HN user

daeken

17,531 karma

Founder of DaeStar Emulation, previously of DigitalOcean, HackerOne, Optiv, Mozilla, Matasano Security, and a couple startups. My primary background is reverse-engineering, but my work is all over the board. My work has been featured in Forbes, H+ Magazine, Hacker Monthly (issue #10), EDN, and my mother's fridge. I've spoken at Defcon (2019), 44con (2019), and BlackHat (2012).

Nothing I say here is in any way representative of the views of my employer nor anyone else with whom I am affiliated.

My email is sera.brocious@gmail.com; feel free to contact me about anything, just include 'HN' in the subject, please.

I'm on HN Office Hours: http://hnofficehours.com/profile/daeken/

[ my public key: https://keybase.io/daeken; my proof: https://keybase.io/daeken/sigs/ci5oPW51-MaGySslf5iDROl1JIBimpAG596tsLH0Qi4 ]

Posts80
Comments2,799
View on HN
www.youtube.com 7y ago

What are quaternions, and how do you visualize them? [video]

daeken
17pts0
www.hacker101.com 8y ago

Show HN: Hacker101 – A Free Web Security Class

daeken
33pts4
news.ycombinator.com 8y ago

Tell HN: I want to sell my company

daeken
4pts0
pegaswitch.com 9y ago

PegaSwitch: Exploit Toolkit for Nintendo Switch

daeken
142pts50
www.microsoft.com 9y ago

Show HN: VNCaster, VNC for Hololens

daeken
5pts1
github.com 9y ago

Keyboard+Mouse for PS4 Remote Play

daeken
1pts1
daeken.svbtle.com 10y ago

HoloLens: A Preview of the Future

daeken
1pts1
github.com 10y ago

Pepakura File Format Reversing

daeken
2pts1
breaker101.com 10y ago

Breaker 101 – Online Web Security Course

daeken
54pts9
github.com 10y ago

Show HN: W|ASH: The Wolfram Alpha Interactive Shell

daeken
2pts1
lithub.com 11y ago

Aneurysm

daeken
1pts0
www.astrobotic.com 11y ago

MoonMail by Astrobotic

daeken
4pts1
breaker101.com 11y ago

Breaker 101 – Online Web Security Course

daeken
21pts1
demoseen.com 12y ago

Fret.js: Procedural Fretboard Generator

daeken
12pts10
breaker101.daeken.com 12y ago

The new Breaker 101 course has launched

daeken
35pts15
singularityhub.com 12y ago

It's Alive Artificial-Life Worm Wiggles On Its Own

daeken
2pts0
daeken.com 13y ago

Breaker 101: An intensive online web security course

daeken
286pts112
gizmodo.com 13y ago

Microsoft's Crazy IllumiRoom: More Details About a Real-Life Holodeck

daeken
3pts0
daeken.com 13y ago

So You Want To Be A Breaker, Part 1: Web Security

daeken
261pts83
daeken.com 13y ago

Show HN: Super simple static blog generator, Benjen

daeken
90pts45
daeken.com 13y ago

Responsible Disclosure Can Be Anything But

daeken
60pts35
daeken.com 13y ago

Confusing Crypto Blobs

daeken
102pts40
www.forbes.com 13y ago

Hackers Crack Hotel Room Locks With A Tool Disguised As A Dry Erase Marker

daeken
8pts0
ch00ftech.com 13y ago

The Laser Doodler

daeken
104pts10
daeken.com 13y ago

Onity's plan to mitigate hotel lock hack

daeken
62pts16
boingboing.net 13y ago

Sociability's value comes from privacy

daeken
17pts5
demoseen.com 14y ago

Show HN: WebGL Enabler for iOS

daeken
53pts57
demoseen.com 14y ago

Show HN: WebGL Enabler for iOS

daeken
26pts4
questcompanions.com 14y ago

Show HN: QuestCompanions, temp labor for MMORPGs

daeken
48pts41
me.veekun.com 14y ago

PHP: A fractal of bad design

daeken
765pts495

Some people just prefer to listen. I read well and I read quite quickly -- I don't know how many books I've physically read, but it's gotta be in the high hundreds at least -- but over the past ~10 years I've switched primarily to audiobooks. Rather than being something that I enjoy while I'm doing something else, I typically do something mindless with my hands (weave chainmail, cross stitch, sew) in order to give my full attention to the book.

