is an important tool that's missing in our toolbox. You could do most of the above, and still get pwned by a typo in an `npx` command. Capability based access management is not likely to land in any large package manager in the next few years, and we need solutions that work today.

Package-level hooks are everywhere: https://github.com/ecosyste-ms/package-manager-hooks

I wrote this in response to the recent AUR attacks. The problem isn’t really too many dependencies - it is that most users cannot be auditing everything they install and we need mechanisms that help users where they are.

I audit my AUR pkg builds, and I would have likely caught any malware. But so would a Dependency Cooldown or a third-party threat feed. Package Managers should make it easy to build this tooling via hooks.

Aliases and pre-hooks are nowhere near the guarantees you want, that’s what I am arguing - not everything is invoked from a blessed shell. Safely-bump-does.sh is also impossibly hard to write because you are replicating _all of the work NPM does in transitive dependency resolution_. Unless you are re-generating the lock file from scratch - it isn’t safe. Just updating package.json isn’t sufficient for eg.

Author here - people are definitely looking at other places. This just happens to be where the attacks are, and gets disproportionate attention as a result.

Do you have examples of campaigns that weren’t flagged? Everything except xz had a 1 day window and Dependency Cooldowns are super effective against most campaigns for that reason.

See papers at https://kokkonisd.github.io/ for eg.

`PreInstall` mainly. But `PreFetch/PreBuild` also for source-repositories, such as AUR helpers.

homebrew doesn't support hooks as a system package manager: https://github.com/ecosyste-ms/package-manager-hooks as an example.

I think the packaging ecosystem is varied enough that this should be left for the package managers to decide. Yarn allows dependency resolution and WebFetch overrides in its hooks for eg.

(Author here). I don’t really care _how and what you decide to do with it_, the post is about package managers giving users the ability to decide.

Dependency Cooldowns can be implemented with global hooks, git-commit-signing checks can be implemented, LLM-scans can be implemented, someone can run the code in a jail and use the eBPF logs to publish a threat feed.

Modern language packaging is also _source available_, and we have a huge leg up over traditional virus scans - we have the source code almost always. You can do amazing static analysis.

Yes, it’s hard work. But package managers are doing it already. Yay and Paru both now support hooks. I’m offering to help for AUR to publish more metadata: https://lists.archlinux.org/archives/list/aur-dev@lists.arch...

(Author here). It isn’t a matter of pre-install hooks. I don’t want known malware on my system irrespective of whether it runs at install-time or not. Pre-install hooks are going away in NPM, but we will have code injected in index.js next.

Modern package managers are not amenable to letting another script override its resolutions, and that is what needs fixing.

Has anyone reversed their SDKs to run a swarm that captures enough traffic to see what requests are actually getting made?

You can route an encrypted video stream through a server, same as messages. Zoom supports this as well now. You can’t do fancy stuff like transcoding at the server to support an older client, but WhatsApp dropped support for non-e2e really-old clients eons ago (Symbian and the like).

There is also microformats.

This was published in April, and we are far from consensus on what is “varnish”. Lots of distributions are now packaging vinyl and calling it varnish, some are pointing to the varnish repo instead (Fedora, Homebrew).

I’d left a comment last time, but haven’t tracked it since: https://news.ycombinator.com/item?id=47728216

I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

The crypto people tried this with hardware only password managers but they were too annoying. I have a halfway solution of using pass with Yubikey/GPG where each password decryption requires a touch. It does protect against the entire vault being decrypted at once and exfiltrated.

And as we can see from Australia, this doesn’t need a blockchain.

Other modes worth trying: "Mailing Lists", "Research Papers"

The discussion is so bad because the article is.

There’s so many nuances around assets, trademarks, copyright, monetisation, cheatware(?), multi-player etc but the article ignores all of it and goes for the straight freedom angle. How do you even have in-game purchases when you can’t control client code? Do we even have a single example of FOSS and mainstream game that made money and was multiplayer?

Terrible slop and I am flagging it.

MS gave away its exclusive rights to negotiate no revenue sharing: https://blogs.microsoft.com/blog/2026/04/27/the-next-phase-o...

Github does not expose a public bug list or any issues page, hiding their problems deep in email chains

Which email chains is this referring to? GitHub/community is fairly active from the community perspective. GitHub rarely looks at it anymore, prioritising their Enterprise roadmap.

Github often breaks on firefox and safari, browsers with millions of users

[[citation needed]].

I’ve been as annoyed as everyone with the GitHub frontend performance since the React rewrite, but never really faced breakage in Firefox. This claim is repeated a few times in the article, but without any links.

Meta offers it in EU: https://about.fb.com/news/2024/11/facebook-and-instagram-to-...

I’ve been considering it but I am not sure if it drops just ads or suggested posts as well.

Please don't do things to make titles stand out, like using uppercase or exclamation points, or saying how great an article is.

use the original title, unless it is misleading or linkbait; don't editorialize.

https://news.ycombinator.com/newsguidelines.html

Signal pushed a fix for that: https://signal.org/blog/signal-doesnt-recall/