Hacker News: MajesticHobo2

New comment by MajesticHobo2 in "VSCode's SSH Agent Is Bananas (2025)"

MajesticHobo2 — Thu, 24 Sep 2026 15:33:31 +0000

Is it? I've read the article twice (yesterday when you posted it and last year when it was first published), and that was not my interpretation.

New comment by MajesticHobo2 in "VSCode's SSH Agent Is Bananas (2025)"

MajesticHobo2 — Wed, 23 Sep 2026 21:52:24 +0000

This part of VSCode's architecture is acceptable to me. The reverse direction, where a compromised remote can do whatever it wants to my local machine, is not.

New comment by MajesticHobo2 in "GPT-6 Astra"

MajesticHobo2 — Fri, 04 Sep 2026 00:36:45 +0000

That is a linear growth problem whose answer is very easy to intuit.

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

MajesticHobo2 — Wed, 26 Aug 2026 23:48:47 +0000

You also don't want adversaries to be able to disrupt long-lived streams with bad password guesses, since I think part of Wormhole's security model is it will terminate the session if the other side gets it wrong.

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

MajesticHobo2 — Wed, 26 Aug 2026 23:43:51 +0000

They say it's rate-limited, so at least it probably won't scale to large botnets or similar...

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

MajesticHobo2 — Wed, 26 Aug 2026 23:40:56 +0000

notabug wontfix; that's the end-to-end (E2E) principle in action. Bring your own all of that.

New comment by MajesticHobo2 in "Show HN: Firefox in WebAssembly"

MajesticHobo2 — Wed, 15 Jul 2026 21:56:19 +0000

Browser sandboxing is now fully solved.

New comment by MajesticHobo2 in "We Are the Last People Who Know How It Works"

MajesticHobo2 — Tue, 30 Jun 2026 22:35:12 +0000

It's the same style I see on Twitter and LinkedIn a lot.

New comment by MajesticHobo2 in "We Are the Last People Who Know How It Works"

MajesticHobo2 — Tue, 30 Jun 2026 22:30:33 +0000

Why does it have to be deliberate? It's not surprising that people exposed to output from LLMs will unconsciously pick up their linguistic habits.

New comment by MajesticHobo2 in "Carrot Disclosure: Forgejo"

MajesticHobo2 — Wed, 29 Apr 2026 01:36:24 +0000

I'd say also add a test that shows the HTML injection (which spurred the PR) isn't possible. Given an attacker-controlled URL of:

    foo onclick

the following shouldn't render:

New comment by MajesticHobo2 in "Vulnerability research is cooked"

MajesticHobo2 — Mon, 30 Mar 2026 22:02:03 +0000

It was definitely partially about model quality. The frontier models are capable of producing valid findings with (reasonably) complex exploit chains on the first pass (or with limited nudging) and are much less prone to making up the kinds of nonsensical reports that were submitted to curl. Compared to now, the old models essentially didn't work for security.

If those script kiddies had been using today's models instead and _still_ didn't do any filtering, a lot more of those bugs would have been true positives.

New comment by MajesticHobo2 in "Vulnerability research is cooked"

MajesticHobo2 — Mon, 30 Mar 2026 20:54:52 +0000

> With decompilation I think there's a higher risk of it missing the intention of the code.

I'm not sure but suspect the lack of comments and documentation might be an advantage to LLMs for this use case. For security/reverse engineering work, the code's actual behavior matters a lot more than the developer's intention.

New comment by MajesticHobo2 in "Vulnerability research is cooked"

MajesticHobo2 — Mon, 30 Mar 2026 20:33:26 +0000

That was then, this is now. The new models are scarily good. If you're skeptical, just take an hour to replicate the strategy the article references. Point Claude at any open-source codebase you find interesting and instruct it to find exploitable vulnerabilities. Give it a well-defined endpoint if you want (e.g., "You must develop a Python script that triggers memory corruption via a crafted request") and see how well it does.

New comment by MajesticHobo2 in "We mourn our craft"

MajesticHobo2 — Sun, 08 Feb 2026 04:03:42 +0000

Third or fourth, maybe, not first.

New comment by MajesticHobo2 in "OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing"

MajesticHobo2 — Tue, 27 Jan 2026 19:54:12 +0000

Yes, but it would likely have to be chained with other bugs - at minimum, something that gives you an info leak.

Yeah, somebody came up with one here: https://news.ycombinator.com/item?id=46469897

New comment by MajesticHobo2 in "Humans May Be Able to Grow New Teeth Within Just 4 Years"

MajesticHobo2 — Wed, 31 Dec 2025 00:21:43 +0000

It’s a phase 1 clinical trial designed only to assess safety and determine the appropriate dosage. Future trials will focus on efficacy.

New comment by MajesticHobo2 in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"

MajesticHobo2 — Thu, 18 Dec 2025 23:36:25 +0000

Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?

New comment by MajesticHobo2 in "XKeyscore"

MajesticHobo2 — Sun, 07 Dec 2025 23:17:21 +0000

I'm sure they can store far more than 20 TB now, but it is true that the content pool is much larger. I would guess it's not a favorable ratio.

New comment by MajesticHobo2 in "Show HN: Cadence – A guitar theory app"

MajesticHobo2 — Wed, 22 Oct 2025 23:05:11 +0000

Thanks for making this! I've been looking for something like this for a while.

Hacker News: MajesticHobo2

New comment by MajesticHobo2 in "VSCode's SSH Agent Is Bananas (2025)"

New comment by MajesticHobo2 in "VSCode's SSH Agent Is Bananas (2025)"

New comment by MajesticHobo2 in "GPT-6 Astra"

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

New comment by MajesticHobo2 in "Tailcat – Like netcat, but over Tailscale’s data plane"

New comment by MajesticHobo2 in "Show HN: Firefox in WebAssembly"

New comment by MajesticHobo2 in "We Are the Last People Who Know How It Works"

New comment by MajesticHobo2 in "We Are the Last People Who Know How It Works"

New comment by MajesticHobo2 in "Carrot Disclosure: Forgejo"

New comment by MajesticHobo2 in "Vulnerability research is cooked"

New comment by MajesticHobo2 in "Vulnerability research is cooked"

New comment by MajesticHobo2 in "Vulnerability research is cooked"

New comment by MajesticHobo2 in "We mourn our craft"

New comment by MajesticHobo2 in "OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing"

New comment by MajesticHobo2 in "Fixing a Buffer Overflow in Unix v4 Like It's 1973"

New comment by MajesticHobo2 in "Humans May Be Able to Grow New Teeth Within Just 4 Years"

New comment by MajesticHobo2 in "We pwned X, Vercel, Cursor, and Discord through a supply-chain attack"

New comment by MajesticHobo2 in "XKeyscore"

New comment by MajesticHobo2 in "Show HN: Cadence – A guitar theory app"