Top all-time · #1112
Latacora
Company blog · latacora.com/blog · on HN as lvhsecurityprogramming
Latacora is the company blog at latacora.com, writing about security and programming. Since 2016, 61 different Hacker News readers have linked it 96 times, most often “The PGP Problem (2019)”. It is still writing: the last post was on 2026-10-14, and you can follow it by feed.
Retained security teams for startups.
Most-linked posts?
- The PGP Problem (2019)13 people · 15 mentions · first linked 2023-09-09
- Stop Using Encrypted Email (2020)10 people · 12 mentions · first linked 2023-10-22
- Cryptographic Right Answers: Post Quantum Edition10 people · 11 mentions · first linked 2024-07-30
- Latacora – Security Teams for Startups7 people · 7 mentions · first linked 2017-04-13
- The SOC2 Starting Seven5 people · 6 mentions · first linked 2023-10-26
- Cryptographic Right Answers (2018)5 people · 5 mentions · first linked 2023-09-15
- The PGP Problem (2019)4 people · 5 mentions · first linked 2025-12-27
- How (not) to sign a JSON object (2019)3 people · 4 mentions · first linked 2023-12-25
- Stop Using Encrypted Email (2020)3 people · 4 mentions · first linked 2025-12-13
- Latacora: Security Programs For Startups3 people · 3 mentions · first linked 2016-09-23
What Hacker News says?
The only other thing I'm aware of is a brief note on Twitter that they're shutting down: https://twitter.com/tqbf/status/771533037666390017 (FWIW, the "more to come" has so far been about the Ptaceks' next project, which is apparently something focused on security needs of startups, in collaboration with Jeremy Rauch, with details still apparently in flux; contact details for those interested are at http://latacora.…
Comment linking /
on “I’m Joining Stripe to Work on Atlas”Submitted Datomic and Content Addressable Techniques as a story · 166 points
HN discussionI wrote two: https://www.latacora.com/blog/2020/03/12/the-soc-starting/ https://fly.io/blog/soc2-the-screenshots-will-continue-until...
Comment linking /blog/2020/03/12/the-soc-starting/
on “The Startup CTO's Handbook”Submitted Cryptographic Right Answers: Post Quantum Edition as a story · 109 points
HN discussion> . If you're in cyber and don't have knowledge of these things you're either in something insanely niche, in research of some sort, or lack critical knowledge that you should have Here are some things that counter this: https://users.ece.cmu.edu/~adrian/731-sp04/readings/Ptacek-N... : A paper that rocked the security industry at the time. Tptacek also was cofounder of Matasano, now part of NCC; also cofounder of La…
Comment linking /blog/2018/04/03/cryptographic-right-answers/
on “Google to buy Wiz for $32B”Submitted Latacora: Security Programs For Startups as a story · 98 points
HN discussionLatacora | Full-Time | Chicagoland, NYC Metro | Startup Security Engineer Latacora builds and operates security teams for startups. Look at the startups hiring on this thread, and imagine running the security team for, like, a bunch of them simultaneously. That’s what we’re about. You’d want to be interested in that problem to make reading further worth your time. We’re currently 6 security-researcher software-devel…
Comment linking /
on “Ask HN: Who is hiring? (March 2018)”Submitted How (not) to sign a JSON object (2019) as a story · 54 points
HN discussionLatacora | Chicago, Remote (USA) You could pick a startup to do security work for. Or you could join our team and work for lots of startups, all at once. Latacora runs whole security teams for startups. We're a weird kind of consultancy: we have only one kind of client, and we work full-time with them for 6-18 months, doing everything every startup security team does, from software security to cryptography design to…
Comment linking /careers
on “Ask HN: Who is hiring? (September 2018)”Submitted The PGP Problem (2019) as a story · 12 points
HN discussionGoogle "Cryptographic Right Answers". There are a couple of different posts, but they agree on the most of the things you would look for. Ex.: https://gist.github.com/tqbf/be58d2d39690c3b366ad or https://www.latacora.com/blog/2018/04/03/cryptographic-right...