I love (and heavily use) source generators, but the development experience is godawful. Working with the raw Roslyn types is painful at best and this is compounded by them having to be written against .NET Standard, severely limiting the use of newer .NET functionality.

Eventually I want to write a good baseline library to use for my source generators -- simplifying finding definitions with attributes, mapping types to System.Type, adding some basic pattern matching for structures -- but haven't found a way to do it that's general enough while being very useful.

Why xor eax, eax? 8 months ago

Back in 2005 or 2006, I was working at a little startup with "DVD Jon" Johansen and we'd have Quake 3 tournaments to break up the monotony of reverse-engineering and juggling storage infrastructure. His name was always "xor eax,eax" and I always just had to laugh at the idea of getting zeroed out by someone with that name. (Which happened a lot -- I was good, but he was much better!)

The vast majority of non-text editing in game development isn't done in modeling or image manipulation apps, it's done via the game engine's editor. That's true whether you're using Unity, Unreal, Godot, or a homebrew engine.

There are the rare engines with no editor to speak of -- where things are either done programmatically or other textual definitions -- but they're very very very few and far between.

The engine itself doesn't have a UI, but working with any major engine without using their editor is functionally impossible.

So, it is possible to use the machine consumable forms of the ISA, but realistically you'll spend way longer fighting it than finding other strategies.

Years ago, I ended up creating my own aarch64 definition, which I use to generate disassemblers, interpreters, and recompilers (dynamic and static) automatically: https://github.com/daeken/SharpRetro/blob/main/Aarch64Genera...

It doesn't have perfect support, but it has served as an incredibly useful resource. I've since generalized it to work for other architectures, and that same repo has definitions for MIPS (specifically the PSX CPU), DMG, and the groundwork for an x86 core. The goal is to be able to define these once, then generate any future targets automatically.

A qualifying mini app within the Mini Apps Partner Program is one that’s put out by a person or entity that’s not directly or indirectly controlled by you, nor under common control with you.

I don't understand; if it's put out by someone else, how do I participate?

I've become an unironic proponent of HE, the Human Era. For CE dates, we just add 10000 (I'm writing this from 12025). But for BCE dates, they're subtracted and it makes things so much clearer when it comes to telling how long ago something was. E.g. the sundial was invented around 6000 HE, steel was developed around 9000 HE.

Kurtzgesagt has a really great video about the subject: https://youtu.be/czgOWmtGVGs

There's also a timeline in HE that covers many major historical events: https://docs.wixstatic.com/ugd/71a711_295e365a6ec64d6ca7f87e...

Space Elevator 9 months ago

Bolos are used for spin gravity in the first part, but that's very different from the rotovators used in the second part. Both in concept and design. The key point with the rotovator is that the tip is moving at ~0m/s relative to the body it's orbiting when it's at its nadir, allowing you to just hop/grab on.

Back in ~2004, I worked on a project to define a codec virtual machine, with the goal of each file being able to reference the standard it was encoded against, along with a link to a reference decoder built for that VM. My thought was that you could compile that codec for the system you were running on and decode in software, or if a sufficient DSP or FPGA was available, target that.

While it worked, I don't think it ever left my machine. Never moved past software decoding -- I was a broke teen with no access to non-standard hardware. But the idea has stuck with me and feels more relevant than ever, with the proliferation of codecs we're seeing now.

It has the Sufficiently Smart Compiler problem baked in, but I tried to define things to be SIMD-native from the start (which could be split however it needed to be for the hardware) and I suspect it could work. Somehow.

