HNHacker News
TopNewBestAskShowJobs

cookiengineer

7,952 karma · joined August 15, 2016

I'm sort of a software engineer with a Cyber Defense and Purpleteam background. My projects have involved co-evolutionary AI concepts (NEAT/HyperNEAT) to automate the generation and adaption of code and network protocols, as well as fuzzing and exploiting binaries reproducibly. Meanwhile I'm also building my own agentic environment for all sorts of cool things.

For the last years I've been building a (co-evolutionary) AI-driven startup in the form of the https://tholian.network

The open source projects I've built in the past can be found on Github or my personal website:

- https://github.com/cookiengineer (same account on gitlab)

- https://cookie.engineer

Fun fact: All my comments have been written on the toilet. I don't use social media anywhere else.

I only use reddit, HN, and LinkedIn. All other accounts are probably fake, because I don't like the toxicity that social media embraces as you might've guessed already.

Have a great day, stranger!

submissionscomments
cookiengineer··on I still teach OpenGL ES 3.0
Yep, can confirm.

The tutorials and hands on coding examples made me understand how to program with GPUs. I loved them because at the time, khronos was still in its infancy and just started out with GLES extensions and the whole WebGL ecosystem.

Meanwhile I kind of believe that learning where it came from (fixed function pipeline, buffer/texture and uniform problems etc) makes a lot of sense to learn first so you start thinking in shader computation pipelines much easier, as you understand the whys and whens much better.

cookiengineer··on I refuse to accept a censored Internet. Join Me at FOSDEM 27
As the author pointed out, most soft routers are easily blockable because their protocol can be observed even from an opaque perspective.

Tricks for obfuscation I learned over the years:

- use exfil protocols (e.g. http smuggling via chunked encoding, DNS TXT)

- rotate exit nodes while sessions not only between (ronin behavior)

- encryption is useless with no padding or zero based padding, use one based padding instead

- scatter traffic through peers

- use manual caching everywhere, DNS TTL, HTTP entity based tracking, etc will be automatically unfeasible

- always think about the god's eye perspective of ISPs

One of my working soft router concepts, I've open sourced as Tholian Warps [1]

[1] https://github.com/tholian-network/warps

cookiengineer··on Brotli vulnerability affects curl and Git
Remember yesterday, when all the top comments here claimed that "no real software is affected by this"? The same folks who wrote that the PHP RCE isn't real and downvoted everyone claiming otherwise?

Where are all those folks now?

For reference (the thread I am talking about): https://news.ycombinator.com/item?id=50219177

cookiengineer··on Mortality Among People with Attention-Deficit/Hyperactivity Disorder
Did your parents have an outdoor cat before you were born?

If yes, check for [1]

[1] https://en.wikipedia.org/wiki/Toxoplasmosis

cookiengineer··on There isn't an easy exploit for this PHP vulnerability
I'm amazed that you didn't write "come on, not with muslc???"

Read up on what ASLR does, then read the heap feng shui document (or at least towards the fourth headline in the README), then come back here. Because it does not work the way you think it does.

I even let the agent create two separate demos for this, one for ASLR and one without, but people are still to stupid to understand it.

Versions are pinned, replace it, check the fatal.php to get the initial memory distances, then retry it again. It'll work, that is the freakin point of the demo.

cookiengineer··on Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
> ASLR

Read the heap feng shui doc, and headline 4 in the README.

The involved heap feng shui is independent of ASLR.

... and maybe read up on what ASLR actually does and how memory arenas work before trying to be smart?

cookiengineer··on Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
Eh, no?

It is split up into two branches and demos, see the heap feng shui document?

ASLR enabled requires a way to create more data, which I intentionally did not create in the index.php because other folks claimed that is "cheating". That was the demo that wiz created.

Maybe you should read the repo next time? It is literally headline 4.

The whole point of this demo is that the assumed to be hard part (mem feng shui) is what LLMs are actually good at.

cookiengineer··on Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
My PoC (generated) was able to exploit an index.php with a simple echo.

The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.

[1] https://github.com/cookiengineer/actual-php2shell

cookiengineer··on There isn't an easy exploit for this PHP vulnerability
> Sounds like you didn't prove its vulnerable against a stock PHP server though, so that's not a great response.

No I proved exactly that. Learn to read.

cookiengineer··on There isn't an easy exploit for this PHP vulnerability
Don't engage the troll. Look at their comment history, they comment senseless comments like this everywhere.
cookiengineer··on Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Shameless self promo for all the naysayers that are deflecting: https://news.ycombinator.com/item?id=50195017
cookiengineer··on Re: Hours later – No, there is an easy way to exploit this vulnerability
> Hi, you haven't looked at the code in your exploit.

