1
On privacy and control
I have 15+ years of software engineering experience across different parts of the tech stack including networking libraries, congestion control, performance improvements, Backend, and Android development.
New
The latest blog posts to take off on Hacker News. 371 posts.
2
Web Browsers have stopped blocking pop-ups
If you were an Internet user for a few years on either side of the turn of the millennium, you will remember pop-up advertisements.
3
Sabotaging Bitcoin
Source I find myself in the unusual position of defending Bitcoin from its critics, if only reluctantly. In 2024 Soroush Farokhnia & Amir...
4
A Vulnerability in Libsodium
Libsodium is now 13 years old!
5
No strcpy either
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
6
MongoBleed Explained Simply
CVE-2025-14847 allows attackers to read any arbitrary data from the database's heap memory. It affects all MongoDB versions since 2017, here's a simple explanation:
7
If you care about security you might want to move the iPhone Camera app
There's a quirk in the iPhone Camera app that can drive a security conscious iPhone owner crazy: if you touch your finger on the Camera app ...
8
9
Things I learnt about passkeys when building passkeybot
Interesting things about passkeys in webauthn
10
Your Supabase is public if you turn off RLS
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
11
CSRF protection without tokens or hidden form fields
A couple of months ago, I received a request from a random Internet user to add CSRF protection to my little web framework Microdot, and I thought it was a fantastic idea.When I set off to do this…
12
13
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
14
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
15
Reverse Engineering US Airline's PNR System and Accessing All Reservations
Timeline & Responsible Disclosure
16
17
Are Apple gift cards safe to redeem?
Link to: https://tidbits.com/2025/12/17/compromised-apple-gift-card-leads-to-apple-account-lockout/
18
Most parked domains now serving malicious content
Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites…
19
I got hacked: My Hetzner server started mining Monero
I got hacked, my server started mining Monero this morning.
20
Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE
It was yet another day at the office. Our team was internally discussing moving to a different platform analytics solution. Our team was really leaning more towards Posthog. It’s one of the brilliant -I personally believe it’s the best- products on the market. And that’s where the story has begun… We have a somewhat…
21
Yep, Passkeys Still Have Problems
Firstyear's blog
22
“Super secure” messaging app leaks everyone's phone number
You can be, do, and have whatever you want, except for not spilling user information
23
It seems that OpenAI is scraping [certificate transparency] logs
lol. I minted a new TLS cert and it seems that OpenAI is scraping CT logs for what I assume are things to scrape from, based on the near instant response from ...
24
Guarding My Git Forge Against AI Scrapers
A summary of the techniques in place to protect my git forge
25
UK House of Lords attempting to ban use of VPNs by anyone under 16
This is deranged, each nation’s boomers and reactionaries attempting to outdo the others: “Action to prohibit the provision of VPN services to children in the United Kingdom” … th…
26
Going Through Snowden Documents, Part 1
We are building a comprehensive archive and analysis project examining published documents leaked by Edward Snowden. Our methodology involves systematically reviewing each available document with particular attention to small details and information that has received little or no public attention since the initial…
27
Israel used Palantir technologies in pager attack in Lebanon
A New Book Quietly Reveals That Israel Used Palantir In It's Terrorist Attack On Lebanon.
28
Stop Breaking TLS
Rant ahead: I hate TLS “Inspection” software with a burning passion and I wish we collectively as an industry would just knock it the fuck off and stop pretending it’s some great security benefit. Every time I encounter it, in whatever form, it’s a gigantic headache that makes everyone’s life worse off and as far as I…
29
Linux CVEs, more than you ever wanted to know
It’s been almost 2 full years since Linux became a CNA (Certificate Numbering Authority) which meant that we (i.e. the kernel.org community) are now responsible for issuing all CVEs for the Linux kernel. During this time, we’ve become one of the largest creators of CVEs by quantity, going from nothing to number 3 in…
30
Why the Sanitizer API is just `setHTML()`
Why the Sanitizer API is just <code>setHTML()</code>