Top all-time · #8370
Jamie Scaife
Personal blog · jamieweb.net/blog · on HN as jamiewebsecuritysystems
Jamie Scaife's personal blog at jamieweb.net covers security and systems. Since 2018, 9 different Hacker News readers have linked it 29 times, most often “Tor is a great sysadmin tool (2020)”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Jamie Scaife's posts on Tor onion services, including v3 onion vanity addresses, v3 hidden service details, and forwarding Tor hidden services. Comments cite them as references.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cyber security, open-source, software development and reverse engineering - the personal blog and website of Jamie Scaife.
Most-linked posts?
- Tor is a great sysadmin tool (2020)2 people · 2 mentions · first linked 2020-08-08
- Using SPF Macros to Solve the Operational Challenges of SPF (2020)2 people · 2 mentions · first linked 2020-05-10
- /blog/onionv3-vanity-address/2 people · 2 mentions · first linked 2019-07-21
- Using a Bloom Filter to Anonymize Web Server Logs2 people · 2 mentions · first linked 2019-03-22
What Hacker News says?
> the real answer to this Alternatively, I like the concept of Tor onion services, where the "domains" are acquired in a permissionless fashion. Names are just randomly generated ed25519 strings so there's no squatting and your address never expires . If you want a vanity domain, you just commit compute time to brute force something human-readable. [1] The obvious drawback is that you have to be a Tor client, but if…
Comment linking /blog/onionv3-vanity-address/
on “The Attempted Corporate Takeover of .Org”Submitted Tor is a great sysadmin tool (2020) as a story · 420 points
HN discussionA somewhat relevant project of mine, where you can test how good you are at spotting these sort of domains: https://www.jamieweb.net/apps/lookalike-domains-test/
Comment linking /apps/lookalike-domains-test/
on “I bought netflix.soy”Submitted A Look at PureDarwin – An OS Based on the Open Source Core of macOS as a story · 244 points
HN discussionI used https://github.com/katmagic/Shallot back then and it took 35221958203 attempts to find one with my chosen seven characters. For the longer v3 .onions you'll want a different tool, this page mentions some and makes some estimates for finding increasing lengths of characters: https://www.jamieweb.net/blog/onionv3-vanity-address/
Comment linking /blog/onionv3-vanity-address/
on “Hackers breach FSB contractor, expose Tor deanonymization project”Submitted Booting a physical Windows 10 disk on Linux using VirtualBox as a story · 25 points
HN discussionEDIT (too late to edit parent): This screenshot, from an article linked below, shows what I'm talking about. The blacked out parts next to "Portugal", "Germany", and "United States" cover publicly routable IP addresses (afaik): https://www.jamieweb.net/blog/forwarding-tor-hidden-services... Also, note that I had it backward in the parent: The traffic first goes through publicly routable IPs, then through Tor relays.
Comment linking /blog/forwarding-tor-hidden-services-to-another-server-across-the-internet/tor-browser-80-reverse-proxy-jamieweb.png
on “Twitter's new Tor onion service”Submitted Show HN: How good are you at spotting lookalike domains? as a story · 18 points
HN discussionThanks for all your help and I understand if I've exhausted the efforts of free HN technical help! I read the link and while I learned more about Tor, the article seems to describe how to secure Tor traffic that is forwarded to regular Internet hosts, for example if someone using a Tor client visited ycombinator.com. My question is, if you use a Tor client to visit twitterhpgjerufcvrmzerg2novpipy42rk3anvb5b7np4zggm4…
Comment linking /blog/forwarding-tor-hidden-services-to-another-server-across-the-internet/tor-browser-80-reverse-proxy-jamieweb.png
on “Twitter's new Tor onion service”Submitted Using Tor as a SysAdmin Tool as a story · 4 points
HN discussionhttps://www.jamieweb.net/blog/forwarding-tor-hidden-services...
Comment linking /blog/forwarding-tor-hidden-services-to-another-server-across-the-internet/
on “Twitter's new Tor onion service”Submitted Using a Bloom Filter to Anonymize Web Server Logs as a story · 3 points
HN discussionThat is what I believed but what I saw seemed to conflict: Install the Tor Project browser, connect to an .onion host, then click on the icon that shows the route. It appears to show the route goes through non-Tor hosts (I don't call them 'clearnet' because I expect the data and some metadata is encrypted). EDIT: See this screenshot from an article elsewhere in this discussion. The blacked out bits next to "Portugal…
Comment linking /blog/forwarding-tor-hidden-services-to-another-server-across-the-internet/tor-browser-80-reverse-proxy-jamieweb.png
on “Twitter's new Tor onion service”Submitted Connecting to Decentralized Network 42 as a story · 2 points
HN discussionThe v3 onion protocol [0] is supposed to provide better DDoS resistance than v2 [1] - haven't read up on the specifics though. [0] https://www.jamieweb.net/blog/onionv3-hidden-service/ [1] https://darknetlive.com/post/cryptonia-market-countering-ddo...
