Top all-time · #12595
Cookie Engineer's Website
Personal blog · cookie.engineer/weblog · on HN as cookiengineersecurityprogramminghardware
Cookie Engineer's Website is a personal blog at cookie.engineer about security, programming and hardware. Since 2020, 6 different Hacker News readers have linked it 49 times, most often “Firefox Privacy Guide”. It is still writing: the last post was on 2026-09-16, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Cookie Engineer's personal website, linked on HN as a fun find that amused readers. Commenters mention playing a game on it and its Sith Lord themed redesign.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cookie Engineer's Ideas and Projects
Most-linked posts?
- /2 people · 2 mentions · first linked 2022-03-27
- Firefox Privacy Guide2 people · 2 mentions · first linked 2025-08-31
What Hacker News says?
This actually reminds me of an idea I had for my own website [1] when I redesigned it, but I wasn't going for a quine and rather made use of copy/paste with a simpler format. I implemented a copy/paste feature using dummy elements that are only visible when being selected, so that when someone wants to copy text from my website, it will be copied as markdown notation (which was the originating article format before…
Comment linking /design/copypaste.js
on “This page is a truly naked, brutalist HTML quine”Submitted Write Linters and Tools Before Code as a story · 14 points
HN discussionThis. I heavily invested in a local runner based CI/CD workflow. First I was using gogs and drone, now the forgejo and woodpecker CI forks. It runs with multiple redundancies because it's a pretty easy setup to replicate on decentralized hardware. The only thing that's a little painful is authentication and cross-system pull requests, so we still need our single point of failure to merge feature branches and do code…
Comment linking /weblog/articles/malware-insights-github-actions-script-injection.html
on “The Pain That Is GitHub Actions”Submitted Firefox Privacy Guide as a story · 4 points
HN discussionhttps://cookie.engineer Built my website as a fun project over the holidays and experimented a little with fun to use UI/UX elements while trying to preserve as much backwards compatibility as possible. Copy/paste uses markdown, which is used to generate the static site, print stylesheets, responsive layout, an interactive avatar, a crypto scavenger hunt, konami code, zerg rush, and works without javascript or even…
Comment linking /
on “Ask HN: Share your personal site”Submitted Malware Insights: GitHub Actions Script Injection as a story · 4 points
HN discussionNote that the author misses an essential point: custom compression dictionaries, which can only be used by WebSockets (WS13) and hardly by the others, as that would break compatibility. I'd argue that you can push websocket data usage way lower than the other protocols, if you use a binary compression based on a predefined schema. In WebSockets, you can use plug&play extensions which can modify the payload on both t…
Comment linking /weblog/articles/implementers-guide-to-websockets.html
on “WebSockets vs. Server-Sent-Events vs. Long-Polling vs. WebRTC vs. WebTransport”Submitted Implementer's Guide to Socks (Protocol) as a story · 4 points
HN discussion> Build something people want I can recommend building something for fun, just for yourself without anything of the business-y metrics. When I had a demotivated phase I started to build my website for fun, and didn't give a damn about anything people would say of it. [1] That ignited the motivation to build my own tools again and led to the motivation of finding something other people might need, too. A lot of "olde…
Comment linking /
on “Ask HN: Why can't I learn anymore?”Submitted Show HN: I remade my website in the Sith Lord Theme and I hope it's fun as a story · 3 points
HN discussionI built lots of tools in the past, and most of them are open sourced and/or available as an archived snapshot via my website [1] One of the projects I failed to make money with but that I'm still proud of is lychee.js [2] - it used game engine concepts to build a generic graph/scene for "normal" applications. But the twist is that every state and property can be serialized, deserialized, and reconstructed over the t…
Comment linking /
on “Ask HN: What are some tools / libraries you built yourself?”Submitted Implementer's Guide to WebSockets as a story · 3 points
HN discussionA couple months ago I posted the "Implementer's guide to WebSockets" that I wrote, but it seemingly got shadowbanned. [1] I wrote the guide with example code for people wanting to know how to implement the complete WS13 protocol from scratch, so you can try it out, fiddle around and modify it to your needs. The guide is more in-depth and assumes that the reader is willing to read the RFC when they're stuck :) [1] ht…
Comment linking /weblog/articles/implementers-guide-to-websockets.html
on “The WebSocket Handbook”Submitted Show HN: Implementer's Guide to WebSockets as a story · 3 points
HN discussionThis is written by a person who never used LLMs. LLMs need a language that: - has opinions about how to write standard code - has opinions about one way of formatting and codestyle - has opinions about linting and integrated debugging - has predictable strong types - has opinions about integrated unit testing and a standard way to write them - has an integrated toolchain - has a strong stdlib and an upstreamed way t…
Comment linking /weblog/articles/write-linters-and-tools-before-code.html
on “Why Common Lisp is now the best programming language”Submitted Malware Insights: macOS Phexia Campaign as a story · 2 points
HN discussionThis attack surface is essentially unfixed for almost a year now. Remember the python packages that got pwned with a malicious branch name that contained shellshock like code? Yeah, that incident. I blogged about all vulnerable variables at the time and how the attack works from a pentesting perspective [1]. [1] https://cookie.engineer/weblog/articles/malware-insights-git...
