211
212
Introduction to reverse-engineering vintage synth firmware
A gentle introduction to reverse-engineering vintage synthesiser ROMs using the Ghidra disassembler.
213
A thought on JavaScript "proof of work" anti-scraper systems
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
214
215
LLMs and coding agents are a security nightmare
Things are about to get wild
216
Yep, Passkeys Still Have Problems
Firstyear's blog
217
Trusting clients is probably a security flaw
If your service needs to trust the clients, hold my Big Mac
218
We got hit by an alarmingly well-prepared phish spammer
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
219
When you deleted /lib on Linux while still connected via SSH (2022)
Let's first not talk about why this can happen, but deleting /lib, /usr/lib, or some other essential runtime files happens quite a lot (as you can see: here, here, here, and here). In this post, I will only discuss what happens when you delete /lib on Linux and how to recover from that. The easy
220
How I protect my Forgejo instance from AI web crawlers
This article describes my nginx configuration and strategy on how to prevent web crawlers from putting down my instance while still serving most people with minimal amount of friction.
221
Passkeys and Modern Authentication
Some thoughts in support of simple solutions.
222
Gmail E2E is as terrible as expected
Recently, Google introduced E2E encryption in Gmail. It went bad.
223
Remote Code Execution in Marvel Rivals Game
Reverse Engineering: I discovered a serious Remote Code Execution (RCE) vulnerability in a popular game that could let attackers run code on your PC. Watch how I found it, reported it, and what you can do to stay safe.
224
Xcode constantly phones home
Building StopTheMadness Pro in Xcode is usually very fast, because my project doesn't use any Swift. It's a combination of Objective-C, which compiles much more quickly than Swift, and JavaScript, which doesn't need to be compiled. However, sometimes the builds were very slow for some strange reason. Checking the…
225
Three ways formally verified code can go wrong in practice
"Correct" doesn't mean "correct" when correctly using "correct"
226
Guarding My Git Forge Against AI Scrapers
A summary of the techniques in place to protect my git forge
227
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers like AT&T , Comcast and Verizon , new evidence suggests. Experts say the heavy concentration of infected devices at U.S. providers is…
228
On privacy and control
I have 15+ years of software engineering experience across different parts of the tech stack including networking libraries, congestion control, performance improvements, Backend, and Android development.
229
230
AppLovin nonconsensual installs
Mobile adtech juggernaut AppLovin recently faced multiple allegations of misconduct . Allegations run the gamut—privacy, ad targeting, even national security and ties to China. I was among the researchers consulted by skeptical investors this spring, and I was quoted in one of their reports, explaining my concerns…
231
232
233
You Don't Need Anubis
don't use anubis just to block llm scrapers
234
The RubyGems "Security Incident"
Ruby Central posted an extremely concerning “Incident Response Timeline” today, in which they make a number of exaggerated or purely misleading claims. Here’s my effort to set the record straight. First, and most importantly: I was a primary operator of RubyGems.org, securely and successfully, for over ten years. Ruby…
235
Microsoft Dependency Has Risks
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual . Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me? What would be the cost? How much I invest into prevention of this scenario? In this…
236
PureVPN IPv6 Leak
Two findings in PureVPN on Ubuntu 24.04. After a reconnect the system takes a default IPv6 route outside the tunnel, and the ip6tables OUTPUT policy is still ACCEPT, so traffic leaves in the clear while the client reports connected.
237
Little Snitch feature nobody knows about
Little Snitch by Objective Development is the first app that I install on a new Mac. In fact I just bought a new Mac, an M4 MacBook Pro with nano-texture display, and I installed Little Snitch via thumb drive even before connecting the Mac to the internet. While setting up my new Mac, which came with macOS 15.2…
238
It's School time: Adventures in hacking an old Kindle
Jailbreaking an old Kindle and turning it into a school dashboard using Cloudflare Workers, Puppeteer, and image processing.
239
TeleMessage Customers Include DC Police, Andreessen Horowitz, JP Morgan,Hundreds
💡Update May 26, 2025: I've published the source code for TeleMessage Explorer: a new open source research tool I've been digging through the 410 GB of Java heap dumps from TeleMessage's archive server, provided by DDoSecrets. Here's a description of the dataset, some of my initial
240
Stop Breaking TLS
Rant ahead: I hate TLS “Inspection” software with a burning passion and I wish we collectively as an industry would just knock it the fuck off and stop pretending it’s some great security benefit. Every time I encounter it, in whatever form, it’s a gigantic headache that makes everyone’s life worse off and as far as I…