Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 6,985 posts.
How the Dreamcast Copy Protection Was Defeated
After I shipped the DOOM Black Book , I took some vacation in Japan where I was able to play Ikaruga on a real arcade at Taito HEY in Akihabara. The experience reignited my interest in SEGA's ultimate video game console, the Dreamcast. There is a lot of documentation available online which made the studying process…
NYTimes Peru N-Word: My side of the story, in four parts
On February 5 this year, one week after an article about me appeared in the Daily Beast, The New York Times announced that I would be…
Tools for thought: graphical algebra and Fourier analysis
" I think a lot of mathematics is really about how you understand things in your head. […]
Separating the Wayland compositor and window manager
Traditional Wayland compositors have a monolithic architecture that combines the compositor and window manager into a single program. This has the downside of requiring Wayland window managers to do the significant work of implementing an entire Wayland compositor as well.
An interactive guide to SVG paths
An interactive guide to understanding SVG paths and path commands.
Extracting Qualcomm's KeyMaster Keys – Breaking Android Full Disk Encryption
A security blog focusing on Android, the Linux Kernel and everything nice.
Golden Rules of Interface Design (2013)
I have often been asked to distill the vast corpus of user interface design into a few key principles. While I was reluctant to do this, it turned out to be a good exercise to write “Golden Rules,” that are applicable in most interactive systems. These principles, derived from experience and refined over three…
ChatGPT in an iOS Shortcut: Smart HomeKit Voice Assistant
Ever since I tried ChatGPT and GPT-3, everything else feels painfully dumb and useless: Siri, Alexa, Google Home and all other “smart”…
How I Made a Heap Overflow in Curl
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
Neon: Node plus Rust
If you’re a JavaScript programmer who’s been intrigued by Rust’s hack without fear theme—making systems programming safe and fun—but you’ve been waiting for inspiration, I may have something for you! I’ve been working on Neon, a set of APIs and tools for making it super easy to write native Node modules in Rust.
Systems design explains the world: volume 1
"Systems design" is a branch of study that tries to find universal architectural patterns that are valid across disciplines. You might thin...
Double Blind Passwords a.k.a. Horcruxing
Before we get into Horcruxing, here's a quick prologue on online security hygiene. You can skip to the Horcruxing section if it seems redundant. 1. Longer…
Go += Package Versioning
More precisely, we need to add the concept of package versions to the working vocabulary of both Go developers and our tools, so that they can all be precise when talking to each other about exactly which program should be built, run, or analyzed. The go command needs to be able to tell developers exactly which…
Win32 is the stable Linux userland ABI (and the consequences)
This post was inspired by some controversy with Valve and their support for Linux, but the bulk of it comes from long-term observation. One of the biggest impacts with the viability of Linux on the desktop was Valve’s Proton, a… Continue reading →
Linux Desktop Environments System Usage
Over the years I've seen a lot of poorly made comparisons of Linux Desktop Environments in terms of system usage and in this article I want to make things right once and for all.
Remote code execution in cdnjs of Cloudflare
Preface (日本語版も公開されています。) Cloudflare, which runs cdnjs, is running a “Vulnerability Disclosure Program” on HackerOne, which allows hackers to perform vulnerability assessments. This article describes vulnerabilities reported through this program and published with the permission of the Cloudflare security team. So this…
Four Hours of Concentration
As I've blogged about before, and mentioned again in my previous post, the great mathematician and physicist Henri Poincaré put in two hours of work in the morning and two in the evening. Apparently this is a common pattern. Cal Newport mentions this in his interview with Todd Henry. Now we also know that if
It looks like you’re trying to take over the world
Fictional short story about Clippy & AI hard takeoff scenarios grounded in contemporary ML scaling, self-supervised learning, reinforcement learning, and meta-learning research literature.
I Have No Talent
The other day someone sent me an IM and thanked me for my open source contributions. They then said something about wishing they had my gem/code creation…
Be Careful with Python's New-Style String Format
Some general warnings about the use of str.format in Python.
Life, work, death and the peasant: Rent and extraction
This is the third piece of the fourth part of our series (I, II, IIIa, IIIb, IVa, IVb, IVc, IVd,IVe, V) looking at the lives of pre-modern peasant farmers – a majority of all of the humans who have…
LinkedIn: The Creepiest Social Network
The primary reasons LinkedIn is the mustached, trench coat and wire frame glasses wearing mouth breather of the internet are the “People You May Know” and “People Also Viewed” features.
The Edited Latecomer’s Guide to Crypto
A group of cryptocurrency researchers and critics annotate the irresponsible cryptocurrency puff piece that was originally published in the New York Times.
If I Launched a Startup - Cheat Sheet
Startup lawyer tips for launching: incorporate smart, use mentors/advisors carefully, and raise seed capital with founder-friendly, low-drama terms.