Top all-time · #3829
Robert Alexander
Personal blog · alexsci.com/blog · on HN as 8organicbitssecuritysystems
Robert Alexander's personal blog at alexsci.com covers security and systems. Since 2019, 20 different Hacker News readers have linked it 117 times, most often “Name Constrain't on Chrome”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Comments link this blog's RSS blogroll network, an aggregate of small personal blogs' blogrolls, and a quote from a CORS article. None of the comments judge the blog's own writing.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Name Constrain't on Chrome2 people · 9 mentions · first linked 2023-04-01
- Designing Personal Software Why we need more to-do apps2 people · 5 mentions · first linked 2024-02-25
- A mental model for EC2 on-demand pricing2 people · 5 mentions · first linked 2023-05-07
- Oops, My UUIDs Collided2 people · 4 mentions · first linked 2025-10-31
- Is Email Confidential in Transit Yet?2 people · 4 mentions · first linked 2024-11-05
- Relicensing Monitor2 people · 4 mentions · first linked 2024-04-25
- Identify Common Software Licenses2 people · 3 mentions · first linked 2021-09-06
- Uptime of GitHub Pages Alternatives2 people · 2 mentions · first linked 2026-03-26
- UUIDv7: Timestamps aren’t time-ordered and other oddities2 people · 2 mentions · first linked 2026-10-23
- RSS blogrolls are a federated social network2 people · 2 mentions · first linked 2024-05-14
What Hacker News says?
Another variant of this is cached or preloaded security configurations. HSTS (which forces browsers to validate HTTPS when connecting) asks browsers to cache the configuration for a set "max-age". Some sites set huge values here, like Twitter's 20 year max-age[1]. There's also the preload lists [2] to consider. This creates a problem if you want to serve non-HTTPS/unencrypted HTTP on your new domain and the previous…
Comment linking /blog/smtp-downgrade-attacks-and-mta-sts/
on “Before you buy a domain name, first check to see if it's haunted”Submitted Discovering the indieweb with calm tech as a story · 229 points
HN discussionYou should read about OPML blogrolls [1], they are gaining traction in this space. Personally, I like the idea of manually exploring recommendations, so I built a browsable index [2]. But you can crawl the these as well and build all sorts of recommendations engines. [1] https://opml.org/blogroll.opml [2] https://alexsci.com/rss-blogroll-network/discover/feed-c550c...
Comment linking /rss-blogroll-network/discover/feed-c550c508de4e5f2500785a76c79ba383/
on “I ditched the algorithm for RSS”Submitted UUIDv7: Timestamps aren’t time-ordered and other oddities as a story · 185 points
HN discussionAgreed, and there's a few projects with CLAs that are ranked lower due to mitigating factors, like K8s [1]. I honestly don't get why they have a CLA, anyone know? The impact of developer good will is difficult to measure, so I don't attempt it. Redis burned community good will so badly with their relicensing that several forks rapidly emerged. Seemed like a predictably poor decision to me. I also don't want to pick…
Comment linking /relicensing-monitor/projects/kubernetes/
on “Ask HN: What are you working on (August 2024)?”Submitted Why UUIDs won't protect your secrets as a story · 75 points
HN discussionFirefox scores well because it uses a copyleft license and the ability to relicense contributions remains with the original authors. Mozilla can't unilaterally relicense the Firefox code base as they haven't been granted that ability by the contributors. The copyleft license means they can't slap a new license on top (like a permissive license allows). The rating criteria was designed to consider legal facators, lik…
Comment linking /relicensing-monitor/projects/firefox/
on “Ask HN: What are you working on (August 2024)?”Submitted SMTP Downgrade Attacks and MTA-STS as a story · 25 points
HN discussionThe recent relicensing of Redis to a non-open-source license bothered many in the community. But the groundwork for the relicensing was laid much earlier. I've been working on relicensing monitor to track various projects attributes that can affect the ease of relicensing a project. https://alexsci.com/relicensing-monitor/
Comment linking /relicensing-monitor/
on “Ask HN: What are you working on (August 2024)?”Submitted RSS blogrolls are a federated social network as a story · 6 points
HN discussionYeah, seems like a good fit. It will end up here, if I get to it. https://alexsci.com/blog/
Comment linking /blog/
on “Ban me at the IP level if you don't like me”Submitted UUIDv7 doesn't have the properties you think it does as a story · 5 points
HN discussionI've been building something vaguely similar, which includes many languages. Be sure to adjust the language filter, although it should auto-detect based on browser language. https://alexsci.com/rss-blogroll-network/discover/
