Top all-time · #12727
er4hn
Personal blog · er4hn.info/blog · on HN as er4hnsecurityprogramming
er4hn is a personal blog at er4hn.info about security and programming. Since 2023, 6 different Hacker News readers have linked it 20 times, most often “Understanding Sphincs+ PQC, Step by Step”. It is still writing: the last post was on 2026-04-05, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for a step-by-step introduction to SPHINCS+, a hash-based post-quantum signature scheme, and its security based on hash functions and statistics.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Understanding Sphincs+ PQC, Step by Step2 people · 3 mentions · first linked 2023-12-23
- The Golden Age of CVEs2 people · 2 mentions · first linked 2023-12-12
- Tacit Knowledge Is Dangerous2 people · 2 mentions · first linked 2023-08-26
What Hacker News says?
It's reasonable to say that LLMs are not completely useless. There is also a very valid case to make that LLMs are not good at generating production ready code. I have found asking LLMs to make me Nix flakes to be a very nice way to make use of Nix without learning the Nix language. As an example of not being production ready: I recently tried to use ChatGPT-4 to provide me with a script to manage my gmail labels. T…
Comment linking /blog/2024.10.26-gmail-labels/
on “Google CEO says more than a quarter of the company's new code is created by AI”Submitted Tacit Knowledge Is Dangerous as a story · 5 points
HN discussionSPHINCS+ is a complete signature scheme that carries that idea to it's completion. Shameless plug for where I explain it: https://er4hn.info/blog/2023.12.16-sphincs_plus-step-by-step...
Comment linking /blog/2023.12.16-sphincs_plus-step-by-step/
on “A quick post on Chen's algorithm”Submitted Gmail Labels Don't Search Well as a story · 4 points
HN discussionThe hash-based one (SPHINCS+) is probably the easiest to understand as its security hinges on hashes being secure, and some statistics. I found https://er4hn.info/blog/2023.12.16-sphincs_plus-step-by-step... to be a nice introduction.
Comment linking /blog/2023.12.16-sphincs_plus-step-by-step/
on “NIST selects HQC as fifth algorithm for post-quantum encryption”Submitted Tacit Knowledge Is Dangerous as a story · 3 points
HN discussionOne very fun and practical application for Datalog is Biscuits, which are a type of arbitrarily scoped authorization token: https://biscuitsec.org/ . I tried them out for a pet project over here: https://er4hn.info/blog/2024.05.08-biscuits/ and was pretty impressed with what I found. It's not a perfect solution, but I liked it a lot more than OAuth.
Comment linking /blog/2024.05.08-biscuits/
on “An Overview of Datalog (2010)”Submitted SpiceDB – The AuthZ Must Flow as a story · 2 points
HN discussionIt's a tradeoff between how you route requests. If they all come from the same host, using the same source port, they are all probably related and it's not a bad idea to have them all go to the same server node to process. In general I believe that having LBs decrypt HTTPS to HTTP for better routing is an anti-pattern. It makes the LB a high value target in a network. I wrote up a blog post in more detail about how…
Comment linking /blog/2023.02.18-tls-load-balancer/
on “Memoirs from the old web: The KEYGEN element”Submitted Biscuits – A Tasty Solution for AuthZ as a story · 2 points
HN discussionThere's a couple things that I think are worth digging into with this post and the grandparent: - If a LB is a place where all traffic is going through, it does become a higher value target. Saying that they are not hacked feels very anecdotal. - It is possible to have a LB which forwards TLS connections and does not need to MitM other connections. There are tradeoffs in it, but this is entirely possible. I had a wr…
Comment linking /blog/2023.02.18-tls-load-balancer/
on “Memoirs from the old web: The KEYGEN element”Submitted Hot Take – Analysis of Security in Popular Messaging Apps as a story · 2 points
HN discussionThis is very detailed and a fun read. I'd done a similar set of research in 2022 as well: https://er4hn.info/blog/2022.08.23-tormentnexus/
Comment linking /blog/2022.08.23-tormentnexus/
on “We're sorry we created the Torment Nexus”Submitted Good Docs Take Great Effort as a story · 2 points
HN discussionBeautiful animations! I love how they make understanding this more intuitive and can be adjusted to play with different settings. One thing that I generally felt is missing in these discussions is how TLS messes up load balancing strategies. I did my own research on what to do when you want to have TLS and not terminate at the load balancer. I covered that in a blog post available here: https://er4hn.info/blog/2023.…
Comment linking /blog/2023.02.18-tls-load-balancer/
on “Load Balancing”Submitted The Golden Age of CVEs as a story · 2 points
HN discussionhttps://er4hn.info
Comment linking /
on “Ask HN: Could you share your personal blog here?”Submitted Force Projection in Cyberwarfare Is Disruptive as a story · 1 points
HN discussionSubmitted Understanding Sphincs+ PQC, Step by Step as a story · 1 points
HN discussionSubmitted The Golden Age of CVEs as a story · 1 points
HN discussion