News for hackers. Stuff that matters.
Re:AI Is Breaking Two Vulnerability Cultures by sedatk on Friday May 08, 2026 @08:35PM (#48070514)
> BinDiff: you can't patch software without disclosing vulnerabilities

That’s why Microsoft has been obfuscating its binary builds for at least the last two decades so that even the two builds from the same source would produce very different blobs.

Re:AI Is Breaking Two Vulnerability Cultures by dataflow on Friday May 08, 2026 @09:11PM (#48070753)
Sounds dubious, do you have a citation? The disassembly looks very straightforward for a lot of Windows code.
Re:AI Is Breaking Two Vulnerability Cultures by sedatk on Friday May 08, 2026 @10:19PM (#48071106)
They're not encoded, but the code blocks are shuffled. That's why disassembly does look straightforward, but it used to thwart BinDiff at the time.
Re:AI Is Breaking Two Vulnerability Cultures by dataflow on Friday May 08, 2026 @11:16PM (#48071473)
What made you believe this is the case? any examples/links/etc.?
Re:AI Is Breaking Two Vulnerability Cultures by sedatk on Friday May 08, 2026 @11:43PM (#48071617)
It was a part of our Windows build process when I was at Microsoft. I only assumed that they would keep doing it, but they might have as well dropped the practice.
Re:AI Is Breaking Two Vulnerability Cultures by cstdr on Saturday May 09, 2026 @10:02AM (#48075063)
I don't see how that can be useful when Microsoft publishes debug symbols for almost everything.
Re:AI Is Breaking Two Vulnerability Cultures by j16sdiz on Saturday May 09, 2026 @01:35AM (#48072108)
If I understand correctly, that is just randomness comes from parallel compiling and linking.

If you saying there is a whole step just scrambling blobs, i will be very surprised.

Re:AI Is Breaking Two Vulnerability Cultures by shakna on Saturday May 09, 2026 @08:41AM (#48074539)
That sounds a lot like US9116712, but I don't think its ever been publicly said that Windows does this.
Re:AI Is Breaking Two Vulnerability Cultures by wglb on Friday May 08, 2026 @08:37PM (#48070537)
How are they obfuscated?
Re:AI Is Breaking Two Vulnerability Cultures by sedatk on Friday May 08, 2026 @10:19PM (#48071108)
See my sibling comment.
Re:AI Is Breaking Two Vulnerability Cultures by wglb on Saturday May 09, 2026 @03:01PM (#48077323)
Everything I can find says they are not obfuscating
Re:AI Is Breaking Two Vulnerability Cultures by prezk on Monday May 11, 2026 @01:26PM (#48097914)
All the while, Linux is going towards reproducible builds (Debian just announced it as a policy). This is of course the only sane way for FOSS, and, I believe, the only sane long term approach in any case. Security by obscurity, while not worthless, is just a thin mitigation layer. By the way, build-time randomization is ineffective in light of AI analysis---it needs to be per-binary-run, in the style of KASLR.