Top all-time · #8309
Connor's Blog
Personal blog · cedwards.xyz · on HN as cedwssecurityprogramming
Connor's Blog is a personal blog at cedwards.xyz about security and programming. Since 2021, 9 different Hacker News readers have linked it 25 times, most often “Instance Metadata Service Risks”. No feed was found, so read it on the site itself.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link cedwards.xyz for posts on using a 'defer' pattern for exit traps in Bash scripts and on Python packaging, including a piece about the number of Python packaging tools. The comments only link or describe the posts.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Instance Metadata Service Risks2 people · 2 mentions · first linked 2023-11-27
- Breaking up with Python2 people · 2 mentions · first linked 2022-12-29
- Defer for Shell2 people · 2 mentions · first linked 2023-06-20
- TPM-Backed SSH Keys on Windows 112 people · 2 mentions · first linked 2024-11-17
- The 'Fuck You' Pattern2 people · 2 mentions · first linked 2021-06-28
What Hacker News says?
Secretive is a bit friendlier to set up but I'll probably switch to this anyway so I have one less app on my computer. Plugging my blog post for how to achieve this on Windows 11: https://cedwards.xyz/tpm-backed-ssh-keys-on-windows-11/
Comment linking /tpm-backed-ssh-keys-on-windows-11/
on “Native Secure Enclave backed SSH keys on macOS”Submitted The 'Fuck You' Pattern as a story · 1202 points
HN discussionI called it: https://cedwards.xyz/github-actions-are-an-impending-securit...
Comment linking /github-actions-are-an-impending-security-disaster/
on “Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos”Submitted Use this kernel parameter in your kiosk as a story · 129 points
HN discussion>and malware looking to elevate root can just rig up ~/.bashrc, what use is this patch? Apologies for self promotion, but I wrote a relevant blog post that discusses this[0]. Is there any way of mitigating this trivial attack? I feel like the Unix/Linux security model is broken. [0]: https://cedwards.xyz/sudo-is-broken/
Comment linking /sudo-is-broken/
on “Try to make sudo less vulnerable to Rowhammer attacks”Submitted Breaking up with Python as a story · 53 points
HN discussionI have suspected Tor has been busted for quite a long time. LE is only using this power selectively for now - the last thing that they want is to scare users away lest they go and build something more secure. The Nym mixnet[0] seems promising but it's still new and unproven. I had an idea a while back to make traffic analysis more difficult by building circuits distributed across adversarial countries. Would like to…
Comment linking /adversarial-routing/
on “Law Enforcement Undermines Tor”Submitted Use (at)Protonmail.com at Your Peril as a story · 5 points
HN discussionI wish I could rejoice at the adoption of VR but I can only feel despair that Facebook of all companies is leading the way. I owned an Oculus CV1 for 2 years and loved it. It completely shifted my perspective on VR, changing me from a naysayer to an enthusiast. Then Facebook began strengthening its grasp on Oculus by making account migration mandatory, and I decided not to comply and got rid of my headset instead. F…
Comment linking /goodbye-oculus/
on “Facebook has sold 4M Quest 2 headsets in the US, recall docs reveal”Submitted The Devil's Investment UX as a story · 3 points
HN discussionGitHub doesn't really seem to prioritise security. I just reported a nasty way to smuggle code[0] into Actions pipelines to them and got a classic "expected behaviour WONTFIX” response. It's exactly the kind of sneaky behaviour that the Jia Tans out there would use in an attack. [0] (see end of) https://cedwards.xyz/github-actions-are-an-impending-securit...
Comment linking /github-actions-are-an-impending-security-disaster
on “Zizmor would have caught the Ultralytics workflow vulnerability”Submitted Uncloud: A Fresh Take on Workload Orchestration as a story · 2 points
HN discussionI warned about this, but you didn’t have to be clairvoyant to see it coming: https://cedwards.xyz/github-actions-are-an-impending-securit... GitHub are cutting corners and not working on making their CI/CD offering secure.
Comment linking /github-actions-are-an-impending-security-disaster/
on “GitHub suffers a cascading supply chain attack compromising CI/CD secrets”Submitted TPM-Backed SSH Keys on Windows 11 as a story · 2 points
HN discussionThere’s another foot gun I wrote about recently: https://cedwards.xyz/passkeys-are-not-2fa/
Comment linking /passkeys-are-not-2fa/
on “Don't use passkeys for encrypting user data”Submitted Instance Metadata Service Risks as a story · 2 points
HN discussionWindows kind of has this in the form of UFW. You can have either a RAM or disk based overlay for your C: partition and all writes will go to the overlay, which can be wiped. Except there are specific paths which must be excluded otherwise Windows craps itself. You also have to set up the overlay after the sysprep phase which inits drivers and stuff. https://cedwards.xyz/messing-around-with-windows-unified-wri...
Comment linking /messing-around-with-windows-unified-write-filter/
on “The Mutable OS: Why Isn't Windows Immutable in 2025?”Submitted The 'Fuck You' Pattern as a story · 2 points
HN discussionThe IMDS is useful, and these changes definitely make it safer, but it is also inherently risky. I wrote a blog post[0] about the risks it introduces. One of them being that any process on your VM instances can hit the IMDS and get credentials, allowing it to perform any action that the assigned role can perform. A simple role that allows apps to write logs to a bucket could be used for exfiltration if the policy is…
Comment linking /instance-metadata-service-risks/
on “Amazon EC2 Enhances Defense in Depth with Default IMDSv2”Submitted OTP in Your Password Manager Is Not 2FA as a story · 1 points
HN discussionhttps://cedwards.xyz/defer-for-shell/ Enjoy. (blog post is mine)
Comment linking /defer-for-shell/
on ““Exit Traps” Can Make Your Bash Scripts Way More Robust and Reliable”Submitted Tofu: Do You Check? as a story · 1 points
HN discussionJust wanted to share my blog post about why I think sudo is broken: https://cedwards.xyz/sudo-is-broken/
Comment linking /sudo-is-broken/
on “Sudo without a setuid binary or SSH over a Unix socket”Submitted Defer for Shell as a story · 1 points
HN discussionhttps://cedwards.xyz/breaking-up-with-python/ Bear in mind this was not written for an audience, let alone a HN audience.
Comment linking /breaking-up-with-python/
on “How to improve Python packaging, or why 14 tools are at least 12 too many”