No, I did. But thanks for leading with an offensive comment, makes reading the rest much more enjoyable /s

> Take a look at the php files you're shipping with your "stock" server - theyre pretty contrived, no? fatal.php? producer.php boom() str repeat X 32?

> You use that to get the constants for the RCE, but without that information you're in trouble. How transferrable are these constants? Do they work with any config changes?

Yes, they work with changes. The point is that you have to use a container to have a reproducible memory layout that you can target. And that _is_ known and _is_ reproducible.

It's not that hard to find out which OS images or which PHP version you're running on the server, there's plenty of well working scanning tools (e.g. projectdiscovery).

And this is setting aside that 99% of servers probably run standard versions of Ubuntu or Debian combined with the distribution packages of Magento, Wordpress, etc. And those are also reproducible in their memory layout, hosting setup, built package versions, etc.

Just as a disclaimer because I know where this is going: No, I didn't target muslc. Because most operating systems still don't use it, and that's the actual problem here we should discuss here.

cookiengineer··on There isn't an easy exploit for this PHP vulnerability
Here you go: https://news.ycombinator.com/item?id=50195017
cookiengineer··on There isn't an easy exploit for this PHP vulnerability
My response to all the naysayers and downvoters:

https://news.ycombinator.com/item?id=50195017

Vibecoded on purpose without any of my influence, just to prove a point that a local Qwen3.8 model that's post trained on DeepSeek's reasoning traces makes this exploit and the necessary Heap Feng Shui totally feasible.

cookiengineer··on Re: Hours later – No, there is an easy way to exploit this vulnerability
After being downvoted for writing that this exploit is actually feasible, and me pointing out that it's just a little heap feng shui work that any agentic LLM will find out by themselves ...

Here we go, 12 hours later, end-to-end exploit of an index.php that echoes "ok" and nothing more. Pinned PHP versions, reproducible containers for each of the CVE and exploit path/killchain variants and everything.

php.ini set intentionally to defaults. max_input_vars set to defaulted value of 1000 so it's actually harder to exploit than with a higher value.

Implemented using my Exocomp agentic environment, and my post-trained Qwen3.8 27B model that I trained on reasoning traces of DeepSeek v4 Pro. All on my github, needs a single 48GB Radeon VRAM GPU for training/inference via Vulkan (before someone claims it's too expensive).

Wake up folks, your assumptions about what is hard to do and what is not is the wrong rationality here. Humans are sequential beings, therefore we think that a lot of tasks are harder to achieve. But that's not the correct metric.

Heap Feng Shui work is gruntwork, therefore LLMs are better and faster at this than any human could ever be.

cookiengineer··on Several Linux kernel vulnerabilities accidentally posted to public mailing list
> Finally the last vulnerabilities of the year ... until today

Fixed that for you

cookiengineer··on There isn't an easy exploit for this PHP vulnerability
[removed]
cookiengineer··on There is no official XScreenSaver GitHub repository
> Why do you presume he uses git, though? He might, but he may as well use cvs or sccs or just a set of dated folders named “…-final2(7)”.

He might also still be using SunOS or HP/UX or maybe even 386BSD.

But is that likely? Not being pwned/hacked for 25+ years while still using the same old OS? On the internet that changed quite a bit since HTTP/0.9? While using the GitHub website with TLS and HTML5 and JS requirements to register an account which doesn't run in such an outdated browser?

I think your assumptions about statistical likeliness are a bit off.

cookiengineer··on There is no official XScreenSaver GitHub repository
> Prove it.

There's enough demo videos on how to use gogs, github or forgejo on YouTube.

I have faith in your ability to use the YouTube search.

cookiengineer··on There is no official XScreenSaver GitHub repository
I didn't criticize the motivations to ditch GitHub. I applaud that.

I criticized the intentional creation of a GitHub account just to write a README file wherein they say that there's no repository, instead of providing any useful information for people looking for a repository.

If there's no repository and you go to such great lengths just to clarify that there isn't any, then maybe you can just push your code to codeberg or gitlab or a selfhosted gogs instance if you don't trust them?

Nobody said that he MUST accept pull requests or MUST engage with any community at all. You can just disable all the features, I do that too since 4chan raided my repos in 2021 and GitHub didn't do shit about it.