Comment linking /weblog/articles/malware-insights-github-actions-script-injection.html
on “Pwning the Nix ecosystem”Submitted You don't need LPM Tries (2023) as a story · 2 points
HN discussionUnrelated, but if I try to send you a message on https://cookie.engineer/contact.html it says "Could not send message, check ad-blocking extension", but I'm pretty sure I turned them off and it still doesn't work Also, the best starter is charmender
Comment linking /contact.html
on “Ask HN: Website with 6^16 subpages and 80k+ daily bots”Submitted (Updated) Implementer's Guide to WebSockets as a story · 2 points
HN discussionThis is kind of a stupid ChatGPT article. No, this will not effectively help to reduce the fingerprint of your Browser. A LOT more tracking services are integrated into the Firefox browser in various places (like New Tab page, Sync, Pocket, Shavar, Google Safebrowsing, OSCP, etc pp). I wrote a more detailed article about this, and got an "as good as possible" as a result. But yeah, please please start to use a Host…
Comment linking /weblog/articles/firefox-privacy-guide.html
on “Hardening Firefox – a checklist for improved browser privacy”Submitted Malware Insights – Miasma Campaign as a story · 1 points
HN discussionMaybe you have issues with the synaptics driver? In case you do, I wrote an in-depth configuration guide for it a while ago [1]. Maybe this helps? [1] https://cookie.engineer/weblog/articles/synaptics-touchpad-o...
Comment linking /weblog/articles/synaptics-touchpad-on-linux.html
on “Show HN: Komorebi – A tiling window manager for Windows 10/11 written in Rust”Usually when I read something like this I am worried about the false sense of security that SOCKS proxy users give themselves. SOCKS is a very outdated protocol, that's why I wrote an in-depth article about it. The TLDR is kinda like this: - don't use socks proxy passwords, they're plaintext or work only with pre-shadow BSD 0.x. - IPv6 doesn't work. TOR socks proxy supports it but no Browser does. - DNS isn't tunnel…
Comment linking /weblog/articles/implementers-guide-to-socks.html
on “VPN over SSH? The Socks Proxy”In addition to this: Carrier grade NAT ISPs sometimes have global scope ipv6s assigned, and if the other endpoint has ipv6 support, too, you can breakout easily using the assigned ipv6. Rather than that I would recommend reading up on DNS exfiltration techniques [1] and things like pwnat [2] that use faked SNMP reply packets that make routers think they forgot to let a data packet through for hop traces. And if you…
Comment linking /weblog/articles/implementers-guide-to-socks.html
on “How Git servers work, and how to keep yours secure”Here's another that I discovered today: not a hobby project but a personal webpage that got me rotfl. https://cookie.engineer/
Comment linking /
on “Show HN: Which animal shares your body fat percentage?”Back in the days I developed a webmail interface and backend [1] for myself because GMail got unusable on Windows CE devices while they were still on the market in Germany. Designing a website with WAP-level of HTML is quite a challenge, but it's possible. And it works so well with 2G slow connections that you start to appreciate it when your "flatrate" is throttled again. If you try to use any website in the new we…
Comment linking /
on “Design for Obsolete Devices”I think that the way HTML5 is used these days is more as a way to build a design, rather than a way to deliver semantic content. When looking at the Alexa top 1000, you'll find not a single semantic website that cares about their markup, most of them not even having an alternative text for images. The Semantic Web also came with the idea of separating content, design and functionality; and came with the idea of havi…
Comment linking /
on “The Semantic Future of the Web”My website [1] is handcoded and I decided to push ES6 with ESM modules without any bloated build toolchain. The website should work without JS but all the interactive features, gimmicks and improving parts are done with a bit of JS and CSS trickery ;) Code for the weblog is statically pregenerated, and the article format is markdown. I mostly built it for fun over the holidays, and decided to keep it as a creative s…
Comment linking /
on “Ask HN: What are solid examples of well written HTML and CSS websites?”yawns Good morning world, Here's the updated Antimiasma tool for mitigation [1] [2]. More details on how this tool was built and how the Miasma worm works on my website [3]. This is the first false flag in the campaign series, where setting the "LANG" environment variable to "ru_RU.UTF-8" or "ru_RU.KOI8-R" won't stop the spreading mechanism. So it's likely this could've been any script kiddie that modified the TeamP…
Comment linking /projects/cyber-defense/antimiasma.html
on “Keyv and friends compromised in active Shai-Hulud supply chain attack”