lcamtuf
lcamtuf is Michal Zalewski, a security researcher and author of AFL and p0f who also writes about machining, electronics and robotics.
What HN says
Commenters say his site holds hours of worthwhile reading on security, home machining and robotics, and recommend his blog, now partly on Substack.
Stats for nerds
306HN people shared it
131linked in comments
6.8Kstory points
Dec 2025last shared
Top posts on HN
- 1This JPEG is also a webpage7 people · 1.6K points · first shared 2012 · 226 comments on HN
- 2Doomsday planning for less crazy folk34 people · 992 points · first shared 2016 · 330 comments on HN
- 3Guerrilla guide to CNC machining, mold making, and resin casting25 people · 696 points · first shared 2012 · 74 comments on HN
- 4Concise Electronics for Geeks (2010)16 people · 676 points · first shared 2010 · 49 comments on HN
- 5My adventures in CNC robotics6 people · 406 points · first shared 2012 · 49 comments on HN
- 6The Tangled Web: A Guide to Securing Modern Web Applications (2011)9 people · 339 points · first shared 2011 · 46 comments on HN
- 7The Google plasma globe affair of 20124 people · 260 points · first shared 2022 · 99 comments on HN
- 8The hyperinflation gallery5 people · 258 points · first shared 2020 · 320 comments on HN
- 9Disaster planning for regular folks (2015)7 people · 257 points · first shared 2022 · 136 comments on HN
- 10American fuzzy lop – a security-oriented fuzzer80 people · 209 points · first shared 2014 · 25 comments on HN
What HN people wrote when they linked it
- viraptorFeb 2009
Books, articles... I'm afraid they're boring - they are cool to read if you're interested in the society, but that comes later on and you start to look for those things yourself. If he's interested in how things really work, then just make sure he knows the difference between exploration and breaking someone's work. The best learning material I have found are pages of people dealing with real security... stuff that you cannot find by googling "hacking".
That might both give him some new ideas, as well as show who is really considered important. For example, I always thought lcamtuf (http://lcamtuf.coredump.cx/) is a great example of a hacker of many skills (photography, network security, fuzzing, constructing robots with own 3d printer and many more random ideas). I guess you just don't have time to be a script kiddie if you have enough good ideas of your own...
Just make sure he finds securityfocus before he finds cDc :)
On the other hand you could let him know, that notifying the school officially about the security problem may be a bad idea. Typical teachers are as likely to say "thanks", as "OMG hacker! security audit to make sure you didn't change any data will cost X$/h - your parents are paying for it and you're suspended".
- fpgaminerMay 2023
The high margin makes sense if their account is mostly ordering low-volume. The margins on cut-tape, for example, are nuts. As a distributor they order in bulk at low per-unit pricing, and then when hobbyists buy onsies twosies they can charge low-volume pricing for a huge markup.
Doesn't mean they're making a lot of money on those types of orders.
(That isn't an argument against the author's complaints, just providing hopefully interesting info).
Off-topic: I clicked through to the author's Sir Box-a-Lot project (https://lcamtuf.coredump.cx/sir-box-a-lot/) and immediately fell in love with the micro rocker switch they used for the power switch. A 7mmx3mm rocker power switch. https://www.mouser.com/datasheet/2/295/GW-1663576.pdf What an absolute beaut.
- voodootruckerDec 2018
I'd love to know how to test graphics and audio programs, frankly.
TDD works very well for things with a defined input and output, including:
1. compilers
2. databases
3. all web apps (output is the DOM)In regards to the escape string, if there was a bug at exactly 15 characters, there must be a branch somewhere that isn't being hit, and it should be pretty easy using code coverage reports to find it, and generate the correct input sequence to exercise it.
When you get to fuzzing, you're hitting the edge of state-of-the-art. There is good research going on at automating some of that: http://lcamtuf.coredump.cx/afl/
- svieiraJan 2023
The fact of the matter is that what-a-resource-is includes the headers it is served with and the context in which it is requested. Consider https://lcamtuf.coredump.cx/squirrel/
It may not be normal in your day-to-day work, but it's definitely an important point of extensibility. Extensibility is indeed opposed to management (see _The Principle of Least Power_ for more on that front) but that is a trade off that worked really well for the web for decades. I for one would be really sad to see this further limited and would love for browser support for `Link` header behavior to increase rather than decrease.
- gebtJan 2021
This ability would be a big time saver during development.
I enjoy to develop without Googling; really enjoy!
I tried some other amazing things:
- developing without using touchpad or mouse.
- debugging without running code until the end.
- developing with turn offed WiFi.
In general, I'm always trying to reduce my needs.
I think this practices would help me to be more accurate, more independent, and become able to live in a post-apocalypse situation as a geek.
I said post-apocalypse, I remembered lcamtuf article "Disaster planning for less crazy folk": https://lcamtuf.coredump.cx/prep/
- jfoutzJun 2024
completely unrelated (pretty much)
But this is still one of my favorite parts of the internet - https://lcamtuf.coredump.cx/gcnc/ amazing, information dense guide to actually making stuff. I reached out once to the author, who was patient and kind.
I get through my days, I make stuff I do stuff, and I'm generally content with that. The author, lcamtuf, from my very limited interaction seems "extra". Maybe it really just is writing stuff down. Maybe I should do more of that.