Comment linking /blog/2018/04/03/cryptographic-right-answers/
on “Online Cryptography Course (2017)”Submitted Latacora – Security Teams for Startups as a story · 7 points
HN discussionLatacora | Security Engineers | Full-time | Remote (Chicago HQ) You could pick one startup to work for. But why choose? You can also work for a bunch of them simultaneously. We're building a security team that runs security teams for startups. We're a novel firm: we have only one kind of client (startups). We work full-time with them for anywhere between 6 months to going on 4 years now. We do everything a security…
Comment linking /careers
on “Ask HN: Who is hiring? (March 2021)”Submitted Stop Using Encrypted Email (2020) as a story · 5 points
HN discussionLatacora | corpsec engineer | Remote | Full-time | https://www.latacora.com If working on security at a startup is appealing, here's an opportunity to work with a whole group of startups --- in health care, in financial services, in hardware, in transportation, in AI, and even in sports analytics. You'll be a member of a growing security team with multiple practice areas, working with security veterans, talented dev…
Comment linking /
on “Ask HN: Who is hiring? (October 2021)”Submitted Stop Using Encrypted Email (2020) as a story · 5 points
HN discussionHell no. Email encryption should be left to rot. https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...
Comment linking /blog/2020/02/19/stop-using-encrypted/
on “Getting ready to issue IP address certificates”Submitted The PGP Problem [2019] as a story · 5 points
HN discussionLatacora | Security Engineers | Full-time | Chicago or Remote You could pick one startup to work for. But why choose? You can also work for a bunch of them simultaneously. That's what we did. We're Latacora, and we're building a security team that runs security teams for startups. We're a weird firm: we have only one kind of client, and we work full-time with them for 6-18 months, doing everything a security team do…
Comment linking /careers
on “Ask HN: Who is hiring? (September 2019)”Submitted Stop Using Encrypted Email (2020) as a story · 4 points
HN discussionRelated: Latacora's (2019) article, How (not) to sign a JSON object[1]. In short, nesting trees and signing them is difficult and prone to pitfalls. It's easier if the envelope holds the message as a raw string, and the signing is performed on the raw string. [1]: https://www.latacora.com/blog/2019/07/24/how-not-to/
Comment linking /blog/2019/07/24/how-not-to/
on “Sign in as anyone: Bypassing SAML SSO authentication with parser differentials”Submitted The PGP Problem (2019) as a story · 4 points
HN discussionNo, it’s here (scroll all the way to the bottom): https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
Comment linking /blog/2019/07/16/the-pgp-problem/
on “Age is a simple, modern and secure file encryption tool, format, and Go library”Submitted Cryptographic Right Answers: Post Quantum Edition as a story · 4 points
HN discussionRecommended in here I believe: https://www.latacora.com/blog/2020/03/12/the-soc-starting/
Comment linking /blog/2020/03/12/the-soc-starting/
on “Age is a simple, modern and secure file encryption tool, format, and Go library”Submitted How (not) to sign a JSON object (2019) as a story · 4 points
HN discussionI'm no cryptographer, but I would say that it is indeed the case that you can assume that two parties can derive a shared key over an untrusted channel. The post Cryptography Right Answers PQ [1], linked in another comment, addresses this in the section "Key Exchange". Rather than thinking about Diffie-Hellman directly, you would turn to a Key Exchange Mechanism (KEM). Before post-quantum cryptography concerns, KEM…
Comment linking /blog/2024/07/29/crypto-right-answers-pq/
on “Digital signatures and how to avoid them”Submitted The PGP Problem as a story · 3 points
HN discussionThey published a followup to that article two months ago, and the correct answer in 2024 is still HMAC. https://www.latacora.com/blog/2024/07/29/crypto-right-answer...
Comment linking /blog/2024/07/29/crypto-right-answers-pq/
on “Digital signatures and how to avoid them”Submitted Cryptographic Right Answers: Post Quantum Edition as a story · 3 points
HN discussion
