Hacker News Reader

transputeon Notes by djb on using Fil-C

Thanks for the subthread discussion links, e.g. authors of LuaJIT and Fil-C, https://news.ycombinator.com/item?id=40556083 (June 2024)

transputeon Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update

Article written by iVerify for their customers, who pay a monthly fee for automated forensic analysis of iOS logs.

transputeon Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update

e.g. zero day CVE-2024-44243, patched last year, https://www.microsoft.com/en-us/security/blog/2025/01/13/ana...

transputeon Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update

Trusted high-privilege components, whether first or third party, are targeted for exploitation.

transputeon Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update

This change was not present in iOS26 betas, hopefully Apple will fix soon, https://www.youtube.com/watch?v=PHijS6jLPxI&t=304s

> If you care about your iOS device security.. reboot every day.. writes a list of running processes to this shutdown.log file.. If you have processes that shouldn't be running, they will get written to this shutdown.log file.. allows you to go back in time and check for IOCs.

transputeon Asahi Linux Still Working on Apple M3 Support, M1n1 Bootloader Going Rust

Is it theoretically feasible for Apple Silicon M3 (with nested hypervisor support) to run pKVM as bare-metal hypervisor?

transputeon Asahi Linux Still Working on Apple M3 Support, M1n1 Bootloader Going Rust

> an option for Macs but not iPad Pros

PTSD can block lights in tunnels.

2024: UTM SE entered iOS App Store, https://www.tomshardware.com/phones/iphone/utm-se-emulator-r...

  The team implemented a version of the Qemu Tiny-Code Threaded Interpreter (TCTI). Qemu TCTI interprets the code rather than compiling it, allowing Turing Software to get around the JIT ban. Mind you, this results in a rather slow experience even by the standards of the emulated hardware.

2025: https://9to5mac.com/2025/05/01/jit-enabler-lands-on-app-stor...

  StikDebug enables on-device JIT for any app, making it possible to run DolphiniOS without sideloading or tethering to a PC or Mac.. approved in the U.S. App Store.

Sep 2025: sideloaded UTM supports JIT on iOS26 with StikDebug, https://x.com/utmapp/status/1967990008364798091

transputeon Asahi Linux Still Working on Apple M3 Support, M1n1 Bootloader Going Rust

> Apple explicitly designed in support for booting other operating systems into the M-series chips

Thank Xeno, who has since been creating open-source training on low-level firmware security at https://p.ost2.fyi, a new iteration of open training material published ~15 years ago at https://opensecuritytraining.info before joining Apple.

https://archive.fosdem.org/2022/schedule/speaker/xeno_kovah/

  his final project was leading the M1 SecureBoot architecture - being directly responsible for designing a system that could provide iOS-level security, while still allowing customer choice to trust arbitrary non-Apple code such as Linux bootloaders.

transputeon Show HN: Tommy – Turn ESP32 devices into through-wall motion sensors

> Wi-Fi sensing as a broader technology could theoretically be used for surveillance if someone controlled devices on both sides of your walls.

Wi-Fi sensing is passive, i.e. only one side of the wall is needed.

https://news.ycombinator.com/item?id=45488908#45546394

transputeon Show HN: Tommy – Turn ESP32 devices into through-wall motion sensors

IEEE consumer standard (WiFi 7 and 802.11bf) is new, military use began 15 years ago, https://news.ycombinator.com/item?id=44426726#44427986

transputeon Show HN: Tommy – Turn ESP32 devices into through-wall motion sensors

"ESP32 CSI Toolkit", papers+code, Virginia Commonwealth University, USA https://stevenmhernandez.github.io/ESP32-CSI-Tool/

"Wi-ESP", papers+code, KITS WRL, South Korea, https://wrlab.github.io/Wi-ESP/

"Espressif CSI sample applications", Shanghai, China, https://github.com/espressif/esp-csi

"CSI-MURDER", paper+code, WiFi Sensing countermeasures, EU, https://ans.unibs.it/projects/csi-murder/

transputeon Show HN: Tommy – Turn ESP32 devices into through-wall motion sensors

> no one cares about the privacy concerns

Even if IEEE doesn't care, someone famous will eventually learn that the walls of their mansion are transparent to passive WiFi receivers with cantennas, even if they turn off all WiFi devices inside their home. Will they build a new mansion with RF-shielded walls? Try to find someone who cares?

