1
Why don’t we do email verification in reverse?
Just about everybody who has ever used a service on the web has experienced the following account creation follow:
William Woodruff
TL;DR: I’ve turned my April post on Brocards for vulnerability triage into a more permanent website. You can now link to each brocard directly, like this , without having to worry about link rot 1 .
- Popular posts
- 19
- Total points
- 4,095
- HN comments
- 2,920
- Rank
- #310 personal
Visit blog.yossarian.net → RSS feedOn Hacker News May 2020 – Aug 2026
Software Engineering 11Systems & Performance 5Tools & Productivity 4Programming Languages 4Security & Privacy 3Infrastructure & DevOps 3
2
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
3
Hiding messages in x86 binaries using semantic duals
This is a quick writeup of a steganographic tool that I threw together: steg86 . It uses a quirk of the x86 instruction encoding format to hide messages in pre-existing binaries with no size or performance overhead.