Top all-time · #1138
Frank Denis
Personal blog · 00f.netsecurityprogramming
Frank Denis writes Frank DENIS random thoughts., a personal blog at 00f.net about security and programming. Since 2009, 63 different Hacker News readers have linked it 124 times, most often “WebAssembly doesn’t make unsafe languages safe”. It is still writing: the last post was on 2026-10-08, and you can follow it by feed.
Frank DENIS blog
Most-linked posts?
- WebAssembly doesn’t make unsafe languages safe5 people · 6 mentions · first linked 2018-11-25
- Performance of WebAssembly Runtimes in 20235 people · 6 mentions · first linked 2023-01-04
- Performance of WebAssembly Runtimes in 20265 people · 5 mentions · first linked 2026-06-23
- The state of the Rust dependency ecosystem4 people · 7 mentions · first linked 2025-10-17
- Benchmark of WebAssembly runtimes – 2021 Q13 people · 4 mentions · first linked 2021-06-17
- Configuration flags are where software goes to rot3 people · 4 mentions · first linked 2026-04-11
- Length-extension attacks are still a thing3 people · 3 mentions · first linked 2025-10-23
- Mod_pagespeed as a Proxy for your Phone3 people · 3 mentions · first linked 2012-06-04
- The best WebAssembly runtime may still be no runtime at all3 people · 3 mentions · first linked 2026-07-08
- Benchmark of different WebAssembly runtimes using libsodium2 people · 3 mentions · first linked 2019-10-23
What Hacker News says?
edns-client-subnet leads to a surprising number of privacy concerns. See: https://00f.net/2013/08/07/edns-client-subnet/ I find the cache timing issue particularly worrying. Cloudflare runs from 151 (and growing rapidly) locations worldwide. Without edns-client-subnet, the upstream DNS server will probably respond according to the geolocation of the Cloudflare location you're talking to -- which is probably pretty c…
Comment linking /2013/08/07/edns-client-subnet/
on “1.1.1.1: Fast, privacy-first consumer DNS service”Submitted Stop using low DNS TTLs as a story · 318 points
HN discussionSpeaking as someone who would love to see WebAssembly succeed as a cross-platform, cross-language way for me to write sandboxed plugins and CLI utilities, I do have to point out that, for out-of-browser use, WASM's MVP does regress various things: * https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... * https://www.usenix.org/system/files/sec20-lehmann.pdf (eg. Under WebAssembly's memory model, dereferenc…
Comment linking /2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/
on “Cosmopolitan Libc: build-once run-anywhere C library”Submitted Problems with low DNS TTLs as a story · 185 points
HN discussionDon't panic, don't spread fear: https://00f.net/2016/02/17/cve-2015-7547/
Comment linking /2016/02/17/cve-2015-7547/
on “Glibc getaddrinfo stack-based buffer overflow”Submitted WebAssembly doesn’t make unsafe languages safe as a story · 161 points
HN discussionThere are some benchmarks of Cranelift-based Wasm VMs (Wasmtime) vs. LLVM-based Wasm VMs here: https://00f.net/2023/01/04/webassembly-benchmark-2023/ The (perhaps slightly exaggerated but encouraging to me at least!) money quote there is: > That’s right. The cranelift code generator has become as fast as LLVM. This is extremely impressive considering the fact that cranelift is a relatively young project, written fro…
Comment linking /2023/01/04/webassembly-benchmark-2023/
on “Cranelift code generation comes to Rust”Submitted It Doesn't Work as a story · 143 points
HN discussionIt depends on how you define supply chain attacks. Recently, there was an exploit discovered in an abandoned Rust package that was used by many other Rust projects, many unaware of it due to the sheer number of dependencies. Whether by negligence or malice, having a known vulnerability that permeates significant portions of the ecosystem is on the order of a supply chain attack. https://edera.dev/stories/tarmageddon…
Comment linking /2025/10/17/state-of-the-rust-ecosystem/
on “Hard Rust requirements from May onward”Submitted Measuring the overhead of WebAssembly using libsodium as a story · 131 points
HN discussionDisclaimer: I work on 1.1.1.1. You might not consider your /24 as personally identifying, but others might. The original RFC discusses these problems fairly well ( https://tools.ietf.org/html/rfc7871 , Privacy notice and privacy considerations). Frank Denis also wrote a good summary on ECS ( https://00f.net/2013/08/07/edns-client-subnet/ ). There's a multitude of ways to fix this - use a whitelist of nameservers to…
Comment linking /2013/08/07/edns-client-subnet/
on “Why does 1.1.1.1 not resolve archive.is?”Submitted Go Is the New Ruby as a story · 105 points
HN discussionlatest benchmarks with wasm3, wasmer, wasmtime, wavm and etc: https://www.00f.net/2021/02/22/webassembly-runtimes-benchmar...
