工具与资源github.com
OpenDrop：开源 AirDrop 实现
OpenDrop: An Open Source AirDrop Implementation
2019 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
OpenDrop 是慕尼黑大学 SEEMOO 实验室开源的 AirDrop 协议实现，基于对苹果私有 AWDL（Apple Wireless Direct Link）协议的逆向工程，可在兼容硬件上与苹果设备互传文件。该项目还伴随发表了对 AWDL 的安全与隐私分析论文，揭示了中间人、DoS 和用户追踪等漏洞。
为什么经久不衰：它既是罕见的对苹果封闭生态的开放协议逆向成果，也推动了 AWDL 安全研究，对跨平台近场传输感兴趣的读者至今仍有参考价值。
HN 评论精选
该项目源于对 AWDL 的安全研究，论文揭示了协议的多个严重漏洞
有趣的是，页面底部链接了一篇 USENIX 2019 论文《十亿个开放接口给 Eve 和 Mallory：通过 Apple Wireless Direct Link 对 iOS 和 macOS 发起中间人、DoS 和追踪攻击》。摘要指出：AWDL 是苹果生态中超过十亿台设备使用的设备间通信关键协议，是其 802.11 Wi-Fi 标准的私有扩展，并与 BLE 集成提供 AirDrop 等服务。作者首次对 AWDL 及其 BLE 集成做了安全与隐私分析，发现了从设计缺陷到实现漏洞的一系列问题，可导致隐蔽篡改 AirDrop 传输文件的中间人攻击、阻断通信的 DoS、绕过 MAC 地址随机化的用户识别与长期追踪，以及让邻近设备崩溃的 DoS。攻击可用 20 美元的 micro:bit 设备实现。
Fnoord查看英文原文
Interestingly the article on the bottom links to a Usenix 2019 (held Aug 14 - 16) paper with the title "A Billion Open Interfaces for Eve and Mallory: MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link" Abstract: "Apple Wireless Direct Link (AWDL) is a key protocol in Apple's ecosystem used by over one billion iOS and macOS devices for device-to-device communications. AWDL is a proprietary extension of the IEEE 802.11 (Wi-Fi) standard and integrates with Bluetooth Low Energy (BLE) for providing services such as Apple AirDrop. We conduct the first security and privacy analysis of AWDL and its integration with BLE. We uncover several security and privacy vulnerabilities ranging from design flaws to implementation bugs leading to a man-in-the-middle (MitM) attack enabling stealthy modification of files transmitted via AirDrop, denial-of-service (DoS) attacks preventing communication, privacy leaks that enable user identification and long-term tracking undermining MAC address randomization, and DoS attacks enabling targeted or simultaneous crashing of all neighboring devices. The flaws span across AirDrop's BLE discovery mechanism, AWDL synchronization, UI design, and Wi-Fi driver implementation. Our analysis is based on a combination of reverse engineering of protocols and code supported by analyzing patents. We provide proof-of-concept implementations and demonstrate that the attacks can be mounted using a low-cost ($20) micro:bit device and an off-the-shelf Wi-Fi card. We propose practical and effective countermeasures. While Apple was able to issue a fix for a DoS attack vulnerability after our responsible disclosure, the other security and privacy vulnerabilities require the redesign of some of their services." [1] I got nothing to add regarding OpenDrop other than that I love interoperability, and that I love it when FOSS enables this. [1] https://www.usenix.org/conference/usenixsecurity19/presentation/stute
AirDrop 这类近场传输在审查环境中有绕过网络封锁的现实价值
这很了不起，尤其考虑到香港抗议者曾用 AirDrop 绕过防火墙。
em3rgent0rdr查看英文原文
This is great, especially considering that AirDrop is used for instance by Hong Kong protesters to bypass the great firewall [1]. [1] https://qz.com/1660460/hong-kong-protesters-use-airdrop-to-breach-chinas-firewall/
AirDrop 体验好但失败时毫无反馈，且这类近场传输理应成为行业标准
AirDrop 很出色，但它会静默失败，没有任何错误提示，最多只说传输被取消。有人知道怎么调试它吗？我也好奇为什么这种文件传输没有成为行业标准——它如此直接（在能用的前提下），还有什么别的传输方式比它更好？
mrtksn查看英文原文
AirDrop is brilliant but it fails silently, no error messages - nothing. At best, it says that it was cancelled. Does anyone knows how to debug it? I also wonder, why this type of file transfer isn't the industry standart. It's so straightforward(when it works), why would anyone transfer files in any other way? Okay, maybe a transfer history can also be useful.
AirDrop 的成功体现了苹果软硬件垂直整合的深度控制
我认为 AirDrop 是苹果软硬件垂直整合优势的绝佳例证。它不与其他平台互操作，是因为其他平台缺乏实现同等软硬件整合所需的控制权——没有对射频硬件的底层直接控制，就无法像 AirDrop 那样整合蓝牙和 Wi-Fi。希望有一天这类功能出现标准，让其他平台也能实现，虽然苹果贡献技术促成标准可能只是奢望。
_V_查看英文原文
I went from MacOS to Linux recently so I was going through similar projects and there is one important caveat: You have to have WIFI adapter that supports special mode (active monitor mode with frame injection). Without compatible wifi adapter this will not work unfortunately :-(
历次讨论
同类还值得读
直接在浏览器中启动 Linux 内核
Boot a linux kernel right inside your browser.
Fabrice Bellard 的 JSLinux 页面，用 JavaScript 在浏览器里启动一个 Linux 内核，并提供一个可交互的终端环境。
工具与资源上首页 5 次 · 2011–2025bellard.orgHacker News 未公开功能与行为清单（2018）
A List of Hacker News's Undocumented Features and Behaviors (2018)
数据科学家 Max Woolf 整理的 Hacker News 未公开功能与行为清单，涵盖投票机制、排名算法、账号惩罚等社区运作细节。
工具与资源上首页 5 次 · 2019–2025github.comMapSCII：在终端中用盲文和 ASCII 渲染地图
MapSCII – Braille and ASCII map renderer for the console
MapSCII 是一个在命令行终端里渲染地图的开源工具，用盲文字符和 ASCII 字符把地理数据画成可交互浏览的字符地图。
工具与资源上首页 5 次 · 2017–2025github.com顶尖大学的免费在线课程
Free Online Courses from Top Universities
Open Culture 整理的一份免费在线课程合集，汇集了全球顶尖大学（如 MIT、斯坦福、耶鲁等）向公众开放的网络课程资源，涵盖音频、视频等多种形式。
工具与资源上首页 5 次 · 2010–2022openculture.com淘气字符串：容易引发用户输入问题的字符串清单
Naughty Strings: A list of strings likely to cause issues as user-input data
一个 GitHub 仓库，收录了大量容易让程序出问题的用户输入字符串，如特殊字符、emoji、SQL 注入片段、系统命令等，供开发者用于测试输入处理逻辑。
工具与资源上首页 4 次 · 2015–2020github.com