Hacker News: gquere

New comment by gquere in "eMudhra intermediate CA compromise"

gquere — Wed, 21 Oct 2026 13:01:04 +0000

Certificate Transparency solves the rogue CA scenario for domain owners.

New comment by gquere in "eMudhra intermediate CA compromise"

gquere — Wed, 21 Oct 2026 12:37:00 +0000

Wiping local app storage fixes this.

New comment by gquere in "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds"

gquere — Wed, 21 Oct 2026 12:32:53 +0000

Doesn't ACME+CT solve this threat?

New comment by gquere in "Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds"

gquere — Wed, 21 Oct 2026 12:30:57 +0000

There's a beginning of an explanation in the mozilla bugrepor thttps://bugzilla.mozilla.org/show_bug.cgi?id=2083449

Getting into EMFI for 30€ thanks to globalization

gquere — Tue, 15 Sep 2026 12:45:07 +0000

Article URL: https://www.errno.fr/EMFI_basics.html

Comments URL: https://news.ycombinator.com/item?id=49711695

Points: 3

# Comments: 0

New comment by gquere in "An Interesting Find: STM32 RDP1 Decryptor"

gquere — Tue, 03 Mar 2026 07:29:48 +0000

RDP2 has been cracked by glitching. You first need to downgrade RDP2 to RDP1 then do the RDP1 bootloader glitch. It's not exactly easy but it's well documented and can be done given enough time. Though the STM32F4 targets do have a high chance of bricking during this attack.

New comment by gquere in "An Interesting Find: STM32 RDP1 Decryptor"

gquere — Tue, 03 Mar 2026 07:27:37 +0000

First I'd like to point out that "Decryptor" is an ill-chosen term: there's no encryption mechanism here, RDP is a software lock based on an internal flash state.

This dongle is very likely to be this original attack https://github.com/JohannesObermaier/f103-analysis/tree/mast... but now packaged. If you want to read more this repo has the best doc: https://github.com/CTXz/stm32f1-picopwner. It's a multi-step attack where a payload is executed from persisted SRAM (RDP1 means you can read/write to it) after a quick reset. The fact that they mention freezing the chip heavily weighs in that direction since it's needed for higher clock chips.

New comment by gquere in "VulnLLM-R: Specialized Reasoning LLM with Agent Scaffold for Vuln Detection"

gquere — Fri, 30 Jan 2026 12:08:27 +0000

I've tried this locally on a known-vulnerable piece of software using the hugginface Q8 model + llama. It did find the vuln when given the entrypoint in the lib and user-controlled buffer. Otherwise it produced false positives.

VulnLLM-R: Specialized Reasoning LLM with Agent Scaffold for Vuln Detection

gquere — Fri, 30 Jan 2026 12:05:29 +0000

Article URL: https://arxiv.org/abs/2512.07533

Comments URL: https://news.ycombinator.com/item?id=46823478

Points: 1

# Comments: 1

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 12:14:47 +0000

AFAIK you don't need a credit card linked to the account, you can get in-store credit from selling the guaranteed drop items from playing a few matches, this is enough to get you started trading.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 12:07:38 +0000

Read up on the story, look at the influencers promoting it and the ecosystem that grew around it. Valve is willfully running a casino for underage and have bypassed local laws that protect against this using technicalities. It's frightening.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 08:33:44 +0000

I didn't downvote you (my account is low reputation) but your argument is weak: that some skins go for absurd amount of money says nothing of the rest of the ecosystem. There can both be children and drug dealers (ab)using the same "gaming" mechanics.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 07:37:30 +0000

They're running an online casino directed at children and have made specific adaptations to bypass legal regulations in several countries.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 07:30:18 +0000

They did this to take a bigger cut of the market because most trades happened off-platform. This new update ensures that they will sell more of their new items through their shop (contract cases) because it's going to be the only way to get the red items to fuses into "valuable" knives. They're rotten to the core.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 07:17:49 +0000

Look at the "meta-"game mechanics: you play a few games, you get a guaranteed case drop. This circa $3 case could contain anything, a $0.2 skin or a rare $2500 knife. When you open it a casino-like wheel goes over all the items and selects one randomly. There are hundreds of YT/twitch channels that open cases all day long and their target audience is children. It's gambling, and it's gambling for children.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 07:08:35 +0000

I doubt it's going to change anything, this manipulated market will adapt and continue to extract money from kids. The cynic in me could even say that this change was pushed by Valve to take a bigger cut of the skin market (most trades are supervised by 3d parties). Coffeezilla investigated one of the many casino sites, there's a lot more to it.

New comment by gquere in "Counter-Strike's player economy is in a freefall"

gquere — Fri, 24 Oct 2025 07:03:30 +0000

It doesn't "feel" like gambling, it's straight 100% the exact same thing but it's designed in a way that bypasses the legal words.

New comment by gquere in "Dumping Memory to Bypass BitLocker on Windows 11"

gquere — Fri, 03 Jan 2025 10:31:52 +0000

On company laptops this isn't always true, for instance here's the spec sheet of the ThinkPad T14 (this seems to be true for all ThinkPad models): https://www.lenovo.com/fr/fr/p/laptops/thinkpad/thinkpadt/th...

Where it states: Module dTPM 2.0 (Discrete Trusted Platform Module)

Same for HP EliteBook and ProBooks: https://h20195.www2.hp.com/v2/GetPDF.aspx/c08049273.pdf

Breaking Down Multipart Parsers: File upload validation bypass

gquere — Thu, 07 Nov 2024 10:08:19 +0000

Article URL: https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

Comments URL: https://news.ycombinator.com/item?id=42075311

Points: 1

# Comments: 0

New comment by gquere in "Becoming physically immune to brute-force attacks (2021)"

gquere — Mon, 28 Oct 2024 07:43:03 +0000

Technically bcrypt isn't a KDF.