Jann Horn

@jann@infosec.exchange
2.3K Followers
142 Following
1,083 Posts

human borrow checker (but logic bugs are best bugs).
works at Google Project Zero.

The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.

homepagehttps://thejh.net

PNG is back!

https://www.programmax.net/articles/png-is-back/ (by Chris Blume)

A new PNG spec was just released! […]

[…] After 20 years of stagnation, PNG is back with renewed vigor!

What's new?

* Proper HDR support (future‐proof, too!)

* Finally recognizes APNGs (animations!)

* Officially supports Exif data

* General tidying up—fixing errata, clarifications, etc.

#png

If I had a nickel for every time I've written code to scrape webauthn challenges out of an IdP provider's Javascript so I can have a CLI-based login flow I'd have two nickels which isn't a lot but still: https://mjg59.dreamwidth.org/72688.html
Captcha Check

In 2021, hundreds of citizen scientists walked a distance of 600 km, counting up and classifying all of the outdoor lights they could see while they did it. The results of their observations have just been published in the journal Nature Cities: https://www.nature.com/articles/s44284-025-00239-5

Find out why they did it, and what they found out in this thread 👇

(1/)

#CitizenScience #LightPollution #OpenAccess #NighttimeLights #RemoteSensing #Nachtlichter

I'M SORRY SIR, BUT THAT IS NOT HOW RECEIPTS WORK
maybe I'm just too German but I don't think I'll ever get over the "Do you need a receipt?" - "Yes." - *hands me a blank receipt for me to fill out myself* interaction I've had with multiple cabbies in the last 15 years

coworker in meeting: did you read [document]?

me, panicking: uhhh ––

coworker: trick question. I was supposed to write it, but I didn't yet.

🤦‍♂️
"Ich wüsste ja zu gerne, was die ganzen Wasservögel den ganzen Tag schnattern!" - "Vergiss es, die haben Ente-zu-Ente-Verschlüsselung!"

Also the perfectionist's nightmare that is the selection of GPRs in AMD64 calling convention on Linux. The six integer arguments go in rdi-rsi-rdx-rcx-r8-r9.

memcpy's arguments are therefore dst:rdi, src:rsi, count:rdx.

Meanwhile, REP MOVSB takes rdi as destination, rsi as the source, and... rcx as the count.

ABIs are weird. If a function can accept six pointers on general-purpose registers, and eight floating-point arguments on FP registers, it should be able to return as many, dammit! Instead, we can't even return an integer and a float on separate registers simultaneously 😭