Top all-time · #4821
Eli Grey
Personal blog · eligrey.com/blogprogrammingweb
Eli Grey's personal blog at eligrey.com covers programming and web. Since 2009, 16 different Hacker News readers have linked it 53 times, most often “Google Inbox spoofing vulnerability”. It is still writing: the last post was on 2025-02-17, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN commenters link Eli Grey's posts as references on browser and web topics: Chrome font rendering on Windows, a Gmail link-spoofing flaw, CSS via HTTP Link headers, and ad link fraud. None of the comments praise or criticise the writing.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Google Inbox spoofing vulnerability5 people · 6 mentions · first linked 2018-04-27
- Zerodrop: Open-source stealth URL toolkit for bypassing censorship filters2 people · 4 mentions · first linked 2018-05-23
- Big Tech's role in enabling link fraud2 people · 4 mentions · first linked 2024-01-15
- Better Font Smoothing in Google Chrome on Windows2 people · 2 mentions · first linked 2010-10-25
What Hacker News says?
Your proposal seems very reminiscent of the generator-based JavaScript async library I created back in 2010: https://eligrey.com/blog/pausing-javascript-with-async-js/
Comment linking /blog/pausing-javascript-with-async-js/
on “Modern Javascript: Everything you missed over the last 10 years (2020)”Submitted Big Tech's role in enabling link fraud as a story · 135 points
HN discussionThe answer to why: It helps with efficient allocation of worker thread pools. I helped make a timing attack[1] as justification for adding this API, and then presented this suggested API to each browser vendor along with the timing attack. The result was that every browser has adopted my suggestion. If this API was not present, ads could get this data in a more resource-intensive manner anyways. 1. https://eligrey.c…
Comment linking /blog/cpu-core-estimation-with-javascript/
on “Click”Submitted Big Tech's role in enabling link fraud – take 2 as a story · 101 points
HN discussionbit.ly had a similar vulnerability that I detected in 2008 through their bookmarklet. Unfortunately it seems I lost my exploit PoC. https://eligrey.com/blog/bitly-vulnerabilities/
Comment linking /blog/bitly-vulnerabilities/
on “Grammarly shared its tokens with all websites”Submitted Show HN: Favioli – Replace blank tab icons with unique per-domain emoji as a story · 94 points
HN discussionChromium is not a good alternative: 95% of Chromium commits come from Google. Or ... Chromium is the perfect alternative ... as long as it remains open source and privacy invasion can be easily stripped out of it. Let Google fund most of the development of a privacy respecting browser (i.e. Brave). And if it doesn't remain open source? Then it's time for a fork --- just like it is now with Firefox. Bottom line: If y…
Comment linking /
on “Tell Mozilla: it's time to ditch Google”Submitted Unverified vanity URLs and interest tracking catalyze fraud online as a story · 36 points
HN discussionIt is possible to optimization enumeration of residential ISPs by subtracting datacenter IP addresses (among other tricks I would imagine). I've targeted residential ISPs before in this project: https://eligrey.com/blog/zerodrop/
Comment linking /blog/zerodrop/
on “How to pay your rent with your open source project”Submitted Publicly-disclosed UXSS flaw was exploited against Opera users for over 2 years as a story · 18 points
HN discussionI wasn't aware that there were any laws about data breach settlements from 2012. I detected a breach at Macmillan Publishers around that time[1] and have been wondering if they were still liable. 1. https://eligrey.com/blog/bedford-st-martins-data-breach/
Comment linking /blog/bedford-st-martins-data-breach/
on “Zappos 2012 data breach settlement”Submitted Better Font Smoothing in Google Chrome on Windows as a story · 6 points
HN discussionGoogle has convinced regulatory agencies that they're not responsible for their own complicity with supporting link fraud. I wrote an article about Google's role in enabling link fraud[1], which shows how this is effectively a form of regulatory capture. Here's a particularly salient critique of these very same FBI recommendations, from my article: > The FBI suggests “Before clicking on an advertisement, check the U…
