ktkaufman

Joined 4 years ago

Karma
224
Submissions
35
Member since
Sep 4
CompSci major in the class of 2025 @ Worcester Polytechnic Institute Contact: [email protected] Interested in both the theory and practice of software reverse engineering, and innovating ways of making it easier
View on Hacker News

Recent submissions

Comment · 8 days ago
I am painfully aware of what happened with key=4, being a sysadmin at a university that uses the InCommon certificate service (which gets certs through eMudhra). What I don't get is why Oracle have decided to be the first ones to remove all of the root CAs, on a Saturday afternoon no less. I couldn't find any other projects that have done the same thing. The G3 root and its vulnerable intermediates have been the ones in the crosshairs.
Comment · 8 days ago
There's a corresponding CVE: https://www.oracle.com/security-alerts/alert-cve-2026-114820...

I'm not sure if Oracle is trying to send a message here, but this seems like it could be quite disruptive...

Comment · 5 months ago
Canvas is open-source and can be self-hosted.
Comment · 1 year ago
TL;DR: it's in a gray area, but nobody with power actually cares (at least for now), so it's effectively fine.

As I understand it, Lego is aware of the project (there's been a significant increase in interest in Lego Island in the past few years, with attempts to obtain the original source code) and simply does not care. It's an ancient IP and can't realistically compete with anything new, at least not in a way that would significantly affect Lego's revenue. This is not unlike the way several other companies have acted when their respective older games have been given the same treatment; if a fan project is not actively causing problems (reputational, financial, etc.), most companies will just leave it alone. For companies that actually seem to care about public opinion (as opposed to, say, Nintendo), I think it's fair to assume that the bad optics of taking legal action against a random fan project, however legally justified it might be, far outweigh any possible benefits.

Comment · 1 year ago
I can tell you from firsthand experience that people - including people I have personally worked with at large organizations - have absolutely heard of Wiz. Yes, it is a relatively new player, but the people there have been putting out high quality research for years and have also demonstrated a very compelling approach to securing cloud environments. They get a lot of praise, and they've earned it.

Second, I have no idea what you're doing to get Wix results from a search for Wiz. When I search for Wiz, I get a whole bunch of results about Wiz, including links to discussion threads where random people (i.e., not high-rep HN users) also talk about how much they like the product.

Finally, something to consider: would Google actually pay $32B for a company that "nobody has heard of" and doesn't provide any value? Probably not. I would hope not.

Comment · 3 years ago
https://ktkaufman03.github.io/

I don't post a lot, but when I do, I try to make it interesting. So far I've covered:

- a creative use of Rust's type system (https://ktkaufman03.github.io/blog/2023/04/20/rust-compile-t...)

- taking a deep dive into some obscure, closed-source scanner drivers, and ultimately creating new ones (https://ktkaufman03.github.io/blog/2022/09/04/pakon-reverse-...)

I do have some more posts planned for the not-so-distant future, which I think will be interesting!

If for some reason you want to subscribe, I have an RSS feed set up: https://ktkaufman03.github.io/feed.xml

Comment · 3 years ago
I was annoyed by having to write the same boilerplate code over and over again to handle "failures" that would never actually occur, so I took matters into my own hands and came up with what I think is a pretty elegant (if slightly complicated) solution. As it turns out, the architecture of this solution can be applied to other issues!
Comment · 3 years ago
Location: Worcester, MA

Remote: Yes, potentially open to hybrid

Willing to relocate: No

Technologies: C#, C/C++, Java, Rust, Python, Go

Résumé/CV: Available on request

Email: ktkaufman AT wpi DOT edu, include "HN February 2023" in the subject line

LinkedIn & GitHub: https://www.linkedin.com/in/kai-kaufman & https://github.com/ktkaufman03

I am a college sophomore studying cybersecurity with several years of practical experience in software reverse engineering, malware analysis and the automation of binary analysis tasks. I am also familiar with computer forensics tools such as Volatility. Some of my past projects include reverse engineering, fixing and updating legacy scanner drivers [1] as well as writing deobfuscators to handle software in various languages. While I was in high school, I uncovered and reported vulnerabilities in various ed-tech software packages.

I am looking for an internship in the cybersecurity field, ideally in a role that involves software reverse engineering. I'm open to other roles as well, including penetration testing work. If you think we'd be a good match, please do reach out!

[1] Reviving the Pakon film scanner: https://news.ycombinator.com/item?id=32714806

Comment · 3 years ago
Location: Worcester, MA

Remote: Yes, potentially open to hybrid

Willing to relocate: No

Technologies: C#, C/C++, Java, Rust, Python, Go

Résumé/CV: Available on request

Email: [email protected]

LinkedIn & GitHub: https://www.linkedin.com/in/kai-kaufman & https://github.com/ktkaufman03

I am a college sophomore studying cybersecurity with several years of practical experience in software reverse engineering, malware analysis and the automation of binary analysis tasks. I am also familiar with computer forensics tools such as Volatility. Some of my past projects include reverse engineering, fixing and updating legacy scanner drivers [1] as well as writing deobfuscators to handle software in various languages. While I was in high school, I uncovered and reported vulnerabilities in various ed-tech software packages.

I am looking for an internship in the cybersecurity field, ideally in a role that involves software reverse engineering. I'm open to other roles as well, including penetration testing work. If you think we'd be a good match, please do reach out!

[1] Reviving the Pakon film scanner: https://news.ycombinator.com/item?id=32714806

Comment · 4 years ago
The way the scanner deals with dust is by complaining that there's dust :-) (It doesn't have a special dust error, AFAIK, but it does do some checks that will end up failing if too much dust has accumulated.)

The way to avoid dust accumulation is to keep it covered when it's not being used. That works nicely and is a reasonable thing to do anyway.

Comment · 4 years ago
In theory it's unnecessary. The problem is that one of the main selling points of the Pakon is its convenience - then again, if somebody wants to do things the hard way, who am I to stop them?

I don't have any plans to develop a cross-platform client, but I will be publishing more technical information about the scanner so people aren't left wondering what I know.

Comment · 4 years ago
I had help, but yes. I think it's worth the cost to give people peace of mind that they won't have to disable some of the most important security features available to them in order to use a scanner.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton