Top all-time · #16113
Matthew Sullivan
Personal blog · mattslifebytes.com · on HN as sullivanmattsecurityprogramming
Matthew Sullivan writes Matt's Life Bytes, a personal blog at mattslifebytes.com about security and programming. Since 2011, 4 different Hacker News readers have linked it 18 times, most often “Hijacking user sessions with the Heartbleed vulnerability”. It is still writing: the last post was on 2025-10-31, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link a post about a session-theft example against JIRA, tied to the OpenSSL Heartbleed disclosure. The comment cites it as a trivial demonstration of how memory leaks can expose session data.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Matthew Sullivan's blog and technical notes.
Most-linked posts?
- Hijacking user sessions with the Heartbleed vulnerability2 people · 2 mentions · first linked 2014-04-08
What Hacker News says?
There is one network entry point per deployment of our app infrastructure (eg. US and EU deploys), so the lambda does go and update both security groups simultaneously to allow the requestor's IP to hit either if they would like. If you wanted to, you could certainly make it more fine-grained than that, but the goal was simply to cut off the majority of the Internet from these mechanisms as an extra protection layer…
Comment linking /2018/08/07/protecting-internal-applications-with-a-saml-aware-reverse-proxy-a-tutorial/
on “Remote access to production infrastructure (death to the VPN)”Submitted Remote access to production infrastructure (death to the VPN) as a story · 236 points
HN discussionSee this post for a trivial example of session theft from JIRA [1]. You may not get the memory chunk you want the first time, but you can repeat it until you do. [1] https://www.mattslifebytes.com/?p=533
Comment linking /?p=533
on “OpenSSL Heartbleed Security Update”Submitted Hijacking user sessions with the Heartbleed vulnerability as a story · 214 points
HN discussionI built this with AWS Lambda. Relevant info if someone else wanted to try my approach to build such a service: https://mattslifebytes.com/2023/04/14/from-rebuilds-to-reloa...
Comment linking /2023/04/14/from-rebuilds-to-reloads-hacking-aws-lambda-to-enable-instant-code-updates/
on “Show HN: I made an in-browser code editor with code replay and REPL”Submitted We desperately need a way to notify people of high-impact vulns, so I built one as a story · 12 points
HN discussionSubmitted Getting your money’s worth: making runtime logging more valuable as a story · 3 points
HN discussionSubmitted Remote access to production infrastructure (death to the VPN) as a story · 3 points
HN discussionSubmitted Cattle not pets: infrastructure, containers and security in a cloud native world as a story · 3 points
HN discussionSubmitted We desperately need a way to notify people of high-impact vulns, so I built one as a story · 2 points
HN discussionSubmitted ID Theft, Porn, and Profit: A 2AM Dumpster Dive. as a story · 2 points
HN discussionSubmitted From rebuilds to reloads: hacking AWS Lambda to enable instant code updates as a story · 1 points
HN discussionSubmitted The missing piece: the need for product management in security teams as a story · 1 points
HN discussionSubmitted The missing piece: the need for product management in security teams as a story · 1 points
HN discussionSubmitted Security has a product management problem as a story · 1 points
HN discussionSubmitted (removed) as a story · 1 points
HN discussionSubmitted (removed) as a story · 1 points
HN discussionSubmitted Protecting internal applications with a SAML-aware reverse-proxy (a tutorial) as a story · 1 points
HN discussion