frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Marshal madness: A brief history of Ruby deserialization exploits

https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-exploits/
19•pentestercrab•4d ago

Comments

Alifatisk•3h ago
Does Marshal dumps work across different computers or is it only compitable with the same computer that dumped the Marshal?
mook•2h ago
I very vaguely recall that the format works across machines (and it was used in old versions of RPGMaker)? Looks like it's actually documented now, since https://docs.ruby-lang.org/en/2.1.0/marshal_rdoc.html has a description.
zoky•33m ago
As a general rule they will work anywhere, as long as the major version of the Marshal format is the same, and this hasn’t changed since Ruby 1.8. I expect if it ever did change (I can’t see any reason for it to ever do so though) there would probably be some sort of backwards compatibility available, as the Ruby community really hates making breaking changes between language versions, especially without offering some kind of relatively easy solution for making older code work.
kayodelycaon•37m ago
I thought Marshal and non-safe yaml are fundamentally unsafe. You’re allowing input to instantiate arbitrary objects. It’s relatively easy to find an exploitable class.

Python’s pickle function is equivalent and has a warning about this.

A German ISP tampered with their DNS – specifically to sabotage my website

https://lina.sh/blog/telefonica-sabotages-me
279•shaunpud•2h ago•152 comments

Show HN: Clearcam – Add AI Object Detection to Your IP CCTV Cameras in a Minute

https://github.com/roryclear/clearcam
12•clearcam•1h ago•7 comments

Spending Too Much Time at Airports

https://thezvi.substack.com/p/spending-too-much-time-at-airports
11•nsoonhui•1h ago•14 comments

Dynamically patch a Python function's source code at runtime

https://ericmjl.github.io/blog/2025/8/23/wicked-python-trickery-dynamically-patch-a-python-functi...
5•apwheele•24m ago•1 comments

How to build a coding agent

https://ghuntley.com/agent/
252•ghuntley•9h ago•84 comments

Seed: Interactive software environment based on Common Lisp

https://github.com/phantomics/seed
45•todsacerdoti•5h ago•7 comments

Turning Claude Code into My Best Design Partner

https://betweentheprompts.com/design-partner/
113•scastiel•4h ago•59 comments

The oldest unopened bottle of wine in the world

https://www.openculture.com/2025/08/the-oldest-unopened-bottle-of-wine-in-the-world.html
22•bookofjoe•2d ago•11 comments

Wildthing – A model trained on role-reversed ChatGPT conversations

https://youaretheassistantnow.com/
56•iamwil•7h ago•26 comments

Show HN: Bicyclopedia

https://bicyclopedia.lemoing.ca/
4•lemoing•1h ago•0 comments

Setting serial baud rate on ESP-IDF does nothing

https://atomic14.substack.com/p/this-number-does-nothing
22•iamflimflam1•20h ago•20 comments

Line scan camera image processing for train photography

https://daniel.lawrence.lu/blog/y2025m09d21/
358•dllu•20h ago•63 comments

The cost of interrupted work (2023)

https://blog.oberien.de/2023/11/05/23-minutes-15-seconds.html
206•_vaporwave_•15h ago•121 comments

ThinkMesh: A Python lib for parallel thinking in LLMs

https://github.com/martianlantern/ThinkMesh
34•martianlantern•8h ago•4 comments

Valve Software handbook for new employees [pdf] (2012)

https://cdn.akamai.steamstatic.com/apps/valve/Valve_NewEmployeeHandbook.pdf
127•Michelangelo11•4h ago•94 comments

How can AI ID a cat?

https://www.quantamagazine.org/how-can-ai-id-a-cat-an-illustrated-guide-20250430/
151•sonabinu•3d ago•47 comments

A Family Project (2022)

https://bittersoutherner.com/feature/2022/a-family-project
7•NaOH•1d ago•1 comments

SSD-IQ: Uncovering the Hidden Side of SSD Performance [pdf]

https://www.vldb.org/pvldb/vol18/p4295-haas.pdf
4•jandrewrogers•1d ago•0 comments

What makes Claude Code so damn good

https://minusx.ai/blog/decoding-claude-code/
346•samuelstros•17h ago•242 comments

Show HN: Port Kill – A lightweight macOS status bar development port monitor

https://github.com/kagehq/port-kill
73•lexokoh•9h ago•27 comments

ICE Uses Celebrity Loophole to Hide Deportation Flights

https://jacobin.com/2025/08/ice-uses-celebrities-loophole-to-hide-deportation-flights/
4•JKCalhoun•12m ago•1 comments

Physics of badminton's new killer spin serve

https://arstechnica.com/science/2025/08/physics-of-badmintons-new-killer-spin-serve/
89•amichail•4d ago•12 comments

A 2k-year-old sun hat worn by a Roman soldier in Egypt

https://www.smithsonianmag.com/smart-news/a-2000-year-old-sun-hat-worn-by-a-roman-soldier-in-egyp...
146•sensiquest•17h ago•36 comments

Rolling the dice with CSS random()

https://webkit.org/blog/17285/rolling-the-dice-with-css-random/
109•zdw•2d ago•17 comments

Why was Apache Kafka created?

https://bigdata.2minutestreaming.com/p/why-was-apache-kafka-created
151•enether•1d ago•141 comments

Programming People (2016)

https://leftoversalad.com/c/015_programmingpeople/
57•saulpw•9h ago•14 comments

Marshal madness: A brief history of Ruby deserialization exploits

https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-e...
19•pentestercrab•4d ago•4 comments

Equal Earth – Political Wall Map (2018)

https://equal-earth.com/index.html
50•bjelkeman-again•6h ago•36 comments

Evaluating LLMs for my personal use case

https://darkcoding.net/software/personal-ai-evals-aug-2025/
74•goranmoomin•12h ago•22 comments

Acronis True Image costs performance when not used

https://randomascii.wordpress.com/2025/05/26/acronis-true-image-costs-performance-when-not-used/
125•juanviera23•4d ago•30 comments