Comment linking /2021/02/22/webassembly-runtimes-benchmarks
on “152kb WebAssembly interpreter that runs on six OSs with Cosmopolitan”Submitted Performance of WebAssembly Runtimes in 2026 as a story · 102 points
HN discussionIt doesn't have to be so complicated: https://00f.net/2019/04/07/compiling-to-webassembly-with-llv...
Comment linking /2019/04/07/compiling-to-webassembly-with-llvm-and-clang/
on “Compiling C to WebAssembly Without Emscripten”Submitted DNSCrypt – how expired certificates became a thing of the past as a story · 97 points
HN discussionhttps://00f.net/2021/02/22/webassembly-runtimes-benchmarks/ A new round will be made soon.
Comment linking /2021/02/22/webassembly-runtimes-benchmarks/
on “Wasmer 2.0”Submitted Where are the self-tuning systems? as a story · 80 points
HN discussionRelevant: benchmarking WebAssembly using libsodium: https://00f.net/2019/04/09/benchmarking-webassembly-using-li...
Comment linking /2019/04/09/benchmarking-webassembly-using-libsodium/
on “Not So Fast: Analyzing the Performance of WebAssembly vs. Native Code”Submitted Base84 deserves a place in file names as a story · 77 points
HN discussionI recommend this excellent reading, https://00f.net/2018/11/25/webassembly-doesnt-make-unsafe-la... . It clarifies what “safe” means in this context.
Comment linking /2018/11/25/webassembly-doesnt-make-unsafe-languages-safe/
on “Wasmer: A Python library for executing WebAssembly binaries”Submitted IP address truncation fails at anonymization as a story · 26 points
HN discussionDisclaimer: I'm one of the maintainers of Tink. I'm not sure if NaCl itself is production ready, but I'm a great fan of libsodium. If I weren't working on Tink, I'd use libsodium for my personal projects. Did you know that Frank Denis [1] the creator of libsodium is not working full time on crypto or security? He's a professional photographer. I can't figure out how he manages to single-handedly maintain such a high…
Comment linking /
on “Tink – Cryptographic APIs that are secure, easy to use correctly”Submitted We trust strangers' open source more than our colleagues' as a story · 21 points
HN discussionRelated and maybe more accessible: https://00f.net/2018/10/18/on-user-authentication/
Comment linking /2018/10/18/on-user-authentication/
on “Let’s talk about PAKE”Submitted The best WebAssembly runtime may be no runtime as a story · 19 points
HN discussionIndeed! Lucet is a great piece of engineering. There are some very popular open-source runtimes that let you run WebAssembly server-side easily: Wasmer (Rust, with three different compilation tiers: Singlepass, Clif and LLVM), WAVM (C++. LLVM), and many more! (disclaimer: I work at Wasmer) There is some nice blogposts benchmarking them: https://00f.net/2019/10/22/updated-webassembly-benchmark/
Comment linking /2019/10/22/updated-webassembly-benchmark/
on “Fastly launches its new compute environment – supports Rust”Submitted Why IP address truncation fails at anonymization as a story · 17 points
HN discussionLLMs don't need your secret tokens (but MCP servers hand them over anyway): https://00f.net/2025/06/16/leaky-mcp-servers/ Encrypting sensitive data can be more useful than blocking entire requests, as LLMs can reason about that data even without seeing it in plain text. The ipcrypt-pfx and uricrypt prefix-preserving schemes have been designed for that purpose.
Comment linking /2025/06/16/leaky-mcp-servers/
on “Show HN: Local Privacy Firewall-blocks PII and secrets before ChatGPT sees them”Submitted An overview of modern SQL-free databases as a story · 16 points
HN discussion
