Top all-time · #8716
D
Daniel Shumway
Personal blog · danshumway.com/blog · on HN as danShumwaywebsecurityprogramming
Daniel Shumway's personal blog at danshumway.com covers web, security and programming. Since 2018, 9 different Hacker News readers have linked it 52 times, most often “Chrome Audio Is Broken”. The last post was in 2020, but the archive is still widely read.
52mentions?
9HN people?
2018–2024first – last linked?
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Daniel Shumway's blog for posts on web platform and browser behaviour, game development, the open-sourcing of Amnesia, and the 'Reset Hard' announcement.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
My name is Daniel Shumway and I build things on the Internet.
Most-linked posts?
- Chrome Audio Is Broken4 people · 8 mentions · first linked 2018-08-20
- The Design is the Implementation3 people · 5 mentions · first linked 2018-08-14
- Disclosing multiple Gamasutra vulnerabilities2 people · 5 mentions · first linked 2018-11-05
What Hacker News says?
> In reality, they do nothing to improve security This is a bad take. I don't have the energy/time to go too in depth at the moment, but I've commented in more detail in the past. The short version: - HTTPS isn't perfect, sites sometimes support old encryption protocols that can leak resource information. Most users aren't checking packets from native apps to ensure they're being sent over HTTPS, and browsers don't…
Comment linking /blog/gamasutra-vulnerabilities/
on “Mozilla VPN”Submitted The Design is the Implementation as a story · 67 points
HN discussionhttps://danshumway.com https://danshumway.com/rss.xml Most of my posts are about technical topics, but they rarely end up being pure tutorials; they're usually relating back to system design, projects/games, or current events. My blog also features no Javascript requirements and no tracking of any kind, including Google Analytics. I'm in the middle of a rewrite that will make it even smaller and faster to load, and…
Comment linking /blog/design-is-implementation/
on “Ask HN: What is your blog and why should I read it?”Submitted The Design Is the Implementation as a story · 30 points
HN discussion> I'm not advertising on my blogs Perhaps you should, I enjoyed finding stuff like this : https://danshumway.com/blog/gamasutra-vulnerabilities/
Comment linking /blog/gamasutra-vulnerabilities/
on “Please Add RSS Support to Your Site”Submitted Disclosing Multiple Gamasutra Vulnerabilities as a story · 4 points
HN discussionKudos! Also, I just checked out your personal site and WOW does "Reset Hard" (2018) sound amazing! https://danshumway.com/blog/reset-hard-announcement/ On my phone, no time now to look closer but plan to soon.
Comment linking /blog/reset-hard-announcement/
on “Amnesia is now open source”Submitted The Hypocrisy of 1.1.1.3 as a story · 2 points
HN discussion> Having a nuclear option for just these people is fine I think that would be fine, I'm certainly not against sensible defaults. But I don't think any browser currently has a good implementation of that nuclear option The distinction between video types shouldn't be something that's baked into the core design of the feature itself. As it stands, I have no idea how I'd even start to implement a good nuclear option on…
Comment linking /blog/chrome-autoplay/demo/
on “Latest Firefox rolls out Enhanced Tracking Protection 2.0”Submitted Chrome Audio Is Broken as a story · 2 points
HN discussionShort version of a long story! A few years ago Google implemented autoplay blocking in Chrome. It was designed to fix problems like this, but was riddled with issues. I wrote about it at https://danshumway.com/blog/chrome-autoplay/ . The spec evolved a little bit since then, so not everything in that post is up to date, but most of the core problems still remain (or did the last time I checked). Firefox was forced t…
Comment linking /blog/chrome-autoplay/
on “Latest Firefox rolls out Enhanced Tracking Protection 2.0”Submitted Chrome's Autoplay Policy Is Broken as a story · 2 points
HN discussionAs a quick side note, I just want to throw out how grateful I am both as a developer and as a user that Firefox handled autoplay blocking in a sane way. - An actual notification the user can see and control, which means as a developer I can give people an easy way to re-enable audio if something breaks. - Actual user controls instead of an opaque algorithm I can't override that randomly decides for me on the fly whe…
Comment linking /blog/chrome-autoplay/demo/
on “Firefox 65.0 released”Submitted Using DNS and SSL to secure internal networks as a story · 1 points
HN discussionThe very partial solution that I've been experimenting with and trying to refine is to "abuse" DNS records and Certbot's DNS tests so that I can have a bunch of public subdomains that point at intranet sites.[0] There's no rule that says you can't point a DNS record at a local IP. This really isn't a full solution though because there are instances where you don't want a public DNS record at all. It's also not parti…
Comment linking /blog/encrypting-internal-networks/
on “Chrome’s address bar will use https:// by default”Submitted Disclosing multiple Gamasutra vulnerabilities as a story · 1 points
HN discussionI'm fairly new to this process myself but I'm finding the trick is to keep your designs extremely clean and easy to mentally model using types you can reason about. Then your software's features can emerge as interactions between "systems". That way (along with many other benefits) there's less to remember as you start coding. I find this post from the other day explains the principle better than I can: https://dans…
Comment linking /blog/design-is-implementation/
