HNHacker News
TopNewBestAskShowJobs

daeken

17,548 karma · joined March 21, 2008

Founder of DaeStar Emulation, previously of DigitalOcean, HackerOne, Optiv, Mozilla, Matasano Security, and a couple startups. My primary background is reverse-engineering, but my work is all over the board. My work has been featured in Forbes, H+ Magazine, Hacker Monthly (issue #10), EDN, and my mother's fridge. I've spoken at Defcon (2019), 44con (2019), and BlackHat (2012).

Nothing I say here is in any way representative of the views of my employer nor anyone else with whom I am affiliated.

My email is sera.brocious@gmail.com; feel free to contact me about anything, just include 'HN' in the subject, please.

I'm on HN Office Hours: http://hnofficehours.com/profile/daeken/

[ my public key: https://keybase.io/daeken; my proof: https://keybase.io/daeken/sigs/ci5oPW51-MaGySslf5iDROl1JIBimpAG596tsLH0Qi4 ]

submissionscomments
daeken··on Pentagon testing mass surveillance balloons across the US
Loon didn't supply the balloons, they just have a shared supplier.
daeken··on Devilution – A web port of the original Diablo game
I wasn't a Diablo cheater, but I was a Diablo 2 cheater. Frankly, it was what made the game playable for me; I wasn't cheating to dupe items or anything like that, but making the damn map functional. It was definitely a huge part of the staying power of the game, IMO.
daeken··on The Titanic Compared With a Modern Cruiseship (2014)
I just got back from my first cruise, which I was excited for but had no real idea of what to expect or whether I'd enjoy it. For context, I suffer from pretty extreme anxiety and seriously dislike crowds of people. I also have a 19-month-old, who came with us on the cruise. Here are my thoughts:

I cruised on the Disney Dream, one of their newest ships. Everywhere you looked, there was some awesome detail that you'd likely miss if you weren't paying attention. From the hidden Mickeys in the tiles of the bathrooms, to the way they laid out their private island (which only ever has one ship docked at a time) so as to minimize congestion.

There were only two times I felt it was crowded: the breakfast buffet and debarkation. The former could've been avoided by more clever design of the area, the latter could've been avoided by staggering the debarkation times rather than adding pressure to get you off the ship so that they could turn it around for the next cruise (which embarked that afternoon!)

I never felt pressured to go do anything. If I didn't want to go to dinner, I could just order room service, which was quick, 24 hours, and completely included in the ticket price. If I didn't really want to be off the boat, I could get back on at any time -- or just not get off at all. There were so many things that we could do if we wanted to, but didn't have to; I appreciated that.

Being disconnected from the interwebs for a week was amazing. I know I could get that from camping or somesuch, but there's something about being completely disconnected from the outside world but still having the luxuries of 2019 that speaks to me and my laziness.

The nursery was great. My daughter had never been in daycare or anything of the sort, so we were nervous about it, but she absolutely loved it. It was convenient and let my wife and I go have a nice date night onboard, kid-free.

Everyone bent over backwards to help in any way they could, and any request we had was taken seriously. Whether it was getting my daughter a hot dog each night at dinner (which wasn't on the menu, but they accomodated just fine -- since she wouldn't eat anything else), having our drinks ready for us as soon as we arrived, getting us ear plugs, or anything else that may have come up.

There were a million other little things that I (and my family) enjoyed about this, but suffice it to say, this will be at least an annual thing for us now; my wife and I are even talking about doing one cruise with the kid and one without, each year, just because we enjoyed it so much.

daeken··on The Titanic Compared With a Modern Cruiseship (2014)
I just got back from my first cruise, a 6-day on the Disney Dream. I couldn't help but keep thinking about how astounding the Titanic was at the time, and how tiny it is in comparison to the ship I was on. It was a genuinely incredible experience, but I can only imagine what it would be like to take a ship like that to the new world, to start a new life.
daeken··on 3D Wireframes Using SVG
The `Lightness' subproject under LumberSharp does (among many other things) this: https://github.com/daeken/LumberSharp

I built this out to translate 3d models or signed distance fields to SVGs for pen plotting purposes. You can see an example here, generated from a few lines of distance field code: https://scontent-atl3-1.cdninstagram.com/vp/9212f4c15cf30583...

