Top all-time · #6576
Adam Pritchard
Personal blog · adam-p.ca/blog · on HN as adam-pwebsecurityprogramming
Adam Pritchard's personal blog at adam-p.ca covers web, security and programming. Since 2022, 12 different Hacker News readers have linked it 20 times, most often “The perils of the “real” client IP”. It is still writing: the last post was on 2025-04-28, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN commenters link Adam Pritchard's posts on IPv6 rate limiting, trusting X-Forwarded-For headers, and Go string length subtleties, cited for detail on web networking and client IP handling.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- The perils of the “real” client IP5 people · 5 mentions · first linked 2022-03-04
- /blog/2022/02/ipv6-rate-limiting/4 people · 4 mentions · first linked 2023-06-04
- The best – but not good – way to limit string length2 people · 2 mentions · first linked 2025-04-30
What Hacker News says?
https://adam-p.ca/ Built with Hugo (starting with no theme, because I wanted understanding, not magic). Uses Bootstrap. Hosted with GitHub Pages.
Comment linking /
on “Ask HN: Share your personal site”Submitted The perils of the “real” client IP as a story · 194 points
HN discussionI killed a Yubikey in my pocket (without washing) after four years. Get two and keep the backup safe. https://adam-p.ca/blog/2021/06/backup-yubikey/
Comment linking /blog/2021/06/backup-yubikey/
on “Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard”Submitted Bug story: Sorting by timestamp as a story · 68 points
HN discussionrelated: https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/
Comment linking /blog/2022/02/ipv6-rate-limiting/
on “OpenSSH introduces options to penalize undesirable behavior”Submitted The best – but not good – way to limit string length as a story · 49 points
HN discussionHere’s my favorite post on the subject https://adam-p.ca/blog/2025/04/string-length/
Comment linking /blog/2025/04/string-length/
on “Go subtleties”Submitted The perils of the real client IP (2022) as a story · 8 points
HN discussionOne potential scenario is bypassing rate limits, enabling abuse, scraping etc. because of the large IP blocks each customer is granted, and seemingly the lack of standardization there. The assumption of there being a finite amount of IPs to cycle for an attack doesn’t entirely hold with IPv6, and seems like not all software is configured to take that into account. Explained here better: https://adam-p.ca/blog/2022/0…
Comment linking /blog/2022/02/ipv6-rate-limiting/
on “GitHub is preparing for IPv6 support for Github.com”Submitted The perils of the “real” client IP as a story · 5 points
HN discussionA very in-depth article on the topic: https://adam-p.ca/blog/2022/03/x-forwarded-for/ I implemented those recommendations in Caddy to enable a "trusted proxies" system which informs the proxy, logging, request matching etc to safely use the client IP taken from proxy headers.
Comment linking /blog/2022/03/x-forwarded-for/
on “What is X-Forwarded-For and when can you trust it? (2024)”Submitted Forwarded Header Sabotage (2022) as a story · 2 points
HN discussionI added a section with brief discussion of rejection, truncation, and the perils therein. https://adam-p.ca/blog/2025/04/string-length/#what-to-do-whe...
Comment linking /blog/2025/04/string-length/
on “The best – but not good – way to limit string length”Submitted Diving into Go's HTTP server timeouts (2022) as a story · 2 points
HN discussionI don't get into truncation much, but I do mention the risk of: a) failing to truncate on a code point sequence boundary (a bug React Native iOS used to have)[1], and b) failing to truncate on a grapheme cluster boundary (a bug React Native Android seems to still have)[2] [1]: https://adam-p.ca/blog/2025/04/string-length/#utf-16-code-un... [2]: https://adam-p.ca/blog/2025/04/string-length/#unicode-code-p...
Comment linking /blog/2025/04/string-length/
on “The best – but not good – way to limit string length”And create a new problem: banning by IPv6 is a nightmare https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/
Comment linking /blog/2022/02/ipv6-rate-limiting/
on “Let us serve you, but don't bring us down”Mine is mostly a (sporadically updated) blog: https://adam-p.ca/
Comment linking /
on “Ask HN: Could you share your personal website here?”From the circleCI blogpost[1]: "Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location" I haven't seen much discussion on how this specific attacker entrypoint can be mitigated. So I'm going to make a naive attempt in this comment. How about storing the client's IP address in the session cookie. Then whenever the…
Comment linking /blog/2022/03/x-forwarded-for/
on “CircleCI says hackers stole encryption keys and customers’ source code”Answering myself: I found this interesting article https://adam-p.ca/blog/2022/02/ipv6-rate-limiting/
Comment linking /blog/2022/02/ipv6-rate-limiting/
on “AWS Customers Cannot Escape IPv4”