D
Daeken
daeken.com · Personal blog · on HN since 2009
Cody Brocious (Daeken), a security researcher and hacker, writes on hardware hacking, web security, crypto flaws, and JavaScript demos.
What HN saysCommenters call his web security primer quite good and cite him for JS demo packing, HMAC canonicalization bugs, and an essay on global progress.
21HN people shared it
16linked it in comments
32stories submitted
1.8Kstory points
11 years agolast shared
2009people per year2026
Most-shared posts
- 1Renraku: Future OS7 people · 46 points · first shared 2009 · 31 comments on HN
- 2Superpacking JS Demos5 people · 63 points · first shared 2011 · 11 comments on HN
- 3The Hardware Hacker Manifesto3 people · 135 points · first shared 2010 · 29 comments on HN
- 4So You Want To Be A Breaker, Part 1: Web Security2 people · 261 points · first shared 2013 · 83 comments on HN
- 5Confusing Crypto Blobs2 people · 102 points · first shared 2012 · 40 comments on HN
- 6Daeken's Blackhat paper on the security flaws in Onity locks2 people · 31 points · first shared 2012 · 3 comments on HN
- 7Tell HN: Daeken Discount Program2 people · 26 points · first shared 2010 · 18 comments on HN
- 8Hacking the Emotiv EEG headset2 people · 1 points · first shared 2010 · discussion on HN
- 9Emokit hacking the emotiv epoc brain computer 02 people · first shared 2010
- 10Breaker 101: An intensive online web security course1 people · 286 points · first shared 2013 · 112 comments on HN
- 11Further Freedom Attacks1 people · 191 points · first shared 2010 · 64 comments on HN
- 12Show HN: Super simple static blog generator, Benjen1 people · 90 points · first shared 2013 · 45 comments on HN
- 13Onity's plan to mitigate hotel lock hack1 people · 62 points · first shared 2012 · 16 comments on HN
- 14Responsible Disclosure Can Be Anything But1 people · 60 points · first shared 2012 · 35 comments on HN
- 15Injecting Arbitrary Python Into EVE Online1 people · 57 points · first shared 2009 · 18 comments on HN
What HN people wrote when they linked it
daeken · 2013-03-14
I used 960gs for the first time last night, to build the template for http://daeken.com/ (had to finally switch from Posterous). It was amazingly simple, even for someone completely CSS brain-dead. Really can't say enough good things about it.
asselinpaul · 2013-05-26
This is quite good (only concerns Web security but worth a read).
http://daeken.com/2013-03-17_So_You_Want_To_Be_A_Breaker__Pt__1__Web_S…
jjarmoc · 2015-04-04
I first learned about this technique from Cody Brocious' post (http://daeken.com/superpacking-js-demos) about his WebGL demo 'Magister' (http://demoseen.com/windowpane/magister.html). That file has a .html extension, but it's also a valid PNG. In his post, he discusses this technique as well as others.
Cody's goal was to compress already minified WebGL code and achieve some pretty impressive results from a ridiculously small file for a demo contest. He also put the JS loader (which is much smaller than the linked decoder) in a custom chunk on the PNG itself. By doing it that way, you can have a PNG that when renamed also contains a web page and/or more Javascript.
It's an interesting technique, for sure, but I've never been able to find a real use for it beyond the compression. With a content-type sniffing vulnerability or something, it could be an interesting way to deliver content to browsers, but otherwise it's really just a curiosity as best I can tell.
agwa · 2015-05-23
Here are some examples of HMAC canonicalization vulnerabilities:
http://www.daemonology.net/blog/2008-12-18-AWS-signature-version-1-is-…
http://daeken.com/confusing-crypto-blobs
knowaveragejoe · 2014-11-13
Actually, the statistics today are largely better than at any point in history we have statistics for.
Here's a nice aggregate:
http://daeken.com/2014-04-16_Spoiler__The_World_Isn_t_On_Fire.html
There is a shitload of good things going on in the world. You just have to pull your head out of the negativity echochamber present in a lot of Internet communities, most notably parts of reddit.
rsxzi · 2014-02-06
This technique has been around since prior to 2008 at least, the biog entry below introduced the code[1], along with providing a tool to compress your js into an image using ruby [2].