And another generated from an STL I generated with OpenSCAD (part of an Egg sculpture series I did for 3d printing): https://scontent-atl3-1.cdninstagram.com/vp/d3fdf208c687551a...

daeken··on YouTube bans content “showing users how to bypass secure computer systems”
I'm super concerned about this. I head up hacker education at HackerOne and the biggest part of that is Hacker101, which hosts all its videos on YouTube. I have the master files and could host them elsewhere, of course, but there's huge value in discoverability, which YouTube completely owns compared to any other platform. Definitely something that I'm going to have to keep an eye on, and be ready to adapt to if they end up enforcing this.
daeken··on When Pepsi Had a Navy
I'm still bothered by this case. While I don't think that PepsiCo should've been forced to buy and then sell (for points) a Harrier jet, the fact that there were no consequences for the ad just kind of baffles me. If you look at any ad targeting youth markets from the time period, they had the same nonchalance; sure, they're not pitching a jet, but that just seems like a terrible argument.
daeken··on Emulator basics: a stack and register machine
It actually doesn't prefix all symbol names as such! The underscore prefix indicates the cdecl calling convention specifically; other calling conventions have their own name mangling schemes.

Edit: I had a nagging feeling that I was forgetting something, and I was. This is only a Windows convention, not a more universal thing.

daeken··on Genetically Engineered Wheat Found in Unplanted Washington Field
> I don't think asking for serious, regular, transparent, independant audit for decades is a bad thing.

You're right! It's a great thing, in fact. That's why there are over 3000 studies on GMO crops so far, with hundreds more happening each year.

Also, I'm a touch baffled by the mention of Terminator genes. 1) They've never existed. There's a patent on it, owned by a company who has pledged to never use it or allow any other company to do so. 2) It solves all the issues regarding drift, which is often a thing anti-GMO folks are concerned about. Never quite understood that.

daeken··on Genetically Engineered Wheat Found in Unplanted Washington Field
Seed irradiation hasn't yet been in use for 100 years -- the first commercial crop to use it was ~80 years ago -- but we consider it safe, despite that it consists of forcing completely random changes to occur. Why? Because we don't talk about the safety of the process; we talk about the safety of the result.

There's no way we can ever say "GMOs are safe" because it's like saying "crops grown during the 14th week of the year are safe". It's a technique, not a product.

daeken··on Genetically Engineered Wheat Found in Unplanted Washington Field
How do you figure it's self-safe? That implies that selectively bred crops can't be harmful, but that's nonsensical. Many selectively bred crops carry higher than natural carcinogen quantities, for instance (potatoes). And that's ignoring plants that are straight-up deadly.

And which category does seed irradiation fall into? If exposing seeds to high radiation in order to randomly mutate them is an acceptable "non-GMO" mechanism, clearly something is wrong.

daeken··on Genetically Engineered Wheat Found in Unplanted Washington Field
Literally everything you're talking about applies to selective breeding of crops as much as it does transgenic crops (what people typically mean by GMO). It applies even more so to irradiated seeds, which - strangely - no one seems to mind or want labels on.

Randomly changing millions of base pairs: good. Precisely cutting a gene from one crop and putting it in another: bad. Baffling.

daeken··on A man who ran out of air at the bottom of the ocean
> So if you're claiming that cryonics has "a snowball's chance in hell" of working, then I presume that either you are (1) ignorant of the science, or (2) making some sort of statement about long-term storage prospects or the credibility of the organizations involved.

I'm signed up to be a cryonics patient when I die, but yeah, the chances are pretty much nil. Personally, I'll take a slightly diminished bank account and a potentially non-zero percent chance of further life over a zero percent chance, but I won't delude myself into thinking that there's effectively any chance of success here.

daeken··on Police Post Racist and Violent Messages on Facebook, a Review Shows
No one is claiming it's a personality trait, though that absolutely could be a part of it. More likely, it's because police officers can act with impunity in pretty much every scenario. Add in a high-pressure job, and you've got a recipe for abuse.
daeken··on ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
Err no, no it's not. It's that there's been a ton more attention there. We're no more or less safe than we were before, we simply didn't know about the bugs that were there.

(FYI, I've been a security researcher for 15+ years and work as the head of hacker education for HackerOne; I am very, very pro disclosure. :) )

daeken··on ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
Before Spectre and Meltdown were disclosed publicly, very very few security researchers were looking at the CPU level, beyond things like attacks against hardware virtualization functionality, TrustZone and friends, ME, etc. Those bugs had existed for ages and could've been found through thorough examination of the processor manuals, but nobody had really looked too hard there. These new bugs were found independently by many different researchers/groups, simply because their attention was drawn to looking at this stuff for the first time.
daeken··on ZombieLoad: Cross Privilege-Boundary Data Leakage on Intel CPUs
Pandora's box was opened with the public disclosure of Spectre and Meltdown. Security researchers will continue to find new and better ways of attacking the security boundaries in processors, and there's unlikely to be an end to this any time soon. Exciting time to be in security, not such an exciting time to be a potential victim.
daeken··on C++ UI Libraries
It does, yeah. They don't distribute pre-built linux packages, but most distros do.
daeken··on People Are Clamoring to Buy Old Insulin Pumps
That, to me, is a pretty solid argument in support of the parent -- that deregulating medical devices will strongly benefit the scammers you mentioned, rather than benefiting patients desperate for something to help.
daeken··on MuseNet
I really, really want to see a live band or orchestra play a set of AI-composed pieces, none of which were filtered or manipulated by humans. Just generate MIDI, spit out sheet music (hopefully written well enough that it can be sight-read), and hope for the best. I'd buy a ticket for that, without a doubt!
daeken··on Why Do People with Depression Like Listening to Sad Music?
This is a tangent, but if you haven't listened to Lonely Avenue, the album that Ben Folds and Nick Hornby did together ... Do that.

