Top all-time · #4239
Andrea Fortuna
Personal blog · andreafortuna.orgsecurityprogramming
Andrea Fortuna's personal blog at andreafortuna.org covers security and programming. Since 2013, 18 different Hacker News readers have linked it 28 times, most often “Some useful tips about /dev/tcp”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Andrea Fortuna's posts as references on digital forensics, Linux and security topics, such as amcache and shimcache artifacts, hidden file metadata, and coding on an iPad.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cybersecurity expert, software developer, experienced digital forensic analyst, musician
Most-linked posts?
- Some useful tips about /dev/tcp2 people · 2 mentions · first linked 2023-06-21
What Hacker News says?
I was wondering this too. This isn't a direct answer to your question, but a quick search turned up this article for finding unsecured assets in a Google bucket https://www.andreafortuna.org/2019/08/07/some-useful-tools-f...
Comment linking /2019/08/07/some-useful-tools-for-finding-unsecure-google-storage-buckets/
on “My Eight-Year Quest to Digitize 45 Videotapes”Submitted Chat Control proposal fails again after public opposition as a story · 595 points
HN discussionThere is a tool used in malware analysis and computer forensics called Volatility[0]. It has some very powerful analysis tools and works on Linux Mac and Windows. In your case its ability to dump the memory of a running process without messing with the process state [1] may be very helpful! It also has the ability to run a Yara scan against the dumped memory which could let you find the region of memory containing t…
Comment linking /2017/07/10/volatility-my-own-cheatsheet-part-3-process-memory/
on “Ask HN: Ever worked with a service that can never be restarted?”Submitted Kubernetes is a symptom, not a solution as a story · 37 points
HN discussionPretty soon you could get through it with an unmodified iPad... https://www.andreafortuna.org/2021/03/13/coding-on-ipad-pro-... Not sure when it's going to be out of beta.
Comment linking /2021/03/13/coding-on-ipad-pro-my-own-setup/
on “Linux on Chromebooks just might get me through a masters in computer science”Submitted Every log must fire: applying Chekhov's gun to cybersecurity incident reports as a story · 5 points
HN discussionCheckout amcache and shimcache, recent files, bam/dam. https://andreafortuna.org/2017/10/16/amcache-and-shimcache-i...
Comment linking /2017/10/16/amcache-and-shimcache-in-forensic-analysis/
on “Windows 10 minus the spyware plus added stability and security”Submitted Simjacker: A new vulnerability exploited for espionage operation as a story · 4 points
HN discussionFirst page, first result on Google: https://andreafortuna.org/2025/11/30/hidden-metadata-reveals...
Comment linking /2025/11/30/hidden-metadata-reveals-what-your-iphone-silently-records-about-you
on “Apple Introduces MacBook Pro with All‑New M5 Pro and M5 Max”Submitted Every GPS satellite is a numbers station as a story · 3 points
HN discussionWhy would (pseudocode, nonexisting but possible example) write(SIGKILL, "/proc/12345/signals") not be possible? For the other direction, there is signalfd in Linux. And of course you can get a peer address from /dev/tcp ( https://andreafortuna.org/2021/03/06/some-useful-tips-about-... ). Yes, /dev/tcp is not an OS primitive but a bash builtin, but there isn't really a reason you cannot do this in the OS. Shared memo…
Comment linking /2021/03/06/some-useful-tips-about-dev-tcp/
on “Linux Namespaces Are a Poor Man's Plan 9 Namespaces”Submitted A sentimental tour of late 1990s and early 2000s hacking tools as a story · 3 points
HN discussionSubmitted Old code never dies: why legacy software is often safer than new code as a story · 3 points
HN discussionSubmitted Some useful tips about /dev/tcp as a story · 3 points
HN discussionSubmitted WhatsApp forensics in 2026 and what survives end-to-end encryption as a story · 2 points
HN discussionSubmitted Forensic tools as instruments of repression: Cellebrite use in Russia as a story · 2 points
HN discussionSubmitted Android pattern of life:hidden artifacts that reconstruct a user's daily routine as a story · 2 points
HN discussionSubmitted When the city becomes the weapon: IoT, AI, and the new face of warfare as a story · 2 points
HN discussionSubmitted Some useful tips about /dev/tcp as a story · 2 points
HN discussionSubmitted IMP4GT: IMPersonation Attacks in 4G NeTworks as a story · 2 points
HN discussionSubmitted YATTRSSC: compile the project on iOS and Android as a story · 2 points
HN discussionSubmitted The security program that only works when everyone is at their desk as a story · 1 points
HN discussionSubmitted Pass-ta-key attacks steal passkeys instead of passwords as a story · 1 points
HN discussionSubmitted Going beneath NTFS: USN Journal, dfir_NTFS, and artefact-driven investigations as a story · 1 points
HN discussionSubmitted eBPF rootkits and the Volatility blind spot in Linux memory forensics as a story · 1 points
HN discussionSubmitted All code is sorcery, until it isn't as a story · 1 points
HN discussionSubmitted The Trojan horse in your cluster: a deep dive into container image security as a story · 1 points
HN discussionSubmitted Standard Windows Processes as a story · 1 points
HN discussion