transputeon Power over Ethernet (PoE) basics and beyond

MACsec, https://forum.openwrt.org/t/macsec-802-1ae-with-802-1x-eapol...

transputeon RF Shielding History: When the FCC Cracked Down on Computers

One workaround is conductive mesh (metal/fabric) over the window interior, bridged to bare metal of the case interior.

transputeon RF Shielding History: When the FCC Cracked Down on Computers

> computer builds that don't have any metal case at all

Would be nice to have more metal cases for SBCs, like the one on R4S, https://www.androidpimp.com/embedded/nanopi-r4s-review

KKSB makes metal cases for some SBCs, https://kksb-cases.com

transputeon RF Shielding History: When the FCC Cracked Down on Computers

"Using Deep Learning to Eavesdrop on HDMI from its Unintended Electromagnetic Emanations" (2024), https://news.ycombinator.com/item?id=41116682

"Tempest-LoRa: Cross-Technology Covert Communication via HDMI RF Emissions", https://news.ycombinator.com/item?id=44483262

transputeon ChkTag: x86 Memory Safety

https://vimeo.com/252868605

transputeon ChkTag: x86 Memory Safety

Is there a comparison of memory tagging designs for different architectures (POWER, SPARC, CHERI/Morello, Arm MTE/eMTE, Apple MIE, x86, RISC-V)? e.g. enforcement role of compiler vs. hardware, opt-in vs mandatory, hardware isolation of memory tags, performance impact, level of OS integration?

transputeon RMPocalypse: Breaking AMD Confidential Computing with a Single Write

The hypervisor is typically controlled by the infrastructure operator.

If the infrastructure operator is untrusted, as in some models of confidential computing, then hypervisor replacements are both easy and an expected threat.

transputeon RMPocalypse: Breaking AMD Confidential Computing with a Single Write

https://en.wikipedia.org/wiki/Confidential_computing

  The following threat vectors are generally considered in scope for confidential computing: Software attacks: including attacks on the host’s software and firmware. This may include the operating system, hypervisor, BIOS, other software and workloads.

transputeon Wi-fi signal tracks heartbeat without wearables

14 years ago (2011), https://news.mit.edu/2011/ll-seeing-through-walls-1018

transputeon Wi-fi signal tracks heartbeat without wearables

"Xfinity using WiFi signals in your house to detect motion", 500 comments, https://news.ycombinator.com/item?id=44426726#44427986

transputeon Wi-fi signal tracks heartbeat without wearables

Grounded radiant barrier (matte white vinyl with aluminum on reverse side) in 48" rolls will block wifi and temperature for $0.25 per sq ft.

2023, https://www.policemag.com/technology/article/15541542/first-...

> “Once you place it against the wall, it takes one scan to show you where everything is, then over time anything that moves will pop up.. It can detect someone moving through the room or someone sitting on the couch and breathing. The small movements of breathing are enough for the radar to discriminate between the couch and the person.”

2015, https://www.usatoday.com/story/news/2015/01/19/police-radar-...'

> At least 50 U.S. law enforcement agencies have secretly equipped their officers with radar devices that allow them to effectively peer through the walls of houses to see whether anyone is inside.. The radars were first designed for use in Iraq and Afghanistan. They represent the latest example of battlefield technology finding its way home to civilian policing and bringing complex legal questions with it.

transputeon Wi-fi signal tracks heartbeat without wearables

> your laptops/Homes to detect your biometrics

Intel laptop demo (shipping since 2023), https://news.ycombinator.com/item?id=45127983#45130061

transputeon Google to merge Android and ChromeOS in 2026

News for hackers: Google Pixel Developer Terminal VM on Android and GrapheneOS provides 50K+ open-source software packages signed by the Debian package maintainers who are trusted as the upstream "root distro" for Ubuntu, Devuan and other Linux distributions. Use of individual Debian Linux software packages on Android phones does not depend on App Store identity registration, financial payment or Google Play Services telemetry.