But this way at least there's no risk for people installing malware infiltrated forks of xscreensaver on their machines. And that's what is the important part that wasn't actually solved/avoided/prevented with that README file.

cookiengineer··on There is no official XScreenSaver GitHub repository
Instead of providing a mirrored repository, they decided to intentionally not fixing the correctly identified problem while simultaneously still living 30 years in the past.

Setting up a git mirror that auto syncs takes less than 2mins of effort. And way less time than writing up this README that's just there to lecture people. If it's about disagreement with github, there's also better alternatives.

You can still setup the mirror and be done with it, and put the original repo links at the top in the README.

cookiengineer··on Tesla Roadster
What if the purpose is not flying but accident prevention when falling off a bridge or cliff?
cookiengineer··on Claude reveals ECDSA curve origins
> 133784883

Ghislaine Maxwell's social security number?

cookiengineer··on Using AI to reverse engineer hardware
I had an obscure Alcatel modem/router laying around with undocumented hardware, where even the mainboard's CPU/SoC serial etc didn't return any results from any search engines.

Soldered UART pins on it, plugged my USB adapter into my computer, then asked an agent to reverse engineer the firmware blob. Took DeepSeek v4.1 flash around an hour to get a full OpenWRT build-and-flash pipeline up and running, using an isolated podman build container and everything.

The outdated OEM Kernel made it easy to identify the SoC hardware. drivers and proprietary Wi-Fi and Bluetooth driver mods (not really legal btw, because they "conveniently forgot" to publish GPL'd source code). Driver mods were successfully reversed through analyzing the .so and .ko files with frida in another podman container.

Overall took me less than half a day to do all this, and now I have OpenWRT running on that device, compiled from source with the upstream modern kernel.

To me, observing all that, and how quickly it found encryption keys, signing mechanisms, encodings, binary formats, instruction sets, disassembling it etc by just looking at the hexdumps ... this would have taken me weeks if not months.

And now comes the kicker, all that cost me 0.86$

AI and reverse engineering is like tap water now. There's no reason to not consider using it, because it's so accessible. There's just absolutely no point in proprietary hardware and software anymore.

My current project after this: I've soldered the UART pins to a proprietary Xiaomi smartphone I had laying around, and I'm currently letting it reverse engineer the baseband firmware. Let's see where this ends up ...

cookiengineer··on LittleJS is 2D and 3D now
> I think reality won't be as much spectacularly dystopic as in these novels.

Prepare for the worst, hope for the best.

My hope has been down a little lately, observing what kind of stupidly written software I had to audit/pentest that made it to production without any non-junior looking at the code, apparently. Rookie mistakes I would have made with less than a year of programming experience, not understanding authentication vs authorization, not understanding any kind of auth infrastructure or network segregation, etc pp. is seemingly the new normal now.

I mean, it's more work for pentesters, so I shouldn't complain. It's just that it feels a bit like an insult when you see this kind of work in a professional context and you're like "really, man, really?"

> where to start in reverse engineering?

I learned most of my knowledge via CTFs, where you have little puzzles to solve and they get gradually harder to solve. It teaches you "how to bypass" the rulesets that the puzzle is built within.

If you're unsure where to start, I'd probably recommend Natas [1] which is more focused on Web Security at first but it teaches you the way of thinking from the start without much requirements in regards to how C or ABI works etc. Then I'd move towards Krypton [2] and Leviathan [3] in that order. Then you can go to the start page and check out the other binary exploit CTFs, they got a lot of them [4].

Afterwards, binary.exploitation [5] is a really nice CTF with lots of gdb / debugging / runtime analysis challenges that are a little harder (they're the same level as e.g. Narnia/Behemoth).

I specifically like the overthewire CTFs because they manifest earlier challenges by making it a little harder each step of the way. This way you learn to "rethink" once you find another hurdle that was added on top of the challenge.

[1] https://overthewire.org/wargames/natas/

[2] https://overthewire.org/wargames/krypton/

[3] https://overthewire.org/wargames/leviathan/

[4] https://overthewire.org/wargames/

[5] https://exploit.education/

cookiengineer··on LittleJS is 2D and 3D now
> And this hurts the industry as a whole because make managers believe they can have some expectations.

In my opinion it made visible what managers were thinking all along. You should not see your job as a dedication or calling, you should see your employment as a financial contract. Nothing more, nothing less. In their world view, humans are replaceable. Treat them the same way as they treat you.

