Submission timeline
2007–2026One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.
First comments on top threads
HN comment orderKind of weird to list every program that reads an input file with higher privleges under sudo or suid. That's like almost every program, and kind of the entire point of sudo/suid.
Most of them by very far rely on sudo. I've got a system without sudo. The only way to execute something as root on my system is to log in, using a U2F security key, from a second system (typically a small laptop sitting next to my workstation). That second system is connected to my workstation on a dedicated LAN only used by these two machines. Firewalls on both (for example my workstation only allow SSH in from that one…
I find a lot of these to be really contrived and not actually exploits. For example, the first "issue" for yum[0] shows that you can create a RPM that will run arbitrary commands when installed, and then shows the example install command, which requires root access. So, sure, if someone tricks you into running arbitrary commands as root, you're hosed. I don't find this particularly novel or interesting. Then there are several supposed "SUID issues", like the second one for…
What I get from reading this is, "never sudo <bin> anything you don't absolutely need to". Or in other words, always adhere to the Principle of Least Privilege. As a sysadmin, we often just give ourselves ALL:ALL in sudo, but we shouldn't. We definitely shouldn't give it to other users.
The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.
- Breakout years
- 3
- Total points
- 702
- Total comments
- 189
100+ points or 50+ comments
reference only — not used in Hall rules or ranking
reference only — not used in Hall rules or ranking
Every submission
| Date | Title as submitted | By | Points | Comments |
|---|---|---|---|---|
| 2018-05-23 | Show HN: GTFOBins – Curated list of Unix binaries to bypass security controls | cyrusand | 2 | 0 |
| 2018-09-05 | Exploitable Unix binaries to bypass local security restrictions | ntrischi | 1 | 0 |
| 2019-02-24 | Show HN: GTFOBins – Lolbas for Unix | d0bby | 1 | 0 |
| 2019-08-08 | Living Off the Land in LinuxFirst breakout | DyslexicAtheist | 163 | 35 |
| 2020-12-01 | Curated list of Unix binaries that can be exploited by an attacker | varbhat | 3 | 0 |
| 2021-01-20 | GTFOBins: List of Unix binaries that can bypass local security restrictions | bryanrasmussen | 2 | 1 |
| 2021-10-13 | GTFOBinsHall induction · Best thread | matthberg | 324 | 54 |
| 2023-07-07 | List of Unix binaries that can be used to bypass local security restrictionsLatest 20+ point return | janisz | 201 | 99 |
| 2025-04-04 | GTFOBins | bsilvereagle | 2 | 0 |
| 2026-01-14 | GTFOBins | tosh | 3 | 0 |