Comment linking /blog/link-fraud/
on “FBI recommends using an ad blocker (2022)”Submitted Spoofing vulnerability in Google Inbox as a story · 4 points
HN discussionChrome on Windows doesn't use the DirectWrite text rendering engine as opposed to Firefox or IE. See details here: http://eligrey.com/blog/post/better-font-smoothing-in-google... This has been an open issue since 2009. I'm surprised it still hasn't been fixed even though it's a daily nuisance in the world of beautiful web fonts and large type sizes: http://code.google.com/p/chromium/issues/detail?id=25541 http://cod…
Comment linking /blog/post/better-font-smoothing-in-google-chrome-on-windows
on “Beautiful web type: highlighting the best of the Google web fonts directory”Submitted Google Inbox spoofing vulnerability as a story · 4 points
HN discussionIf only Ladybird development had taken off sooner. The best balance of {respectful defaults, security, privacy, extensibility} out of the top 5 browsers seems to be Brave[1] for now, which isn't the most ideal situation. 1. https://eligrey.com/blog/choosing-a-browser/
Comment linking /blog/choosing-a-browser/
on “uBlock Origin forcefully disabled by Chrome”Submitted Choosing a Browser as a story · 3 points
HN discussionI wrote a library that adds support for this using yield: http://eligrey.com/blog/post/pausing-javascript-with-async-j...
Comment linking /blog/post/pausing-javascript-with-async-js
on “What's so great about JavaScript Promises?”Submitted Zerodrop: Open-source stealth URL toolkit for bypassing censorship filters as a story · 3 points
HN discussionThe list of Tor exit nodes is public. I can detect public Tor IP addresses and give them a different redirect with Zerodrop: https://eligrey.com/blog/zerodrop/
Comment linking /blog/zerodrop/
on “Twitter accounts are being hijacked for spam”Submitted Google Inbox spoofing vulnerability as a story · 3 points
HN discussionThey are completely forgetting about the standard cross-browser external.AddSearchProvider API. One-click install initiation works fine in both Chrome and Firefox in a DuckDuckGo + Google Suggest search plugin I put together at http://eligrey.com/blog/post/encrypted-duckduckgo-with-googl...
Comment linking /blog/post/encrypted-duckduckgo-with-google-suggest-search-plugin
on “Google competitor DuckDuckGo says it's getting shut out”Submitted Saving generated files on the client-side as a story · 3 points
HN discussionFunny considering Google still has a UX vulnerability in their gmail interface: https://eligrey.com/blog/google-inbox-spoofing-vulnerability... "The link mailto:”support@paypal.com”<scam@phisher.example> shows up as “support@paypal.com” in the Google Inbox composition window, visually identical to any email actually sent to PayPal." It has been fixed in the web version, but apparently the Android app still has thi…
Comment linking /blog/google-inbox-spoofing-vulnerability/
on “Google Phishing Quiz”Submitted Saving generated files on the client-side as a story · 2 points
HN discussionThere is even an actual Unicode symbol for the left-pointing magnifying glass ([1]) that they are using, yet they use the PUA anyways. I use the [1] Unicode symbol semantically on my blog with a custom font at http://eligrey.com/blog/ 1. Edit: Hacker News seems to have stripped the character from my message. I am referring to U+1F50D left-pointing magnifying glass.
Comment linking /blog/
on “Web Fonts Collateral Damage of Ad Blockers”Submitted Encrypted Duck Duck Go with encrypted Google Suggest as a story · 2 points
HN discussionUsing async.js ( http://eligrey.com/blog/post/pausing-javascript-with-async-j... ), you can do away with callbacks and still have asynchronous code by using the yield statement. The following is an example (taken from my blog post) of asynchronous code using async.js: yield to.request("/feedback", "POST", ( yield to.prompt("What are your impressions of async.js?") )); yield to.inform("Thanks for your feedback!"); //…
Comment linking /blog/post/pausing-javascript-with-async-js
on “I love async, but I can't code like this”Submitted Sandboxing JavaScript using web workers as a story · 2 points
HN discussion
