Top all-time · #3790
Jan Wildeboer
Personal blog · jan.wildeboer.netprogrammingsecurity
Jan Wildeboer's personal blog at jan.wildeboer.net covers programming and security. Since 2011, 20 different Hacker News readers have linked it 31 times, most often “The Web Is Broken – Botnet Part 2”. It is still writing: the last post was on 2026-08-01, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
HN readers link Jan Wildeboer's posts on self-hosting email, stealthy botnets and bot blocking, and homelab how-tos like DNS and certificates. One commenter recommends the botnet article as a brief rundown.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- The Web Is Broken – Botnet Part 24 people · 5 mentions · first linked 2025-04-19
- Email Done My Way, Part 0 – The Journey4 people · 4 mentions · first linked 2022-08-14
- Those Stealthy Botnets2 people · 4 mentions · first linked 2025-04-20
- Client-side comments with Mastodon on a static Jekyll website2 people · 2 mentions · first linked 2023-02-26
What Hacker News says?
Funny seeing this on the top of HN when this is also on the top of HN: https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/
Comment linking /2022/08/Email-0-The-Journey-2022/
on “After self-hosting my email for twenty-three years I have thrown in the towel”Submitted The Web Is Broken – Botnet Part 2 as a story · 411 points
HN discussionMy little e-mail Server on an OVH VPS is happily sending and receiving e-Mails to/from the big ones without problems for my 20+ domains. Just a basic postfix/dovecot setup with letsencrypt certificates and SPF/DKIM/DMARC working the way it should. I described everything in a short blog series at https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/ in case you are interested.
Comment linking /2022/08/Email-0-The-Journey-2022/
on “After self-hosting my email for twenty-three years I have thrown in the towel”Submitted My Own DNS Server at Home – Part 1: IPv4 as a story · 220 points
HN discussionThere are similar¹𝄒²𝄒³ ideas for Mastodon / ActivityPub: ¹ https://jszym.com/blog/mastodon_blog_comments/ ² https://jan.wildeboer.net/2023/02/Jekyll-Mastodon-Comments/ ³ https://carlschwan.eu/2020/12/29/adding-comments-to-your-sta...
Comment linking /2023/02/Jekyll-Mastodon-Comments/
on “I’ve removed Disqus. It was making my blog worse”Submitted Apple actually lost in Dutch court, not the opposite as a story · 167 points
HN discussionHola is mentioned in the authors prior post on this topic, linked to at the top of TFA: https://jan.wildeboer.net/2025/02/Blocking-Stealthy-Botnets/
Comment linking /2025/02/Blocking-Stealthy-Botnets/
on “The Web Is Broken – Botnet Part 2”Submitted Email Done My Way, Part 0 – The Journey as a story · 138 points
HN discussionThe first blog post in this series[1], linked to at the top of TFA, offers an analysis on the potential of using ASNs to detect such traffic. Their conclusion was that ASNs are not helpful for this use-case, showing that across the 50k IPs they've blocked, there is less than 4 IP addresses per ASN, on average. [1] https://jan.wildeboer.net/2025/02/Blocking-Stealthy-Botnets/
Comment linking /2025/02/Blocking-Stealthy-Botnets/
on “The Web Is Broken – Botnet Part 2”Submitted Microsoft: No GPLv3 Software for Windows Phone and Xbox Apps. as a story · 131 points
HN discussionThis is a hilariously optimistic, naive, disconnected from reality take. What sort of "proof" would be sufficient for you? TFA includes of course data from the authors own server logs^, but it also references real SDKs and business selling this exact product. You can view the pricing page yourself, right next to stats on how many IPs are available for you to exploit. What else do you need to see? ^ edit: my mistake,…
Comment linking /2025/02/Blocking-Stealthy-Botnets/
on “The Web Is Broken – Botnet Part 2”Submitted EU court: Reverse engineering OK, API not protected by (c) and more as a story · 116 points
HN discussionhttps://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-...
Comment linking /2025/04/Web-is-Broken-Botnet-Part-2/
on “Anubis saved our websites from a DDoS attack”Submitted My Cute Homelab as a story · 23 points
HN discussionUnfortunately nowadays, blocking by ASN is not going to help you out much in solving this type of issue. The reason for this is stealthy botnets. For a brief rundown, I'd suggest this article. https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-...
