1
On privacy and control
I have 15+ years of software engineering experience across different parts of the tech stack including networking libraries, congestion control, performance improvements, Backend, and Android development.
New
The latest blog posts to take off on Hacker News. 679 posts.
2
Web Browsers have stopped blocking pop-ups
If you were an Internet user for a few years on either side of the turn of the millennium, you will remember pop-up advertisements.
3
4
5
Sabotaging Bitcoin
Source I find myself in the unusual position of defending Bitcoin from its critics, if only reluctantly. In 2024 Soroush Farokhnia & Amir...
6
A Vulnerability in Libsodium
Libsodium is now 13 years old!
7
No strcpy either
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
8
MongoDB Server Security Update, December 2025
The following is an update on the security vulnerability identified in December 2025.
9
MongoBleed Explained Simply
CVE-2025-14847 allows attackers to read any arbitrary data from the database's heap memory. It affects all MongoDB versions since 2017, here's a simple explanation:
10
If you care about security you might want to move the iPhone Camera app
There's a quirk in the iPhone Camera app that can drive a security conscious iPhone owner crazy: if you touch your finger on the Camera app ...
11
Say No to Palantir in the NHS
NHS England is rolling out software to run our health records from Palantir - fight back
12
Seven diabetes patients die due to undisclosed bug in Abbott's glucose monitors
I wrote last month about my diabetes diagnosis this year and my difficult choice to wear a proprietary device (called a CGM) on my arm 24/7 to continuously monitor my glucose levels. Like my friend and colleague, Karen M. Sandler — who previously made a much higher-stakes choice to receive a proprietary implanted…
13
Critical vulnerability in LangChain – CVE-2025-68664
Check Point's AI Security Solutions deliver AI-driven threat prevention and unified security management for advanced protection across enterprise networks.
14
15
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
Secure the modern software stack with Koi. Gain visibility, context, and real-time protection over extensions, MCPs, and autonomous AI agent endpoints.
16
Things I learnt about passkeys when building passkeybot
Interesting things about passkeys in webauthn
17
Your Supabase is public if you turn off RLS
I was chatting with a close friend of mine and he sent me a link to his new SaaS that he's developing.
18
CSRF protection without tokens or hidden form fields
A couple of months ago, I received a request from a random Internet user to add CSRF protection to my little web framework Microdot, and I thought it was a fantastic idea.When I set off to do this…
19
20
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
21
Flock and Cyble Inc. weaponize “cybercrime” takedowns to silence critics
When a government contractor pays a company for "Takedown Services" to prevent transparency in government
22
Privacy doesn't mean anything anymore, anonymity does
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
23
24
TP-Link Tapo C200: Hardcoded Keys, Buffer Overflows and Privacy
Hi friends and welcome to the last post for this year! Whenever someone asks me how to get started with reverse engineering, I always give the same advice: buy…
25
Reverse Engineering US Airline's PNR System and Accessing All Reservations
Timeline & Responsible Disclosure
26
GotaTun – Mullvad's WireGuard Implementation in Rust
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable.
27
28
Are Apple gift cards safe to redeem?
Link to: https://tidbits.com/2025/12/17/compromised-apple-gift-card-leads-to-apple-account-lockout/
29
Most parked domains now serving malicious content
Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites…
30
