2 HN users recommended this talk2 months2018–2023score 2.5
Years with an HN recommendation, 2007–2026
Recommended as a fun, practical talk on why bit flips matter for security, and cited in ECC memory discussions.
Artem Dinaburg's DEF CON 19 talk on bit-squatting, where DRAM bit flips cause DNS requests to go to domains one bit off from the intended one. It shows how hardware faults can be exploited for hijacking without any software exploit.
“A really fun DefCon talk on bitsquatting.” (HN, 2022)
A really fun DefCon talk on bitsquatting. Bitsquatting is the practice of registering domains that are one bit off from a popular one: [this video] google.com vs ooogle.com >>> chr(int('0b1100111', 2)) 'g' >>> chr(int('0b1101111', 2)) 'o' If the 4th to last bit of 'g' were to flip before writing to disk, you could get persistent requests to ooogle.com Having done queries against very large datasets at a large company, I can say for certain that this happens much more than you think it might.
Fun DefCon talk on registering domains one bit off.
Regarding "some hardware errors": This might include operationg conditions you didn't consider; say: The divisor in your code went through a non-ECC DRAM module (maybe in a disk drive) that runs hotter than its specified operating temperature would allow and a random bit-flip changes your `1` into a `0`. On this topic, the talk on Bitsquatting from Artem Dinaburg during Defcon 19 is worth watching. The most interesting part on bit flips starts around 15:05 minutes: [this video]
Bitsquatting talk with bit-flip discussion starting at 15:05.
The thing about ECC vs. non-ECC. If you don't have ECC, you don't know silent bit corruption is happening, and when it's finally (if it's ever) discovered, there's nothing that can be done. ECC (SECDED) keeps data safer than it would be otherwise. ECC is necessary for anything real or important based on the financial cost of losing data. For everything else, it can be optional. Plus, don't forget the security issues of bitsquatting and other attacks that are the real results of silent bitflips. DEF CON 19 - Artem Dinaburg - Bit-squatting: DNS Hijacking Without Exploitation [this video]
This reminds me of Bitsquatting, which is like typosquatting but uses domains one bit-flip away instead of one mistyped letter away.[0] In a small experiment, for some popular domains, the author reportedly got a lot of hits. In the associated DEFCON talk, the author notes that even if you use ECC memory, it's unlikely that the DRAM in your hard drives does too.[1] 0: [link] 1: [this video]
Even ECC memory systems often have non-ECC DRAM in drives.
Encryption and signing don't protect against memory corruption. For example, I download software from the internet then hash it. The hash matches. Before the bytes are written to disk locally, a bit flips in RAM. The corrupted data is written to disk and used. Likewise, dnssec doesn't protect you against DNS bitsquatting attacks[1] because the domain name can be changed before the DNS request is made. So the DNS response your computer makes for a-azon.com might be totally valid and signed. It can come through DoH or whatever. The problem is that your browser thought it was the response for amazon.com and chrome send a bitsquatter your amazon cookies. (Oops). [1] [this video]
Talk on bit-squatting, where RAM bit flips redirect DNS requests.
Video list and Hacker News comment labels from HackerTube (prompted by @karpathy), released under ODC-By 1.0, built on the open-index/hacker-news archive. Hacker News data is provided by Y Combinator; comments remain the work of their authors. Video titles, channel names and thumbnails belong to their creators and are shown via YouTube. HackerTube Watch is an unofficial edition. Data export of 2026-10-31.
Plays via YouTube's privacy-enhanced embed
5 Hacker News comments
From the HN archive; up to 20 kept per video, favoring different commenters. Recommendations first.
Citations, criticism and jokes
Read more