Top all-time · #10243
Lolware
Personal blog · lolware.netsecurityprogramming
Lolware is a personal blog at lolware.net about security and programming. Since 2013, 7 different Hacker News readers have linked it 50 times, most often “Reverse engineering GoDaddy's tracking script”. It is still writing: the last post was on 2026-06-10, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
The one linked post is about fuzzing nginx with afl-fuzz, which is the subject of a commenter's point about what afl-fuzz is bad at. The comment only points the author to an earlier discussion of it.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Reverse engineering GoDaddy's tracking script3 people · 3 mentions · first linked 2019-01-15
- Intercepting and Capturing MFA Logons2 people · 3 mentions · first linked 2017-08-03
- Fuzzing Nginx – Hunting vulnerabilities with afl-fuzz2 people · 2 mentions · first linked 2015-04-30
What Hacker News says?
Similar to the dependency issues raised elsewhere, I wrote this script largely because none of my servers run python: https://lolware.net/2015/10/27/letsencrypt_go_live.html
Comment linking /2015/10/27/letsencrypt_go_live.html
on “Entering Public Beta”Submitted Site requests bank logins for online purchases as a story · 282 points
HN discussionbug bounties How about just responding to reports? I've re-reported this to McAfee every year and originally blogged it on a much earlier version something like 2005. https://lolware.net/2012/12/12/uvscan.html
Comment linking /2012/12/12/uvscan.html
on ““AV is my single biggest impediment to shipping a secure browser.””Submitted Running the Let's Encrypt Beta as a story · 242 points
HN discussionLooking at their FAQ, mwave seem to have ceased this practice but they had a thriving online business at the time I wrote this: https://lolware.net/2016/11/17/requesting_bank_login.html Everybody single person who provided feedback on this blog argued I was "being pedantic about nothing", "throwing your fedora at them", and even at American Express they took very seriously the "get your money back" angle but seemed…
Comment linking /2016/11/17/requesting_bank_login.html
on “GitHub Has a Permission Problem”Submitted Reverse engineering GoDaddy's tracking script as a story · 125 points
HN discussionI write this blog a while ago: https://lolware.net/blog/react-xss-protection-cheat-sheet/ The feedback I got across the board was generally "what even is this code? If you it to work with react why isn't it a hook?"
Comment linking /blog/react-xss-protection-cheat-sheet/
on “React has grown beyond its original promise and it's causing more harm than good”Submitted The bloat of AMP as a story · 124 points
HN discussionI can't recommend this enough. You'd be surprised how incredibly often you can spot vulnerabilities in real life code just because you wrote an exploit in this challenge. I blogged about my run through the early sets a while back: https://lolware.net/2014/09/15/cryptochallenge.html Set eight however, is much more brutal (while still being fun). I've completed the first three and had to take a break. Looking forward…
Comment linking /2014/09/15/cryptochallenge.html
on “The cryptopals crypto challenges”Submitted Fuzzing Nginx – Hunting vulnerabilities with afl-fuzz as a story · 82 points
HN discussionWell I went to see if there was any news on this for an Australian, and all I found when I logged into LinkedIn was this advice regarding "restricting" my account from use: http://imgur.com/a/VOBQV I haven't sent out a direct message or "added" anyone in months, and the only recently posted content was this blog: https://lolware.net/2016/11/17/requesting_bank_login.html Despite not being able to log in, I've receive…
Comment linking /2016/11/17/requesting_bank_login.html
on “LinkedIn is now officially blocked in Russia”Submitted Concurrent Vulnerability scanning with Erlang as a story · 11 points
HN discussionI'm running Office 365 with the only thing is supports - Microsoft's app. Which is not infallible: https://lolware.net/2017/08/01/capturing-mfa-logons.html Edit: I've always felt strongly about having things like the AWS logon connected to a dedicated and otherwise unused mailbox, it helps minimise the risk discussed here.
Comment linking /2017/08/01/capturing-mfa-logons.html
on “Security Keys”Submitted HP D2D / StorOnce Storage unit backdoors as a story · 11 points
HN discussionI'd be interested in whether my script[0] works on Windows, aside from the obvious fact most Windows servers don't have Ruby. You could also just put a gets on line 43 to pause it before the verify, and copy the generated verify files onto said Windows server from any Linux box anywhere. [0] https://lolware.net/2015/10/27/letsencrypt_go_live.html
Comment linking /2015/10/27/letsencrypt_go_live.html
on “Public Beta: December 3, 2015”Submitted Security and Caching headers with S3 websites as a story · 3 points
HN discussionI'll take poor SMS based over none at all. https://lolware.net/assets/images/netregistry.png
Comment linking /assets/images/netregistry.png
on “Two-factor authentication is a mess”Submitted Obtaining Corporate Credentials via the Autodiscover Circus as a story · 2 points
HN discussionI switched the production backups for ctadvisor from WAL-E to WAL-G largely because of the whole the workflow I blogged about here: https://www.lolware.net/2017/02/02/continuous-backup-tests-w... I'm not a python person and playing with pip the various deps were painful. It's not the developer's fault - I write plenty of Ruby and I expect non-rubyists would have the same issues with some of my code. But having a Go…
Comment linking /2017/02/02/continuous-backup-tests-with-docker.html
on “WAL-G – fast archival and restoration for PostgreSQL”Submitted Abusing Google Safebrowse for Phished Credentials URLs as a story · 2 points
HN discussionThis was posted a few days back, I don't know if you've seen it? https://lolware.net/2015/04/28/nginx-fuzzing.html (discussion: https://news.ycombinator.com/item?id=9463785 )
Comment linking /2015/04/28/nginx-fuzzing.html
on “What afl-fuzz is bad at”Submitted Intercepting and Capturing MFA Logons as a story · 2 points
HN discussionAutodiscover has always been an interesting security problem. I wrote this years ago: https://lolware.net/blog/2020-09-02-autodiscover-circus/
Comment linking /blog/2020-09-02-autodiscover-circus/
on “Microsoft Mishandling Example.com”Submitted Using Hadoop with Clojure to Process Active Directory Data as a story · 2 points
HN discussionI've had several blogs trend very well. I built the site with Jekyll and run a single EC2 instance and never saw double digit load averages. I also ran a Facebook advertising campaign for this site[2] which is sitting on S3 with Cloudfront in front. I've load tested that to over 2,000 connections per second, which I expect would exceed the most popular blogs. If I was worried about bandwidth costs, I would use a $10…
Comment linking /2016/11/17/requesting_bank_login.html
on “Ask HN: Did your website get the HN/Reddit hug? What did you do?”Submitted Security audit walkthrough (aka React/Typescript/webpack template) as a story · 2 points
HN discussionCompromising a crappy wordpress site means compromising mailbox credentials. https://lolware.net/blog/2020-09-02-autodiscover-circus/
Comment linking /blog/2020-09-02-autodiscover-circus/
on “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”Submitted Argon2 code audits – Infer as a story · 2 points
HN discussionSubmitted Meta has an answer to YouTube Face as a story · 1 points
HN discussionSubmitted Time to Shutdown CT Advisor as a story · 1 points
HN discussion
