Top all-time · #23828
F
Fazal Majid
Personal blog · blog.majid.infosecuritysystems
Fazal Majid's personal blog at blog.majid.info covers security and systems. Since 2019, 3 different Hacker News readers have linked it 25 times, most often “Funding the Vetting of the Software Supply-Chain”. It is still writing: the last post was on 2026-07-21, and you can follow it by feed.
25mentions?
3HN people?
2019–2026first – last linked?
Most-linked posts?
- Funding the Vetting of the Software Supply-Chain2 people · 4 mentions · first linked 2022-10-20
What Hacker News says?
Wen thinking about risks from depending on the cloud, people fixate on the risk of losing data, when this kind of denial of access is a much more likely occurrence. I've started on my de-appleification plan in earnest this year: https://blog.majid.info/quit-apple/
Comment linking /quit-apple/
on “Apple has locked my Apple ID, and I have no recourse. A plea for help”Submitted How to ensure a cron job runs exclusively as a story · 4 points
HN discussionI have a workflow for books that is quite efficient, using the Mac app Delicious Library, a Microvision RoV Bluetooth scanner supported by the app (sadly discontined): https://blog.majid.info/organizing-with-delicious-library/ Sadly I don't have anything that streamlined for groceries.
Comment linking /organizing-with-delicious-library/
on “Grocy: web-based, self-hosted grocery and household management”Submitted Funding the Vetting of the Software Supply-Chain as a story · 1 points
HN discussionAmazon has a huge counterfeit goods problem, and buying from Amazon itself as opposed to a third-party merchant on the Amazon platform is no guarantee, because of their "commingled stickerless inventory" program. Apple accessories in particular are heavily counterfeited, I'd bought some USB-Ethernet adapters for a meeting room with too much WiFi interference. They seemed to work fine then I got a new Mac and it refu…
Comment linking /amazon-counterfeits/
on “Fake Amazon reviews 'being sold in bulk' online”Submitted Edgewalker, a DIY VPN Server as a story · 1 points
HN discussionI’ve had a case where a bit flip in a TCP stream was not caught because it happened in a Singapore government deep packet inspection snoop gateway that recalculated the TCP checksum for the bit-flipped segment: https://blog.majid.info/telco-snooping/
Comment linking /telco-snooping/
on “Single random bit flip causes error in certificate transparency log”I have the Fitcut Curve, the Carl Xscissors and many more besides: https://blog.majid.info/galleries/scissors/ The ones I like best for everyday use are the (also Japanese) Allex, although the Dovo are better yet, but I am somehow afraid of using them because they are so nice.
Comment linking /galleries/scissors/
on “The cutting-edge of cutting: How Japanese scissors have evolved (2018)”Dependencies introduce risks, but not using them at all puts you at a competitive disadvantage against those who are using them and thus achieve faster development time and time to market. What you need is a process to manage dependencies: 1) Only consider open-source dependencies. 2) Introducing new dependencies requires a review. Not just a code review on the pull request introducing it, but checking the license,…
Comment linking /supply-chain-vetting/
on “NIH is cheaper than the wrong dependency”Read also this excellent article by Russ Cox (of Go fame) on the issue: https://research.swtch.com/deps This is at heart an economics problem: how to provide a public good (software security) in the presence of free riders. The way society handles this kind of risk is through insurance, but there are a number of things that need to happen to enable a sustainable economic basis to fund the necessary dependency-vettin…
Comment linking /supply-chain-vetting/
on “We're Drowning”It's not the maintenance of the projects the enterprises have to fund (though that is certainly welcome if the mantainers are willing) but the slow, painful work of vetting the code. Google does that with Project Zero but few companies are wealthy enough to afford that. The way out is economic, not technical: insurance, and mutualizing the cost of security audits. I wrote up my ideas on the subject here: https://blo…
Comment linking /supply-chain-vetting/
on “XZ: Repo maintainer Lasse Collin responding on LKML”Thanks for the recommendation. I use Lockdown (the TOTP app, not the firewall) and even wrote an exporter for it, but it’s essentially unsupported now. https://brooksreview.net/2015/05/lockdown/ https://blog.majid.info/lockdown-export/
Comment linking /lockdown-export/
on “Some Authy 2FA accounts were compromised in Twilio data breach”Lockdown (the TOTP app, not the VPN/firewall app) has both, but it is essentially abandonware now. I wrote my own exporter for it: https://blog.majid.info/lockdown-export/
Comment linking /lockdown-export/
on “Raivo OTP just deleted all tokens after update and is now asking for money”HSTS is surprisingly NOT widely deployed, never mind HSTS Preload. Google, Amazon, eBay, BofA or Chase have neither. Facebook, to its credit, does, then again with Facebook your threat model is what’ inside the perimeter. https://blog.majid.info/hsts-preload/
Comment linking /hsts-preload/
on “Wi-Fine”The roller kit is a field-replaceable unit and Fujitsu supplies them in a boxed kit, so it can't be that hard (I'm still on my original roller, even though I bout a roller replacemnt kit, so I have no idea how hard it is). It's a great unit, but official software support lapsed a few years ago so I am now using it with third-party software (ExactScan Pro). Here are a few scanners I ran through a comparative color fi…
Comment linking /scanner-group-test/
on “The Epson HX-20 – A Contrarian's View (2021)”They also don’t have HSTS enabled, let alone HSTS Preload. Lots of security theater, though. https://blog.majid.info/hsts-preload/
Comment linking /hsts-preload/
on “Against DNSSEC (2015)”It's still work-in-progress: https://blog.majid.info/quit-apple/ You can copy-paste using LocalSend. Not as seamless, but it does work, including with Apple devices.
