1
The Wi-Fi only works when it's raining
The strangest hardware problem I've ever had to debug.
Top posts
Every blog post that took off on Hacker News, ranked by the votes of its best submission. 113 posts.
2
Engineering for Slow Internet
How to minimize user frustration in Antarctica.
3
Passkeys: A shattered dream
Firstyear's blog
4
PySkyWiFi: Free stupid wi-fi on long-haul flights
The plane reached 10,000ft. I took out my laptop, planning to peruse the internet and maybe do a little work if I got really desperate.
5
Hacking millions of modems and investigating who hacked my modem
Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
6
It's always TCP_NODELAY
The first thing I check when debugging latency issues in distributed systems is whether TCP_NODELAY is enabled. And it’s not just me. Every distributed system builder I know has lost hours to latency issues quickly fixed by enabling this simple socket option, suggesting that the default behavior is wrong, and perhaps…
7
API Shouldn't Redirect HTTP to HTTPS
Instead of redirecting API calls from HTTP to HTTPS, make the failure visible. Unfortunately, many well-known API providers don't currently do so.
8
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
9
Is Telegram really an encrypted messaging app?
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
10
What You Get After Running an SSH Honeypot for 30 Days
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
11
How to get the whole planet to send abuse complaints to your best friends
It all begins with one scary email late at night just before I had to go to sleep:
12
13
Maybe Bluesky has "won"
November has sucked so far. One upside of the terrible nonsense is that more people are fleeing X. Many are choosing Bluesky. I’ve seen a bunch of takes about this recently, but I keep seeing things I disagree with. I figure that’s a good enough excuse to write more about this weird-assed social network.
14
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
15
Stop Microsoft users sending 'reactions' to email by adding a postfix header
Over the past few months, I’ve noticed that an increasing number of replies to email that I’ve sent are “reactions”.
16
HTTP: , FTP:, and Dict:?
I went for a spelunk through an ancient codebase a few weeks ago which contained a curious regex that I just couldn't grok. Copied to 📋⧉ {<((https?|ftp|dict|tel):[^\'">\s]+)>}i I'm familiar with HTTP and FTP. I worked in the mobile industry, so knew that tel:+44... could be used to launch a dialer. But DICT?!?!?! It…
17
18
Visual guide to SSH tunneling and port forwarding (2023)
Sysadmin doing syadmin stuff
19
Just disconnect the internet
So, let's say that a security vendor, we'll call them ClownStrike, accidentally takes down most of their Windows install base with a poorly tested content update. Rough day at the office, huh? There are lots of things you could say about this, lots of reasons it happens this way, lots of people to blame and not to…
20
21
Understanding Round Robin DNS
In which I try to understand how browsers and Cloudflare choose which server to use
22
Minuteman missile communications
A programming note: I am looking at making some changes to how I host things like Computers Are Bad and wikimap that are going to involve a lot more recurring expense. For that and other reasons, I want to see if y'all would be willing to throw some money my way. If everyone reading this gave $3 a month, we could…
23
High-speed 10Gbps full-mesh network based on USB4 for just $47.98
Fang-Pen Lin's blog about programming
24
Quake 3 Source Code Review: Network Model (2012)
The network model of Quake3 is with no doubt the most elegant part of the engine. At the lower level Quake III still abstract communications with the NetChannel module that first appeared in Quake World . The most important thing to understand is: In a fast paced environment any information that is not received on…
25
WireGuard: Beyond the most basic configuration
Last week I wanted to replace my OpenVPN setup with WireGuard. The basics were well-documented, going beyond the basics was a bit trickier. Let me teach you want I learned. The basics But first, let’s summarize the basics. I have a server with a hosting provider that I want to use as a VPN server. I won’t delve into…
26
The journey of an internet packet: Exploring networks with traceroute
This article explains the mechanics behind traceroute, from IP headers and TTL fields to ICMP messages. Learn why traceroute is a crucial tool for network diagnostics, how it differs from ping, and how to interpret its output. Ideal for network administrators, IT professionals, and curious users looking to understand…
27
28
OpenID Connect specifications published as ISO standards
I’m thrilled to report that the OpenID Connect specifications have now been published as ISO/IEC standards. They are:
29
HTTP/2 Continuation Flood: Technical Details
Preface In October 2023 I learned about HTTP/2 Rapid Reset attack, dubbed “the largest DDoS attack to date”. I didn’t have deep knowledge of HTTP/2 back then. I knew its basics like frames or HPACK but I was focusing more on HTTP/1.1 protocol and programming languages vulnerabilities. I decided to dedicate time to…
30