Ever since I heard it, I can't see his name without the lyrics popping into my head: "Some guy on the net thinks I suck, and he should know: he's got his own blog"

daeken··on Beyond Meat S-1
I genuinely can't imagine an outcome where these don't become commonplace. Not going to predict that they're going to replace beef or anything, but it won't be weird to get a meat substitute burger from Wendy's or the like.
daeken··on Beyond Meat S-1
As a meat eater, I've had mixed results with Beyond Burger and the Impossible Burger. With real meat, it's pretty hard to mess up a burger; if it's anywhere from medium rare to medium well, it's still going to be a pretty tasty burger. The current burger substitutes require a much more narrow window before they just don't taste very good. That said, I'm extremely bullish on these; they're already great and they're only going to get better from here.
daeken··on We Don't Have a Talent Shortage. We Have a Sucker Shortage
At this point, I flat-out tell recruiters what I'm looking for and ask if they're going to be able to offer something in that ballpark before we proceed to an interview. I let them know that it'll be a hard no if it's below what I'm asking, regardless of stock/benefits/whatever. That's drastically cut down on the amount of time folks have wasted.
daeken··on Parsing short hexadecimal strings efficiently
I don't have the spare cycles to test this out for myself right now, but I'm curious if a 64kb table would be substantially faster. You'd cut it down from 8 indirections, 3 shifts, and 3 ORs to 4 indirections, 1 shift, and 1 OR.

    uint32_t hex_to_u32_lookup(const uint8_t *src) {
     uint16_t *wsrc = (uint16_t *) src;
     uint32_t v1 = digittoval[wsrc[0]];
     uint32_t v2 = digittoval[wsrc[1]];
     return v2 << 8 | v1;
    }
(Also, small note: The function is named `hex_to_u32_lookup` but it only gives a 16-bit result. Might want to clarify in the post.)
daeken··on Apple censors song about Tiananmen Square protests
Is there a way to see what else is accessible from the Chinese iTunes store? I'm curious if "Hypnotize" by System of a Down is accessible; the first line is "Why don't you ask the kids at Tienanmen Square?"
daeken··on Fortnite and the Good Life
I created a system to convert Windows binaries to native Linux/OS X binaries and wrote my own implementation of a ton of Win32 APIs. Never did get Oblivion running, but did run several other games, most notably Prey. Eventually pivoted to implementing DX10 for Linux/Mac/Windows XP (back when Vista was the only one with it), and then the company died a little while later for unrelated reasons. You can read a postmortem here: https://daeken.dev/blog/2009-12-27_Alky_Postmortem.html
daeken··on Fortnite and the Good Life
> It's rare to see a real impassioned defense of gaming outside of "it's not that bad" but I'd like to go out and say it had a hugely positive impact on my life and I think it's really doubtful I'd be where I am today without gaming.

I owe my entire career to gaming. Shadowrun on the Sega Genesis made me want to be a hacker, EverQuest hacking turned me from a mediocre (at best) web dev to a competent reverse-engineer, and my first serious startup came about because I wanted to play Oblivion on OS X. Every huge leap in my technical abilities came about because of games; I wouldn't be anywhere near where I am today without the pushes that these amazing works of art gave me.

daeken··on The Matrix Code Came from Sushi Recipes
I rewatch it about once a year, and it's amazing to me how well it's held up. Honestly, it's just a really well-made film from every angle; not perfect, but very solid.

The sequels don't hold up as well, graphically-speaking, but they are definitely better than most people give them credit for. Deeply, deeply flawed movies, but still enjoyable.

daeken··on PHP 8 to Add a JIT
That's not what serverless means. It means that your code isn't running on a specific server, and between requests it isn't in any kind of running state whatsoever. It's effectively in cold storage until it's needed, then it's pushed to a frontend/edge server and run. Serverless doesn't mean that there's no servers anywhere, but rather that you don't have a webserver or set of webservers that your code is on; it goes onto a webserver when it's needed, and not before.
← PreviousPage 6 of 34Next →