Comment linking /blog/onionv3-hidden-service/
on “Dark.fail: Is a darknet site online?”Submitted DNS CAA Records as a story · 2 points
HN discussionI looked into this a few years ago[1]. The solution I came to involves putting the hash of the most recent Bitcoin block in your document, and then signing the hash of your document into the Bitcoin blockchain. This cryptographically proves that the document was created/published within those two time bounds. This of course doesn't help in all cases, i.e. you could edit an old document to make it look newer, but I'm…
Comment linking /blog/proof-of-timestamp/
on “Ask HN: What are some good methods to prove current time?”Submitted Show HN: Test how good you are at spotting potential phishing domains as a story · 2 points
HN discussionMy blog - 100% bespoke PHP with no frameworks, etc: https://www.jamieweb.net/
Comment linking /
on “Ask HN: Show Us Your Personal Website/Blog?”Submitted MTA-STS and Starttls-Everywhere – HSTS and HSTS Preload for Email as a story · 2 points
HN discussionMy own solution to this is to store the server key fingerprints in a public Git repository, which can then be pulled from on all devices that need to be able to connect. This works nicely for my own personal setup with a few servers. It may be possible to scale this to a larger environment with multiple users too. Then main benefit is that whenever a server is rebuilt (which can be quite regularly when using infra-a…
Comment linking /blog/managing-your-ssh-known_hosts-using-git/
on “Infrastructure Security Without Slowing Down Developers”Submitted Using SPF Macros to Solve the Operational Challenges of SPF (2020) as a story · 1 points
HN discussionA pair of $5 cloud servers and a Cloudflare load balancer for resiliency. Ansible is used to build and maintain both servers, and the actual web content is in Git. I use `receive.denyCurrentBranch=updateInstead` in the repo config on the servers, so I just do a push to each and the new content goes live instantly. The reason for doing it this way is that I want to fully own my platform. I have fine-grain control ove…
Comment linking /
on “Ask HN: Do you blog under your own domain? How?”Submitted Using SPF Macros to Solve the Operational Challenges of SPF as a story · 1 points
HN discussionI've had a Pi running 24/7 for around 3 years - I use it to run network monitoring scripts, basic IDS for my website, uptime monitoring, etc. When the Pi Zero came out I bought 4 of them and put them together into a 5-node grid computer, which to this day I use to run Einstein@Home. You can see live statistics here: https://www.jamieweb.net/projects/computing-stats/ And a video of it here: https://twitter.com/jamiew…
Comment linking /projects/computing-stats/
on “Ask HN: What have you done with Raspberry Pi so far?”Submitted Launching a Public HackerOne Vulnerability Disclosure Program as a story · 1 points
HN discussionMy own solution to this was to write a custom web server log anonymizer[1], and then feed the logs into AWStats. My anonymizer tool uses a bloom filter to determine which IP are addresses are unique, maintaining a semi-accurate unique visitor count. User agents and referrers are also anonymized. My blog post explains this in more technical detail: https://www.jamieweb.net/blog/using-a-bloom-filter-to-anonym... [1] h…
Comment linking /blog/using-a-bloom-filter-to-anonymize-web-server-logs/
on “Ask HN: How should we implement tracking as privacy conscious startups?”I've been picking up the basics in the past few months - I started out with playing around with some open source tools (radare2/Cutter), and then watching Josh Stroschein's introductory course on PluralSight [1]. The course is more Windows oriented but that's alright for the basics. Then, I asked my friend to make me a really basic CrackMe challenge [2]. Solving this was where most of the real learning took place. T…
Comment linking /blog/radare2-cutter-part-1-key-terminology-and-overview/
on “Ask HN: What books/tutorials/articles to read to get into reverse engineering?”This looks good - it's great to see development in the CSP space since it's such as great yet not widely used feature. I've also made something on the same lines as this, although not as a complete tool like yours. Essentially I have a default policy for my site, but I can manually override individual directives on a per-page basis. I called it 'CSP Extreme': https://www.jamieweb.net/blog/taking-content-security-pol…
Comment linking /blog/taking-content-security-policy-to-the-extreme-policies-on-a-per-page-basis/
on “Show HN: A builder tool to help generate CSPs in a type-safe way”
