Top all-time · #949
ENOSUCHBLOG
Personal blog · blog.yossarian.net · on HN as woodruffwprogrammingsecuritysystems
ENOSUCHBLOG is a personal blog at blog.yossarian.net about programming, security and systems. Since 2017, 72 different Hacker News readers have linked it 201 times, most often “Weird architectures weren't supported to begin with”. It is still writing: the last post was on 2026-08-31, and you can follow it by feed.
Most-linked posts?
- Weird architectures weren't supported to begin with8 people · 9 mentions · first linked 2021-02-28
- We should all be using dependency cooldowns7 people · 9 mentions · first linked 2025-11-21
- Anybody can write good bash (with a little effort)6 people · 6 mentions · first linked 2020-01-23
- PGP signatures on PyPI: worse than useless5 people · 9 mentions · first linked 2023-05-21
- totally_safe_transmute, Line-by-Line (2021)5 people · 6 mentions · first linked 2021-03-16
- Zizmor would have caught the Ultralytics workflow vulnerability5 people · 5 mentions · first linked 2024-12-06
- Writing and publishing a Python module in Rust4 people · 4 mentions · first linked 2020-08-02
- How x86_64 Addresses Memory4 people · 4 mentions · first linked 2020-06-13
- Implementing the Clipper Chip Cipher3 people · 4 mentions · first linked 2020-03-09
- Dates That Don't Exist (2015)3 people · 4 mentions · first linked 2018-05-15
What Hacker News says?
The point of the cooldown is to allow time for vendor scans to complete and for compromised packages to be pulled. It's not about waiting for an end user to notice they've been compromised. > Meanwhile, the aforementioned vendors are scanning public indices as well as customer repositories for signs of compromise, and provide alerts upstream (e.g. to PyPI). https://blog.yossarian.net/2025/11/21/We-should-all-be-usin…
Comment linking /2025/11/21/We-should-all-be-using-dependency-cooldowns
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted We should all be using dependency cooldowns as a story · 489 points
HN discussionThe "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...
Comment linking /2025/11/21/We-should-all-be-using-dependency-cooldowns
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted Be Aware of the Makefile Effect as a story · 431 points
HN discussionSettlement between banks in the United States is astoundingly complicated, for (fascinating, terrifying) historical reasons. FedNow is a huge step towards fixing holes that private companies have been papering over for over two decades. Blatant self promotion: for anybody interested in learning more about the Automated Clearing House system (which FedNow will eventually supplement) and interbank settlement in genera…
Comment linking /2019/12/25/A-shallow-dive-into-the-American-banking-system
on “Fed announces details of new interbank service to support instant payments”Submitted Weird architectures weren't supported to begin with as a story · 353 points
HN discussionIt absolutely is counterproductive! It's also a form of gaslighting: we have a problem in this country (assuming that you're also American) with extrajudicial murder of black and brown people. Instead of talking about that and how we've gotten to this point, we have to to rehash the feelings of an extremely powerful man who is anxious about feeling vulnerable on the Blue Bird Site for his opinions. It's perfectly fi…
Comment linking /2019/07/24/Reasoning-about-faithless-actors-with-undercutting-semantics
on “Orthodox Privilege”Submitted Why don’t we do email verification in reverse? as a story · 298 points
HN discussionMy research did not show “months to years.” Even weeks of presence are an outlying event[1]. (This is a situation where everybody benefits from high quality data. If you have data that contradicts mine, please share it!) [1]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using...
Comment linking /2025/11/21/We-should-all-be-using-dependency-cooldowns
on “Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor”Submitted Bypassing GitHub Actions policies in the dumbest way possible as a story · 247 points
HN discussionSure, there's plenty of violence in the world. I am opposed to most forms of it. But no, there is no equivocation here. One of these things (Neo-Nazism) is fundamentally incompatible, even just on the linguistic level, with my existence. The other (Communism) is undesirable and even reprehensible, but doesn't threaten the mode of discourse itself. Put another way: proposing tolerance towards analytically intolerant…
Comment linking /2018/08/20/Disagreement-Language-Metalanguage
on “Some Facebook Employees Unite to Challenge Its ‘Intolerant’ Liberal Culture”Submitted Dear GitHub: no YAML anchors, please as a story · 178 points
HN discussionI thought it was just using the totally safe transmute, this one: https://blog.yossarian.net/2021/03/16/totally_safe_transmute... But I guess there is another trick.