on “Craft: A simple Minecraft clone written in C using OpenGL shaders”Submitted Mess with This: Reset Hard's Approach to Modding as a story · 1 points
HN discussionHeavy, heavy disagree. Tiny example, but just because it's on my mind that I need to rewrite it soon: https://danshumway.com/resume . This is almost per-pixel identical to the resume layout that I used to have laid out in a normal editor exclusively for PDF and print, but without making a single concession with my normal print layout, it also seamlessly collapses into single columns perfectly fine on mobile devices,…
Comment linking /resume
on “How to center a div in CSS”Submitted Browser testing in Node for beginners as a story · 1 points
HN discussion> Also, AudioContext is expected to be active only when created within a user action like a button click. I really hate the user-action restriction as a security measure, because it's ridiculously easy to bypass[0], particularly on Chrome. It's privacy theater -- annoying for legitimate developers, but easy for malicious actors to get around. Putting this stuff behind a permission or sandboxing it somehow would be b…
Comment linking /blog/chrome-autoplay/demo/
on “Audio Fingerprinting using the AudioContext API”Thanks! If you're interested in this design philosophy of having almost radical consistency within a game's systems, I wrote a blog post early on in development about how that influences the way the game is coded. It's a little out of date; since writing it some of the mechanics have changed, but it still provides a good overview of what I mean when I say that nothing in the game is faked. https://danshumway.com/blo…
Comment linking /blog/design-is-implementation/
on “Ask HN: What are you working on?”https://danshumway.com RSS: https://danshumway.com/rss.xml [0] Video Content: https://peertube.danshumway.com I use very similar tech stacks for https://loop-thesis.com and https://distilledjs.com . I should probably get around to setting up a Mastadon instance as well, but I'm not completely sure I want one yet. ---- [0]: I realize that some people would prefer full RSS feeds, but I just haven't had time to add one…
Comment linking /rss.xml
on “Into the Personal-Website-Verse (2019)”I quit my job around two weeks ago (post: https://danshumway.com/blog/leaving-oracle/ ). I'm mostly working on Open Source now, might expand to contracting in the future. It was not an easy decision to make; I don't know if that's because of the culture I was in or just because of me. What eventually pushed me was realizing that it wasn't an all or nothing venture; the most realistic worst case scenario is that I fl…
Comment linking /blog/leaving-oracle/
on “How to Quit a Top Tier Tech Job”Breaking the cycle can't be done by only one side. If good maintainers aren't put in contact with good critiques, then they'll eventually assume every take on their work is purely reactionary. But in the same way, if good critics who take the time to write detailed critiques aren't listened to, then they'll eventually get tired and stop engaging. One side can't put in all of the work, or we'll end up in the same exa…
Comment linking /blog/chrome-autoplay/
on ““We plan to hide ‘https’ scheme and subdomain ‘www’ in Chrome omnibox in M76””This is good. All of this stuff is possible to do already with 3rd-party frameworks with varying levels of performance/reliability, and there may be other methods you use to sanitize your output. If you're a responsible developer, if you have experience trying to guard against XSS, or if you're working with a framework like React/Vue/whatever, this may not change much about your life. However, I think it's understat…
Comment linking /blog/gamasutra-vulnerabilities/
on “Google, Mozilla Close to Finalizing Sanitizer API for Chrome and Firefox Browse”In Firefox, under about:config, disable `media.peerconnection.enabled`. You should consider doing that anyway if you're worried about IP leaks because in some cases peer connections can unmask your IP address behind a VPN. I'm in the midst of switching my hosting off of Youtube and on to Peertube. I don't run Google analytics or any ads on my sites, I make sure that most of my stuff can work without Javascript. I'm…
Comment linking /blog/gamasutra-vulnerabilities/
on “PeerTube 2.1”I wrote a similar post about a year ago[0], but even at the time I wasn't the first to come up with this idea. As someone who doesn't have a lot of experiences with DNS security, seeing other people floating similar setups without significant pushback gives me more confidence that the core idea isn't horribly unsafe. I'm pretty happy/relieved to see other people playing around in the same space. My perspective was (…
Comment linking /blog/encrypting-internal-networks/
on “Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt”---- Senior-level Javascript/Typescript Consulting/Contracting ---- Location: East Coast (Philly area) Remote: Required Willing to relocate: No Technologies: Full stack JavaScript/Typescript (Node, React, Vue, etc...), modern CSS/HTML patterns/frameworks like Tailwind and BEM. The usual tools and systems: Git, Linux, Mongo, etc... I'm comfortable reading and playing with languages like C#, Python, Bash, and PHP, alt…
Comment linking /resume
on “Ask HN: Who wants to be hired? (January 2024)”Cynical? Yes. Is that the state of the world? Yes. Browsers are platforms that are as complex as OSes these days. And any bugs or changes in how they work will affect you app if your app is PWA. - It could be Chrome breaking audio: https://danshumway.com/blog/chrome-autoplay/ - It could be Chrome breaking LocalStorage: this discussion - It could be Chrome removing support for a web standard that was implemented and…
Comment linking /blog/chrome-autoplay/
on “LocalStorage or WebSQL unexpectedly cleared”