The technique has a legitimate use as a suave compression method and was termed "super packing" in 2011 [3]
[1]http://blog.nihilogic.dk/2008/08/imageinfo-reading-image-metadata-with…
[2]http://www.nihilogic.dk/labs/canvascompress/
[3]http://daeken.com/superpacking-js-demos
ygra · 2013-09-27
You mean like this?
http://demoseen.com/windowpane/magister.png.html
(I'm not the creator, I just happen to share an IRC channel with them.) There is a description of how it works at http://daeken.com/superpacking-js-demos
qu4z-2 · 2013-08-13
That reminds me of this (from HN a while back):
http://daeken.com/superpacking-js-demos
An html/png hybrid (among other hacks)
blasdel · 2011-05-27
HN user daeken has been writing an OS in .NET http://daeken.com/renraku-future-os
Xuzz · 2011-01-12
Incredibly relevant: Daeken's Hardware Hacker Manifesto: http://daeken.com/the-hardware-hacker-manifesto
Sony probably has the upper hand legally here. The DMCA seems to be pretty explicit about these kind of this, at least from my non-lawyerly reading of it. Even so, this is quite unprecedented. Apple and Nintendo have both had devices hacked, often by these same people (there's at least two iPhone Dev-Team members there, four members of Team Twiizers, and, of course, geohot), but they never took any kind of legal action.
(Somewhat unrelated, but funny: even Nintendo found out "bushing"'s real name and phone number. I wonder why Sony didn't go through that trouble and referred to him pseudonymously.)
logic · 2010-09-21
Emokit project announcement that led to this post: http://daeken.com/emokit-hacking-the-emotiv-epoc-brain-computer-0
Discussion thread on Emotiv's forums relating to Cody's Emokit project: http://www.emotiv.com/forum/forum15/topic879/
utku_karatas2 · 2010-01-25
Nice try, Mr. Renraku :-) (http://daeken.com/renraku-future-os)
shadytrees · 2010-01-24
Renraku is an operating system. More information here: http://daeken.com/renraku-future-os
scott_s · 2009-08-07
http://daeken.com/renraku-future-os
(So others don't have to go hunting for it like I did.)
chanux · 2009-07-05
Why I see people talking about OSes a written in high level languages a lot lately?
Remember the C# one came on HN? http://daeken.com/renraku-future-os
I think an OS written in an OO language will demonstrate why some people were actually worried about OOP. http://www.geocities.com/tablizer/oopbad.htm
alnayyir · 2011-04-05
There's a difference between a flake, and moving between things that obviously aren't going to work.
Nothing ever gets shipped from him, nothing failed quickly to begin with. ( I don't just mean Alky, either. )
Stop parroting community tropes.
Examples:
Alky
http://daeken.com/daeken-discount-program
https://github.com/daeken/RenrakuOS - 2010
https://github.com/daeken/EveInject - 2009
Quote from his blog:
"""
What have you built and what are you building?
Product-wise, I haven't built much; the biggest thing I've built was Alky, which allowed the conversion of Win32 binaries to run natively on OS X and Linux. It was a marginal success, although it ended up failing later for business reasons.
These days, I'm working on a few things:
Renraku: http://daeken.com/renraku-future-os This will eventually be combined with OpenBAMF/IREctive: Reverse-engineering platform and module store (My primary for-profit project right now)
Books
The Emulator's Handbook: A book on building an emulator from start to finish. There's simply nothing there yet, which is a damn shame -- we need to get people involved here.
So far unnamed: A book on reverse-engineering game protocols and emulating them.
In the future, I'd like to be developing and selling Eyetaps and other hardware around Renraku.
"""
This isn't fail-fast, it's ship-nothing. It only bothers me because he keeps attention-whoring for every little idea he gets and ends up disappointing anybody who thought it was cool.