Top all-time · #12322
EvilPacket
Personal blog · evilpacket.netsecurityprogramming
EvilPacket is a personal blog at evilpacket.net about security and programming. Since 2009, 6 different Hacker News readers have linked it 8 times, most often “XSS is not a feature”. It is still writing: the last post was on 2025-10-14, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
A security researcher's blog on web vulnerabilities such as XSS and account takeovers, and on how companies respond to them. HN commenters cite it in threads on 37signals, CloudKick and MiFi.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Clickity, Hackity, Pwned™
Most-linked posts?
- XSS is not a feature2 people · 2 mentions · first linked 2009-08-23
What Hacker News says?
The author did not claim anybody can expect or provide 100% security. The write-up was (among other things) about something more important - how do companies respond when presented with an important security issue. 37signals responded fairly poorly and that's useful information. Interestingly, this is not the first report of a somewhat strange attitude they seem to have regarding possible exploits - http://evilpacke…
Comment linking /2009/jul/9/basecamp-one-wrong-click/
on “XSS Twitter in minutes; Why you shouldn't store important data with 37signals”Submitted XSS is not a feature as a story · 72 points
HN discussionMiFi fun. http://www.evilpacket.net/2010/jan/14/mifi-geopwn/
Comment linking /2010/jan/14/mifi-geopwn/
on “SSH Tunneling through web filters”Submitted CloudKick.com account takeover. as a story · 22 points
HN discussionI think the submitter himself said it well in his Rackspace XSS hack: "Web applications are never 100% secure. Also the amount of vulnerabilities previously found in a product does not directly relate to the current state of security in a product or service. A better measure of this is how quickly the company responds and how they care about security related issues." ~ http://www.evilpacket.net/2009/jul/9/theft-rack…
Comment linking /2009/jul/9/theft-rackspace-cloud-api-key/
on “CloudKick.com account takeover.”Submitted Rackspace Cloud: XSS to Root as a story · 4 points
HN discussionSubmitted Attacking OSS Using Abandoned Resources – EvilPacket as a story · 2 points
HN discussionSubmitted Verizon MiFi GeoPwn Exploit as a story · 1 points
HN discussion