Thanks to SoC CPU/memory virtualization at the VM boundary, there is stronger isolation between Debian software packages and the rest of the device, than between any two Android software packages distributed by App Store, which are executing within a single VM context. This protects the device from side effects of Debian Linux software in the Developer Terminal VM.

This is more safe and more secure than status quo.

> doable, but dangerous

Incorrect. It is more isolated, less dangerous, more secure, more flexible for developers and increases functionality to users.

transputeon Google to merge Android and ChromeOS in 2026

Qualcomm Arm PCs support hardware nested virtualization for pKVM L0 and KVM L1 hypervisor, similar to Pixel devices. This could enable Debian Linux in a VM, currently available on Pixel as "Linux Terminal" for developers, with all Debian Arm packages and root access in the VM.

"Terminal app can now run full graphical Linux apps in the latest Android Canary", https://news.ycombinator.com/item?id=44681858

"Coding without a laptop: Two weeks with AR glasses and Linux on Android", https://news.ycombinator.com/item?id=43985513

transputeon VMScape and why Xen dodged it

On HP business PCs, Xen's microkernel architecture was extended for copy-on-write nested virtualization microVMs (VM per browser tab or HTTP connection) and UEFI-in-VM, https://www.platformsecuritysummit.com/2018/speaker/pratt/ | https://news.ycombinator.com/item?id=42282053#42286147

Imminent unification of Android and ChromeOS will likely use a similar h/w nested-virt architecture based on L0 pKVM + L1 KVM hypervisors on Arm devices.

Honda is using Xen, "How to accelerate Software Defined Vehicle" (2025), https://static.sched.com/hosted_files/xensummit2025/93/HowTo...

transputeon Supermicro server motherboards can be infected with unremovable malware

OpenCompute (OCP) Caliptra is an effort by hyperscalers, AMD and others to enforce a platform root of trust with OSS firmware and open silicon, mandating dual signature by server OEM and hyperscaler customer. The platform RoT is responsible for validating device firmware and OS boot, https://www.youtube.com/watch?v=p9PlCm4tLb8&t=2764s

> Often we see.. great security.. compromised by other great ideas for mgmt and other things.. starts to weaken its security posture.. want to keep Caliptra very clean [via OSS firmware transparency]

transputeon Supermicro server motherboards can be infected with unremovable malware

With some server vendors, if you don't connect an ethernet cable to the BMC, it can intercept BMC-targeted traffic from the OS-connected ethernet port.

transputeon Things you can do with a Software Defined Radio (2024)

  remotely read a nearby screen

"Eavesdrop on HDMI from Unintended Electromagnetic Emanations with GNU Radio" (2024 paper), https://github.com/emidan19/deep-tempest

Displaying malicious image causes HDMI cable to emit LoRa packets, https://github.com/XieyangSun/TEMPEST-LoRa

  passive radar

"Build a passive radar with software-defined radio" (2022), https://hn.algolia.com/?query=passive%20radar

SEC-T 0x11 (2025) on evil maid defense, https://www.youtube.com/watch?v=ScwNIWzk4RQ

> Do you like feeling safe about leaving your expensive stuff in your hotel room? Have you ever had anything stolen out of your room, or discovered someone has gained access to your room while you weren't there? .. what about .. other rooms? Maybe not EXACTLY a hotel room? I've presented on securing hotel rooms in the past, but adding home assistant, zwave devices, co2 sensors and millimeter wave radar it's become a whole new game

  SDR is amazing!

Video tutorial series with book references, https://gallicchio.github.io/learnSDR/:

> We use the GNURadio software along with RTL-SDR and ADALM-PLUTO hardware to explore the world of digital communication. We build up to a simple QPSK modem and rudimentary GPS reception.

LibreSDR firmware, https://github.com/F5OEO/tezuka_fw

> official [PlutoSDR] firmware updates are no longer focus on new features for SDR enthusiastic people.. tezuka.. aims to be Universal Zynq/AD9363 firmware builder for.. PlutoSDR, Pluto+, AntSDR (e200), LibreSDR