Comment linking /rss-blogroll-network/discover/
on “SlopStop: Community-driven AI slop detection in Kagi Search”Submitted Choosing Vim over VSCode as a story · 5 points
HN discussionYes! Context specific CA trust would be great, but AFAIK isn't possible yet. Even name constraints, which are domain name limitations a CA or intermediate cert place on itself, are slowly being supported by relevant software [1]. As a contractor, I'll create a per-client VM for each contract and install any client network CAs only within that VM. [1] https://alexsci.com/blog/name-non-constraint/
Comment linking /blog/name-non-constraint/
on “.INTERNAL is now reserved for private-use applications”Submitted Designing Personal Software Why we need more to-do apps as a story · 5 points
HN discussionI built a partial list last year [1]. It's challenging to decide which CAs are government operated or controlled: the names don't always make it clear, private companies may operate under government direction, law may require CAs to follow government requests. These were all very clearly government/military organizations running CAs. The Brazilian CA referenced here is number two on the list. [1] https://alexsci.com…
Comment linking /blog/ca-trust/
on “A Brazilian CA trusted only by Microsoft has issued a certificate for google.com”Submitted An HTTP header caused time.gov to skew from UTC as a story · 4 points
HN discussionI think support for name constraints is much better now, but I think someone needs to correctly audit it. We need near universal adoption for it to be considered a usable tool. I researched the issue a little here: https://alexsci.com/blog/name-non-constraint/
Comment linking /blog/name-non-constraint/
on “A Brazilian CA trusted only by Microsoft has issued a certificate for google.com”Submitted Relicensing Monitor: Project Listing as a story · 4 points
HN discussionI'm very aware of DigiNotar, I wrote a blog post last year that discusses DigiNotar and even mentions Brazil/ITI [1]. A challenge for Microsoft is that they aren't transparent in their inclusion decisions, so we can only speculate why they chose to trust this CA. What gives you confidence that Microsoft is doing careful vetting? In stark contrast, Mozilla publicly and extensively documented why they didn't trust thi…
Comment linking /blog/ca-trust/
on “A Brazilian CA trusted only by Microsoft has issued a certificate for google.com”Submitted Designing Personal Software: Why we need more to-do apps as a story · 4 points
HN discussionI've been collecting OPML blogrolls for a project, here's over one hundred I've found. I'll add this one too. https://alexsci.com/rss-blogroll-network/blogrolls/
Comment linking /rss-blogroll-network/blogrolls/
on “Show HN: Engineering.fyi – Search across tech engineering blogs in one place”Submitted Oops, My UUIDs Collided as a story · 3 points
HN discussionI'm working on some writing on my blog [1], trying to improve my writing and explore style. My current series of post follows the surge of interest in UUIDs with the uptake of UUIDv7. I've seen some subtle misunderstandings spreading, so I dive into nuance. This has spun off some mini projects, like an RFC compliant UUIDv8 implementation based on XKCD 221 [2] (humor intended). I think I have two more in the blog ser…
Comment linking /blog/uuid-oops/
on “Ask HN: What Are You Working On? (Nov 2025)”Submitted Is Email Confidential in Transit Yet? as a story · 3 points
HN discussionThe quick-to-build game model is quite fun. At the start of the pandemic I created a few games, probably about 30min each. My toddlers got to feel part of the process (which unicode emojis should I use?) and they played the games for much longer than I took to build them. These are by no means at the quality of the submission, but they were how my kids learned to use a mouse and keyboard. I definitely encourage othe…
Comment linking /games/
on “Making small games, which is fun in itself”Submitted A mental model for EC2 on-demand pricing as a story · 3 points
HN discussionBeautiful! Thanks for open sourcing this! I've been working on a project [1] that probably wants to become a live crawler like this, but it's currently batch based. I'm focused on RSS feeds and microformats [2]. Can you share any details on what kind of performance / operational costs you're seeing while you're on the HN front page? The fly.toml looks like $5/month could suffice? [1] https://alexsci.com/rss-blogroll…
Comment linking /rss-blogroll-network/
on “Show HN: I made tool that let's you see everything about any website”Submitted Challenges facing the CAs and why we still trust them (2023) as a story · 2 points
HN discussion