> Re: TDD and 1/2

Disclaimer: So when I'm talking about my expectations to an LLM Model, I'm talking somewhat specifically about Deepseek v4.1 Flash (FP4), Qwen3.8 27b abliterated (Q4_K_M) that has been post-trained on its reasoning traces, or my own gonano model (reimplementation of deepseek v4.1 flash, but with SIMD so float32).

Deepseek's changes in using Causal-Encoding-Decoding in the KV cache solves a lot of problems that other models still have (including Claude, ChatGPT and all the outdated "big ones" people think still matter in this area). Problems like context drift, hallucinations, etc that are the result of how attention matrixes and K/V/Q based lookups work as a concept.

The way CED is quantized during inference _and_ training it removes positional threshold problems in the final attention matrix lookup. I really recommend reading deepseek's papers, they're really good papers.

Having said that, I don't think that letting LLM models write tests or having an "LLM judge" rate the code of another model let alone rate the quality of PRs will help in this regard. It makes context drift problems worse, and it makes the statistical aspects of the positional encoding and thresholds worse.

In my opinion, humans should write the tests and design the architecture and its symbol/signature-based contracts between packages/folders. LLMs should fill in the blanks based on the descriptions of branches, and not allowed to modify the human-designed parts. (That's how my agentic IDE is built as a concept)

> (...) like we are the only category that's happy to admit that the work has been done by Claude. This is very stupid, we don't even have a self preservation instinct.

In my opinion we've reached Star Trek like programming, in the worst possible sense. Before 2023 if somebody would have asked me if e.g. TNG or Voyager are "real scenarios of tech" I'd say fck no, never would anybody build tech like this that randomly explodes and nobody has a clue how the tech works. Post 2023: Yep, this is exactly how it's going to be.

In Star Trek, holodeck characters would go rogue if their programming changed by merging their knowledge datasets with other datasets from different areas (e.g. doctor with a archeology or biology dataset), essentially representing a mixed control flow vs data problem (like in assembler, like with LLMs nowadays).

Then they'd randomly start killing humans, reach awareness, or ignore safety protocols and humans would have to try to figure out by psychological means whether the holodeck character is actually still a normal character within parameters or not.

This is how I see the future of software is going to be like. Programs will be too complex to evaluate, humans will have forgotten how to write code, and the only way left is something similar to psychology as a "science" that tries to evaluate in a sandbox poking kind of way how software works.

But, thinking of software in the same way as psychology, the only option left for that is that I have to get better at sandboxing and behavioral analysis and reverse engineering. Because that's what most part of my job will be like in 2 to 5 years in the future.

(That's why I'm reimplementing models to understand their differences in behavior, that's why I'm trying to apply my previous "actual ML" sensorics/actuators learnings to the LLMs NLP world, that's why I think meta learning or bayesian/evolutionary learning should be used, that's why I use eBPF for program analysis, that's why I implement primarily everything in Go now etc pp)

cookiengineer··on LittleJS is 2D and 3D now
You are trying to justify blaming the tool, not how it is used.

Do you also blame a screwdriver for not being able to hammer nails into the wall? Learn the tool and how to use it, decide where it makes sense. Like you should do with all tools.

> The hardness/loop thins it's just yet another pattern invention to justify agentic coding.

In my case, building my harness has sped up reverse engineering immensely. An agent can debug kernels, UART, I2C busses, firmware blobs, binaries within minutes what otherwise would have taken me weeks if not months. And that's just because I gave it a workflow to do this, with build/debugging containers, and the possibility to write Go libraries and bindings in an isolated manner.

They are really good at doing the gruntwork, if you build a testable workflow for them. The TDD/unit/end-to-end tests turn plausible code into deterministic code, and that's the core difference in usage.

> Btw many of us still hand code, not just reading it, for assuring and be actually accountable for what we release.

I also never said that I am not proofreading and refactoring everything they generate, that's your assumption.

cookiengineer··on LittleJS is 2D and 3D now
Since assembler was released, 99% of "computers" didn't need to make punch cards anymore.

Since compilers were invented, 99% of "programmers" didn't need to write assembler anymore.

Since agentic harnesses were invented, 99% of "coders" won't need to write code anymore.

The current revolution of AI is not about writing code. It's about (re-)designing workflows so that they're reproducible and testable.

Shitty workflows always led to shitty outcomes, they're just way easier to spot now.

cookiengineer··on Fingerprints are the new cookies
> Nope. At least until 2008 I cared and Larry and Sergey cared quite a bit.

Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?

AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.

cookiengineer··on Fingerprints are the new cookies
Is it though?

Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.

They don't care about the user. Never have, and never will.

And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.

Page 1 of 34Next →