Cloudflare/Security-Audit-Skill
Cloudflare's security audit skill repository provides tools for assessing and improving security measures. It is hosted on GitHub and includes code, documentation, and community support. (github.com)
This write-up analyzes how item and building quality randomness introduced in the Space-Age DLC for Factorio is actually produced by a deterministic pseudo-random number generator and demonstrates that the RNG can be reverse-engineered and predicted. It explains that the game uses the taus88 generator (an XOR combination of three linear-feedback shift registers, LFSRs) from Boost.Random, and that because items’ quality outcomes are derived from this PRNG, knowing the algorithm and internal state allows exact prediction of future "random" events. A note clarifies that Factorio 2.1 changes RNG usage and breaks the author’s in-game implementations, but the underlying RNG algorithm remains the same so the theoretical analysis still applies.
The analysis traces the discovery from a forum hint by a developer to concrete confirmation: the author reimplemented both variants in Python, used symbolic manipulation with sympy to verify bitwise equivalence, and observed compiler-driven constant-folding in the optimized code. The write-up then explains LFSR mathematics - bit-vector representation over F2, linear feedback via XOR, modeling by polynomials, the importance of primitive feedback polynomials for maximal cycle length (2^n−1), and why LFSRs are linear and therefore trivially breakable. From these specifics the conclusion follows that the RNG’s linear structure enables reconstructing internal state from outputs and thus deterministic prediction and exploitation of in-game random mechanics.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Cloudflare's security audit skill repository provides tools for assessing and improving security measures. It is hosted on GitHub and includes code, documentation, and community support. (github.com)
Signing keys used to verify US driver's license barcodes can be recovered, which may undermine their security. The process of retrieving these cryptographic keys raises concerns about the integrity of license verification systems. (ryan.science)
An ex-Microsoft engineer explained the origin of the 'FCKGW' Windows XP product key, which became notorious among software pirates. The key was originally a placeholder or internal code before being widely used illegally by users. (pcgamer.com)
Pangram offers an AI detection tool that accurately identifies AI-generated text and images, trusted by universities and global brands. It uses natural language processing and pattern analysis to distinguish between human and AI content with over 99.9% accuracy, verified by third-party researchers. (pangram.com)
A cartel of tech CEOs is attempting to control AI development through safety measures and regulations, potentially hindering competition and innovation. Critics argue that such efforts could give established companies an unfair advantage while slowing progress on beneficial AI applications. (fractalsofchange.substack.com)
Flock cameras run outdated Android and Linux versions, leaving them vulnerable to numerous security flaws. Researchers found hard-coded credentials and unpatched vulnerabilities that could allow hackers to take control of the devices. (micahflee.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.