Comment linking /quit-apple/
on “Apple, What Have You Done?”ExactScan Pro supports the S1500M on modern versions of macOS, and is superior to ScanSnap's own software in most ways. Mojave won't help, I had to switch to ExactScan when I "upgraded" to Mojave (although I believe Fujitsu brought back S1500M support in the original ScanSnap software on Mojave by popular demand a few years later). Treasure it, the S1500M uses a CCD sensor, unlike all subsequent ScanSnaps that use i…
Comment linking /scanner-group-test/
on “I Almost Bought a Scanner”I am coming to GrapheneOS from iOS, as recounted in https://blog.majid.info/quit-apple/ My experience with seedvault is not as positive as the OP, it fails for about half my apps. I guess I have another year to fix this when the GrapheneOS enabled Motorola flagship comes out. I carry both my iPhone 16 Plus and my Pixel 8 Pro, but limit my iPhone use to mobile banking, Apple Pay and Find My.
Comment linking /quit-apple/
on “I've been running GrapheneOS on my Pixel Fold for over half a year”Well, I don't have a Kindle, so I can't verify this, but I am basing this from reporting: https://www.bbc.co.uk/news/articles/c98k91yy4z4o "The move will mean owners of older Kindles, including its earliest models such as the Kindle Touch and some Kindle Fire tablets, will be unable to download new e-books." For a more tech-oriented site, according to Ars Technica Amazon removed the ability to upload over USB: https…
Comment linking /why-i-will-never-buy-a-kindle/
on “I'm never buying another Kindle, and neither should you”I vibe-debug 10x more than I vibe-code, but here goes: - a daemon to properly set the LEDs on my Lincstation N2 NAS (even early Claude was great at reverse-engineering): https://blog.majid.info/lincstation/ - most consequential, Thufir, a task manager to replace Cultured Code's Things as I am leaving massa Tim Apple's plantation: https://github.com/fazalmajid/Thufir Still very janky, but usable enough for my purpose…
Comment linking /e-ink/
on “Ask HN: What are tools you have made for yourself since the advent of AI”https://blog.majid.info/pdf/patent_ppv.pdf (in French, however) It's a micropayment proxy using network authentication, billing on your ISP bill, with a reload grace period to prevent double-billing. It was deployed by France Telecom in its Wanadoo retail Internet service, but most of the money they made was from selling ringtones, not the original purpose of migrating Minitel service providers to the Web.
Comment linking /pdf/patent_ppv.pdf
on “Micropayments as a reality check for news sites”You'd be surprised how many top websites (e.g. Amazon, eBay) don't even implement HSTS, let alone HSTS Preload. Here's some naming-and-shaming: https://blog.majid.info/hsts-preload/
Comment linking /hsts-preload/
on “I quitted infosec and I couldn't be happier”I blog very sporadically, a post per quarter or so, but write about stuff where there isn’t an answer on the Internet. 20 years ago, somehow I had become the US expert on how to pair your Palm Pilot with your Bluetooth-enabled cell phone to connect to the Internet using GPRS for email, SSH or basic web browsing (even then the bane of JavaScript had made browsing unusable on the pre-iPhone browsers). That’s because e…
Comment linking /bluetooth-blues-redux/
on “Nobody cares about your blog”