HNHacker News
TopNewBestAskShowJobs

KateLawson

1,411 karma · joined May 21, 2009

Root Labs (currently): consultant for design and analysis of embedded and kernel security, cryptography, and reverse engineering. https://rootlabs.com

Past companies:

- SourceDNA (founder): a web service that scanned binaries from the app stores, identifying the tools and libraries they were built with. We notified developers about security issues and tracked the market share of SDKs and developer tools.

- Cryptography Research (engineer): self-protecting digital content, differential power analysis, tamper resistance for ASICs. So many stories.

submissionscomments
KateLawson··on Suica, Japan's First IC Transit Card
Various versions of these cards could be accessed to change the balance, including extracting the key by differential power analysis

[edit] Looks like this finally became public recently https://www.techtimes.com/articles/321138/20260721/japan-con...

KateLawson··on Stalking the Wily Hacker: 40 years later – Cliff Stoll [video]
It used to be common to leave voicemail for him from conference bridges ("cl1ff st0le muh k0d3z"). His greeting said something like "I'm not here right now; I'm baking cookies".

@CliffStoll Even though I wasn't the perpetrator of said voicemail, apologies on behalf of all the kids who annoyed you just because they could.

KateLawson··on I want extern "fil-C"
Any reason why you don't use clang's `-fbounds-safety`? It offers ABI compatibility and incremental adoption. The author of Fil-C worked on it also :-)

https://clang.llvm.org/docs/BoundsSafety.html#overview

KateLawson··on 78% MNIST accuracy using GZIP in under 10 lines of code
MNIST is what the Post Office solved in the late 1990s. It's basically the "hello world" of visual recognition these days.

https://www.govexec.com/federal-news/1999/02/postal-service-...

KateLawson··on Rosenpass – formally verified post-quantum WireGuard
It's important to point out that these programs have two different objectives.

The Mullvad client is designed to connect to a closed-source service, which is run by someone else. It supports a bunch of different plugins, including openvpn and WireGuard. So probably it could adopt rosenpass, at least with its WG plugin.

WireGuard is designed for minimal protocol variability, high assurance implementations, and ultra small code size. It's used by VPN services, but also by end-users creating their own tunnels.

KateLawson··on Tales of the M1 GPU
The slowness was due to a hardware bug in the 6522 VIA chip. The shift register (FIFO) would lock up randomly. Since this couldn't be fixed before the floppy drive needed to be shipped, they had the 6502 CPU bit-bang the IEC protocol, which was slower. The hardware design for the 154x floppy drive was fine, and some clever software tricks allow stock hardware to stream data back to the C64 and decode the GCR at the full media rate.

https://www.linusakesson.net/programming/gcr-decoding/index....

KateLawson··on NFS: The Early Years
Sun did have a firewall by the early 90's. It had application-level proxies, and you'd have to configure applications to bounce through it if you wanted to get to the Internet. In many ways, this was more secure than today's default for firewalls where you can make any outbound connection you want but only the inbound connections are filtered.

Note that I'm not arguing that Sun was a leader in security, but they did make some efforts that other companies didn't.

KateLawson··on Leaping Brain's "Virtually Uncrackable" DRM is just an XOR with "RANDOM_STRING"
Though there is no organized conspiracy, this is actually not far from the truth, especially in some areas of content protection. Companies that don't have the in-house technical expertise (music labels), working from an unprotected distribution system (audio CD) are at a particular disadvantage.

At the other end of the spectrum, you have satellite TV. In this area, a lot of money invested and full control of the playback platform have resulted in some strong systems. But still, it took a long time and a lot of cracks of intermediate systems for this industry to become the success story it is today.

Disclaimer: I worked for a company involved in the above.