Hacker News Reader

Comment by epolanski | Hacker News Reader

This blog post gave me a great deal of self confidence.

While I have no doubts how good the author and his friends are, all of their ideas were quite intuitive and simple to understand.

The kind of "I could've come with the same idea" type. Realistically I would've not for many reasons but it is still stuff I can grasp and even gives me ideas while reading.

Which is different from the general hacker idea I have of someone in a basement exploiting extremely far fetched and hard to grasp for me memory corruptions in some cache dumping some random bytes like the very complex attacks like Spectre I've read about.

It also makes me think that if most of the applications I have worked on haven't been attacked and easily exploited is because honestly nobody bothered.

View on HN

> It also makes me think that if most of the applications I have worked on haven't been attacked and easily exploited is because honestly nobody bothered.

This is my view of the things I create as well, and the fact they are not released to the public and are not generally public facing. Building internal tools does have a bit of freedom. However, I do things to the best of my knowledge "best practice" and don't intentionally do stupid things just because. But it is rather reassuring knowing that it's not that exposed to show how small "best of my knowledge" really is

Completely agree with you. However, I think over time I've come to realize that those hacks that seem obscure, weird, and impossible are not perceived that way by the people who discover them. It's just their area of expertise, their natural playground. And so maybe those exploits are as easy to understand by others in that field, as this blog post is to you.

Yes. Things always look way harder from the outside.

Also, the fact that clarity of exposition is interpreted as triviality is why people are sometimes compelled to write things in a way that deliberately obscures the content — one doesn’t want to risk explaining it too well and having the reader think “well, I could’ve come up with that!”.

The general hacker idea you have is... not reality.

At this point, I'm convinced that 90% of modern hacking is reliant on

username: admin

password: password

The other 10% is just literally asking for their password

More precisely, it's a Burp Suite plugin that tests for that combo, and users have no idea because it's one of a million didn't things they also have no idea are running.

this is even too advanced. 99% of modern hacking is :

username: admin

password:

The best lock pickers spend a lot of time making their own locks.

Reply on news.ycombinator.com