1
I Went to SQL Injection Court
Chicago argued that answering a FOIA request with a database query means creating a new record. Matt Chapman sued, I wound up on the stand explaining SQL, and now there's a bill to fix it.
Thomas Ptacek
Thomas and Erin Ptacek on software, security, cryptography, hiring, and the occasional cocktail.
- Popular posts
- 15
- Total points
- 5,286
- HN comments
- 3,322
- Rank
- #197 personal
Visit sockpuppet.org → RSS feedOn Hacker News Jul 2013 – Sep 2026
Security & Privacy 7Software Engineering 7Systems & Performance 3Tools & Productivity 2Society, Policy & Culture 2Life, Learning & Writing 2
2
How to Write with an LLM
Two rules keep an LLM from pasteurizing your writing: never take a word it suggests, and never let it encourage you. Then hand it all the tedious work.
3
The Hiring Post
The developer job interview doesn't work: it measures a basket of skills uncorrelated with job performance. Work-sample tests, warm-ups, and how to grade your own hiring process.
4
The Emacsification of Software
Everything looks like Emacs now: personal, complicated, idiosyncratic, and shrink-wrapped around exactly what you want it to do. Does shipping software even make sense in the long run?
5
Stop Making TUIs
It's time to stop drawing user interfaces with punctuation characters. Native UI is a completely solved problem.
6
Starfighter, Summer 2015
An Erin post. On finding, in app pentesting, the only game worth loving, and turning that into Starfighter: a company that hires people by letting them play it.
7
What even is an OS now?
Computers now work the way I thought they did when I was 8. What does computing look like when most applications have an audience of 1-2 people? I'm leaving Fly.io to build a phone for that world.
8
Vulnerability research is cooked
Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?
9
10
Against DNSSEC
10 years later and still unrebutted: DNSSEC is pageantry, it's not security, which is why so few security teams deploy it.
11
Is Extended Random a Malicious NSA Plot?
Dual_EC was almost certainly an NSA backdoor. Extended Random is the TLS extension that would have made it practical to exploit. Did NSA plant that one too? A look at the evidence.
12
Applied Cryptography Engineering
Applied Cryptography taught two generations of developers what they know about crypto, and it is a dreadful instruction manual. The book to replace it with, and what you still have to learn after.
13
A Liquid Nitrogen Cocktail Party
Dewars, safety rules, barware, and drinks: how to throw a liquid nitrogen cocktail party, in the spirit of Dave Arnold's Liquid Intelligence, without anybody losing an eye.
14
You Don't Want XTS
XTS is the de-facto standard disk encryption mode, which makes it look like a good general-purpose one. It isn't. What disk encryption actually promises, and why XTS's guarantees don't travel.
15
How To Safely Generate A Random Number
Use urandom. That is the whole answer. Why the entropy-depletion story is a myth, and why userspace CSPRNGs are behind most of the last decade's randomness disasters.