Comment linking /2021/03/16/totally_safe_transmute-line-by-line
on “Cve-rs: Fast memory vulnerabilities, written in safe Rust”Submitted Things I hate about Rust, redux as a story · 169 points
HN discussion> Can you really say you trust all of these? We need better capabilities. E.g. when I run `fd`, `rg` or similar such tool, why should it have Internet access? IMHO, just eliminating Internet access for all tools (e.g. in a power mode), might fix this. The second problem is that we have merged CI and CD. The production/release tokens should ideally not be on the same system as the ones doing regular CI. More users ne…
Comment linking /2024/12/06/zizmor-ultralytics-injection
on “Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos”Submitted Hiding messages in x86 binaries using semantic duals as a story · 169 points
HN discussionThe National Archives is equally incredible and responsive: I made a Twitter bot[1] to automatically post photos from the DOCUMERICA project[2], and found handful of missing scans (just a few dozen in over 10,000) in the process. I emailed them to ask about it, and they responded in a handful of days[3]. [1]: https://twitter.com/dailydocumerica [2]: https://en.wikipedia.org/wiki/Documerica [3]: https://blog.yossaria…
Comment linking /2021/10/25/A-small-documerica-twitter-bot
on “Does Someone Know My Name?”Submitted Things I hate about Rust as a story · 163 points
HN discussion> which GitHub goes to extents to document GitHub Actions policies as applying to `uses:` clauses If it were phrased like this then you would be right. The docs would give a false sense of security, would be misleading. So I went to check, but I didn't find such assertion in the linked docs (please let me know if I missed it) [0] So I agree with the commenter above (and Github) that "editing the github action to add…
Comment linking /2025/06/11/github-actions-policies-dumb-bypass
on “Bypassing GitHub Actions policies in the dumbest way possible”Submitted How x86_64 Addresses Memory as a story · 159 points
HN discussionIsn't it worth the balance between stability and effort to go with LTS (long term support / security updates only)? You know the updates on LTS will be relatively much safer. The limit of potential breaking updates to every 2 years is mostly the point. But if you're just talking about a home lab where you want to use the latest advances without the latest exploits, try a dependency cooldown. Simon Willison recently…
Comment linking /2025/11/21/We-should-all-be-using-dependency-cooldowns
on “Ubuntu LTS releases to 15 years with Legacy add-on”Submitted Approximating sum types in Python with Pydantic as a story · 158 points
HN discussionNot for fingerprinting, but I wrote a tool that does this to hide messages in x86 binaries[1]. I also wrote an explanation here[2]. [1]: https://github.com/woodruffw/steg86 [2]: https://blog.yossarian.net/2020/08/16/Hiding-messages-in-x86...
Comment linking /2020/08/16/Hiding-messages-in-x86-binaries-using-semantic-duals
on “Yes, the 8086 wanted to be mechanically translatable from the 8080, but”Submitted A few HiDPI tricks for Linux as a story · 139 points
HN discussionYou can no longer upload a PGP signature to PyPI, if that's what you mean. That was phased out last year (to virtually no complaint since nobody was actually verifying any of the signatures, much less attempting to confirm that their keys were discoverable[1]). [1]: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI...
Comment linking /2023/05/21/PGP-signatures-on-PyPI-worse-than-useless
on “PyPI now supports digital attestations”Submitted LLVM Internals: The Bitcode Format as a story · 129 points
HN discussionWeird architectures weren't supported to begin with: https://blog.yossarian.net/2021/02/28/Weird-architectures-we... If you're still running a system with an arcane ISA, support it yourself. 99% of the people running modern Linux are interested in three CPU architectures (four or five once RISC-V gains traction), all of them supported by Rust. Supporting old or obscure ISAs is not a priority at this point compared t…
Comment linking /2021/02/28/Weird-architectures-werent-supported-to-begin-with
on “Linus Torvalds on where Rust will fit into Linux”Submitted Modernizing my 1980s sound system as a story · 121 points
HN discussion> were previously supported I think it was over this debacle, definitely over some debacle, someone made a great blog post that pointed out this wording is usually incorrect (edit: Link https://blog.yossarian.net/2021/02/28/Weird-architectures-we... HN Thread: https://news.ycombinator.com/item?id=26294397 ). It previously worked , but no one was promising support for niche architectures. It just happened to work (at…
Comment linking /2021/02/28/Weird-architectures-werent-supported-to-begin-with
on “Alpine Linux: Proposal to move Rust to main”Submitted How many registers does an x86-64 CPU have? as a story · 120 points
HN discussion