Comment linking /2025/04/Web-is-Broken-Botnet-Part-2/
on “Ask HN: Startup getting spammed with PayPal disputes, what should we do?”Submitted Those Stealthy Botnets as a story · 7 points
HN discussionA bit related: If you want to show the verified status for GitHub on your Mastodon profile, here is how to do it: https://jan.wildeboer.net/2022/06/Quick-Fix-Verified-Mastodo... Courtesy of https://news.ycombinator.com/user?id=jwildeboer
Comment linking /2022/06/Quick-Fix-Verified-Mastodon-Github/
on “We've hit 1M monthly active users”Submitted Email Done My Way, Part 0 – The Journey as a story · 7 points
HN discussionNo. Both MacOS and iOS happily resolve and connect to the machines in my homelab.jhw domain. I did add the root cert of my CA (Certificate Authority) to the trust store on MacOS and iOS, so I can also enjoy TLS connections. Scroll to the "Add the certificate" part of https://jan.wildeboer.net/2025/08/Create-SMIME-Cert-stepca/ for the HOWTO that worked for me.
Comment linking /2025/08/Create-SMIME-Cert-stepca/
on “My Own DNS Server at Home – Part 1: IPv4”Submitted Be the LetsEncrypt in your homelab with step-ca as a story · 3 points
HN discussionRead this: https://jan.wildeboer.net/2025/04/Web-is-Broken-Botnet-Part-... Basically everybody's a bot in a hidden botnet now. And we agreed to it. Phones, tablets, Windows appstores add the SDK in, and then drone. One of the big ones is "Infatica" - devs get paid to put this in legitimate 'apps' AI companies, and whoever and whatever else use the reputation-good IPs to hammer sites and well, it's fair game for all…
Comment linking /2025/04/Web-is-Broken-Botnet-Part-2/
on “Using lots of little tools to aggressively reject the bots”Submitted My doorlock and my digital sovereignty as a story · 3 points
HN discussionIt's not fuck the bots, it's fuck the bot owners for using the websites as they want, and not at minimum, asking. Like 'hey cool if I use this tool to interact with your site for this and that reason?' No, they just do it. So that can scrape data, which at this point in time for AI which has hit the cap on what it can consume knowledge wise, scrapes it because live updates and new information is most valuable to the…
Comment linking /2025/04/Web-is-Broken-Botnet-Part-2/
on “Using lots of little tools to aggressively reject the bots”Submitted OCT – My Framework for Digital Sovereignty, Part 1 as a story · 2 points
HN discussionYep. That's exactly what I am looking for. Use USB-PD to charge small electric vehicles in a standardised way ;) See https://jan.wildeboer.net/2024/06/Charging-SEVs-A-Modest-Pro... where I describe the concept and https://github.com/manuelbl/usb-pd-arduino/wiki where there is Open Source code (and schematics) to do PD sniffing and sink negotiation.
Comment linking /2024/06/Charging-SEVs-A-Modest-Proposal-AODP/
on “Twonkie: A USB-PD sniffer/injector/sink based on Google's Twinkie open hardware”Submitted Conway: Think Networks First, Actors Second as a story · 1 points
HN discussion" But some IT experts have pointed to a different possible cause: an expiring security certificate. The problem, it seems, is that the Verifone H5000 is a rather old albeit robust model whose so-called “End of Life” was officially announced by Verifone in 2019. " ... " That is the hypothesis of Jan Wildeboer, a self-described “EMEA Evengelist” at IBM-owned Red Hat who began informing the English-speaking public abou…
Comment linking /2022/06/H5000
on “German Payment Outage Underscores Danger of Cashless Economy: System Fragility”Submitted Client-side comments with Mastodon on a static Jekyll website as a story · 1 points
HN discussion(running my own email server since 12+ years) The most effective spam "filter" I use is a simple DNS check ;) No reverse lookup to the hostname the sender pretends to be? No connection. Simple. That simple rule eliminates almost all spam. SPF/DKIM checks take care of the rest. For low-traffic email servers the dns lookup costs are negligible. Sometimes smaller IS better :) I block repeat offenders with crowdsec. I w…
Comment linking /2023/04/Daily-Bot-Blocking/
on “Is Gmail killing independent email?”Submitted Philosophy of Home Automation as a story · 1 points
HN discussion
