Forwarded from Foresight News
【Zilliqa Ledger 应用存在随机数生成漏洞，签署 5 笔及以上原生交易的账户或被攻破】
Foresight News 消息，Zilliqa 发文披露其 Ledger 应用存在严重漏洞，影响原生（非 EVM）Zilliqa 交易的 Schnorr 签名生成。该漏洞存在于 2019 年至 2026 年间发布的所有版本 Zilliqa Ledger 应用中，7 月 19 日发现链上疑似主动利用迹象，7 月 21 日确认根因。该漏洞导致签名时使用的临时随机数（nonce）可被预测，攻击者仅凭链上公开数据即可还原签名者私钥。Zilliqa 提醒，曾使用 Ledger 设备签署原生 Zilliqa 交易的用户应等待官方指引，暂勿采取任何独立行动。漏洞根因在于签名程序在将随机数写入缓冲区时复制了错误的字节范围，导致每个生成的随机数最高 64 位固定为零，熵值严重不足。利用 5 笔或以上受影响签名，攻击者可通过 lattice reduction 在数秒内还原私钥。由于受影响交易已永久记录在链上，更新签名应用无法逆转此风险，相关私钥必须废弃。目前原生交易已暂停以防止进一步损失，协调修复方案正在最终确认中。EVM 交易及 zilliqa-js、gozilliqa-sdk、pyzil 等 SDK 不受影响。
https://foresightnews.pro/news/h5Detail/109243
Foresight News 消息，Zilliqa 发文披露其 Ledger 应用存在严重漏洞，影响原生（非 EVM）Zilliqa 交易的 Schnorr 签名生成。该漏洞存在于 2019 年至 2026 年间发布的所有版本 Zilliqa Ledger 应用中，7 月 19 日发现链上疑似主动利用迹象，7 月 21 日确认根因。该漏洞导致签名时使用的临时随机数（nonce）可被预测，攻击者仅凭链上公开数据即可还原签名者私钥。Zilliqa 提醒，曾使用 Ledger 设备签署原生 Zilliqa 交易的用户应等待官方指引，暂勿采取任何独立行动。漏洞根因在于签名程序在将随机数写入缓冲区时复制了错误的字节范围，导致每个生成的随机数最高 64 位固定为零，熵值严重不足。利用 5 笔或以上受影响签名，攻击者可通过 lattice reduction 在数秒内还原私钥。由于受影响交易已永久记录在链上，更新签名应用无法逆转此风险，相关私钥必须废弃。目前原生交易已暂停以防止进一步损失，协调修复方案正在最终确认中。EVM 交易及 zilliqa-js、gozilliqa-sdk、pyzil 等 SDK 不受影响。
https://foresightnews.pro/news/h5Detail/109243
Foresight News
Zilliqa Ledger 应用存在随机数生成漏洞，签署 5 笔及以上原生交易的账户或被攻破
Zilliqa 发文披露其 Ledger 应用存在严重漏洞，影响原生（非 EVM）Zilliqa 交易的 Schnorr 签名生成。该漏洞存在于 2019 年至 2026 年间发布的所有版本 Zilliqa Ledger 应用中，7 月 19 日发现链上疑似主动利用迹象，7 月 21 日确认根因。该漏洞导致签名时使用的临时随机数（nonce）可被预测，攻击者仅凭链上公开数据即可还原签名者私钥。Zilliqa 提醒，曾使用 Ledger 设备签署原生 Zilliqa 交易的用户应等待官方指引，暂勿采取任何…
🤡9😁1
Forwarded from Hacker News (yahnc_bot)
git's –end-of-options Flag https://nesbitt.io/2026/07/21/end-of-options.html
Andrew Nesbitt
–end-of-options
The git flag I assumed was an LLM hallucination
Forwarded from Hacker News (yahnc_bot)
It's getting harder to focus every day https://glyphack.com/attention/
Glyphack
It's getting harder to focus every day
I’m feeling it right now. I had to set a timer for 15 minute on my computer and block all distractions to write this. If I didn’t force myself to focus I would easily get distracted by something after few minutes. Even when I’m doing things that I’ve been…
😢2
Forwarded from Hacker News (yahnc_bot)
The PImpl idiom and the C++26 std:indirect type https://mariusbancila.ro/blog/2026/07/23/the-pimpl-idiom-and-the-cpp26-stdindirect-type/
Marius Bancila's Blog | About code. Mostly on C++
The PImpl idiom and the C++26 std::indirect type
Forwarded from Hacker News (yahnc_bot)
Buz – A fork of Bun using modern Zig, with sub-1s incremental builds https://ziggit.dev/t/buz-a-drop-in-replacement-for-bun-using-modern-zig-with-sub-1s-incremental-builds/16891
Ziggit
Buz - A drop-in replacement for Bun using modern Zig, with sub-1s incremental builds
Buz This is my WIP fork of Bun, based on the last commit before their Rust rewrite. It is still very early in its development and is nowhere near ready for production. I saw that a similar project had already been posted on Ziggit, so I am posting mine to…
Forwarded from Hacker News (yahnc_bot)
Designing an Ethernet Switch ASIC https://essenceia.github.io/projects/ethernet_switch_asic/
Tales on the wire
Designing an Ethernet Switch ASIC
Designing the world's first open source Ethernet switch ASIC. An unmanaged cut-through 3-port 100Mbps switch fabbed on Global Foundries 180 nm.
Forwarded from Hacker News (yahnc_bot)
Android May Soon Restrict On-Device ADB https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/
Kitsumed Blog
Android May Soon Restrict On-Device ADB, Affecting Shizuku, libadb and Developers
Changes proposed for ADB could kill an entire ecosystem of open-source power-user apps, mobile developer setups, and rootless privacy tools based on Shizuku.