Top all-time · #11628
EdOverflow
Personal blog · edoverflow.com · on HN as EdOverflowsecurityprogramming
EdOverflow is a personal blog at edoverflow.com about security and programming. Since 2017, 6 different Hacker News readers have linked it 9 times, most often “Exploring Continuous Integration Services as a Bug Bounty Hunter”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link Ed Overflow's security writing, here a 2018 post on logic flaws in web-of-trust services, including namespace attacks. The commenter cites it to show security.txt authors found the issue.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Web developer, security researcher, Team Lead & Senior Pentester at Cure53, and author of security.txt (RFC 9116). Explore bug bounty, open source, and …
Most-linked posts?
- Exploring Continuous Integration Services as a Bug Bounty Hunter2 people · 2 mentions · first linked 2019-04-26
What Hacker News says?
I am a security researcher referenced in the winning web-hacking technique on that list ("Dependency Confusion" by Alex Birsan [1]) and was ranked 7th in Portswigger's 2019 issue [2,3]. My motto has always been "Learn to make it; then break it." In other words, I invest a lot of time familiarising myself with technologies and specifications before examining how their implementation might lead to security flaws. This…
Comment linking /2019/ci-knew-there-would-be-bugs-here/
on “Web hacking techniques of 2021”Submitted GNU ed ate my homework as a story · 113 points
HN discussionFunny thing that you mention it here as one of the authors of security.txt found this exact issue on several sites: https://edoverflow.com/2018/logic-flaws-in-wot-services/ section "Attack Vector Two – Namespace attacks"
Comment linking /2018/logic-flaws-in-wot-services/
on “The “security.txt” proposal reached last step in the IETF process”Submitted Exploring Continuous Integration Services as a Bug Bounty Hunter as a story · 5 points
HN discussionAside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”Submitted Broken Link Hijacking – How expired links can be exploited as a story · 4 points
HN discussionSubmitted An analysis of logic flaws in web-of-trust services as a story · 3 points
HN discussionSubmitted What Bypassing Razer's DOM-Based XSS Patch Can Teach Us as a story · 2 points
HN discussionSubmitted Bypassing SSRF filters by abusing a bug in Ruby's native resolver as a story · 2 points
HN discussion