Wow. This may be one of the most intense reverse-engineering (and honestly, engineering) efforts I've ever seen for an emulator project before. Capturing the raw LD image to this degree, being able to play it in reverse, etc -- absolutely brilliant. Truly fantastic work.

There's no AArch32 or Thumb support (A32/T32) on M-series chips. AArch64 (technically A64) is the only supported instruction set. Fun fact: this makes it impossible to run Mario Kart 8 via virtualization on Macs without software translation, since it's A32.

How much that does for efficiency I can't say, but I imagine it helps, especially given just how damn easy it is to decode.

(B2-ish Spanish learner here but) "ll" is pronounced in at least three variants that I know of: "y", "j", and something between "sh" and "ch". E.g. "llama" might be pronounced like (in English writing) "yama", "zhama", or "shama". The last one really threw me for a while; it's super common in Argentina at least.

EverQuest 1 year ago

There's a musician named Richie Truxillo who made so many comedy songs about EQ back in the day, but your comment just reminded me of "Has Anybody Seen My Corpse." I haven't thought about corpse runs and dragging folks' corpses back to them in ages!

EverQuest 1 year ago

I can nearly single-handedly credit EverQuest with my career. I got my start in the ShowEQ and eqemu sphere, first building little PHP apps to manage servers and such, then reverse-engineering -- I learned x86 and then C++ all to get the lifts in Kelethin working. Hell, nearly 25 years later, any time I work on some new graphics API or game engine, I end up writing an EverQuest zone renderer.

Not my favorite game of all time, but certainly the one with the biggest impact!

Edit to add: also, huge props to that community for both humbling me and teaching me more than I could've imagined. Went from a dumbass 13 year old saying "ROT13? Isn't that some unbreakable encryption?" In the ShowEQ IRC channel because she couldn't imagine saying she didn't know something, to a competent reverse-engineer. I cannot imagine how insufferable I was haha.

I mean ... You're not completely wrong, but you're not completely right either. For context: I've been working full-time in security for 15 years and on the fringes (reversing) for many more.

WAFs in and of themselves provide virtually zero security. They can block naive attacks -- catching the most obvious payloads -- and act as an early-warning signal that an attack may be underway (though the SNR on this is awful). But frankly, this is far less important in practice than the fact that it just makes things more difficult and annoying for attackers. Enough so that it can make a semi-attractive target into a no-go.

This is like defense-in-depth, but instead of layering protections in place so that the holes in the swiss cheese don't like up, you're making the cheese smell awful enough to ignore the juicy apple behind it.

If you're a valuable enough target, they're gonna go for the apple regardless of how bad the cheese is. ... And this analogy may have gotten away from me.

Huh, that business model honestly makes a lot of sense and -- ignoring the time component -- could be helpful for accessibility. My doctor has flat pricing for all members (he makes it public on the site, and included advance notice of an increase in his newsletter), but it is way out of reach for most folks. Not that 300 members goes that far either, but it's tough.

He was recommended by my therapist. Essentially runs an all-inclusive, boutique medical service; expensive, but actually turned out to be cheaper than all the services I'd previously had to use, for the best care of my life. That said, he only sees a limited number of patients (actually just closed new memberships from the web, only accepting referrals until he hits his cap) and only in Georgia.

I imagine there are other boutique providers out there, but this has been a first for me and given me hope that healthcare might not be so goddamn awful for everyone eventually.

My doctor sends out a monthly newsletter sharing things he finds interesting or useful, medical news, etc. Just this weekend he covered this study and shared his own thoughts on this, which I'll summarize since I haven't asked his permission to share verbatim:

This study does show a strong correlation but doesn't attempt to show causation. If cannabis users are significantly different than non-users in terms of activity levels or diet, or the ways they manage anxiety/pain/boredom, this could cause skewing. Since people use cannabis to treat (however effectively) various conditions, what is the risk of those conditions going untreated?

I thought this was a good analysis; glad to see a bit of desensationalism.