Top all-time · #1173
Micah Lee
Personal blog · micahflee.comsecurityprogrammingwriting
Micah Lee's personal blog at micahflee.com covers security, programming and writing. Since 2013, 61 different Hacker News readers have linked it 84 times, most often “Hardening Debian for the Desktop Using Grsecurity”. It is still writing: the last post was on 2026-10-11, and you can follow it by feed.
Hi, I'm Micah. I help journalists, researchers, and activists stay safe and productive.
Most-linked posts?
- Hardening Debian for the Desktop Using Grsecurity5 people · 5 mentions · first linked 2016-01-17
- Unfortunately, the ICEBlock app is activism theater4 people · 4 mentions · first linked 2025-09-02
- Backdoored Linux Mint, and the Perils of Checksums4 people · 4 mentions · first linked 2016-02-21
- /2014/12/fact-checking-pandos-smears-against-tor/3 people · 4 mentions · first linked 2015-04-14
- Technical analysis of the Signal clone used by Trump officials3 people · 3 mentions · first linked 2025-05-02
- Ubuntu shouldn't abuse trademark law to silence critics of its privacy decisions3 people · 3 mentions · first linked 2013-11-07
- Using Signal Groups for Activism3 people · 3 mentions · first linked 2025-06-16
- TeleMessage Customers Include DC Police, Andreessen Horowitz, JP Morgan,Hundreds3 people · 3 mentions · first linked 2025-05-22
- Practical Defenses Against Technofascism2 people · 3 mentions · first linked 2025-10-26
- Flock cameras are riddled with security vulnerabilities and hardcoded creds2 people · 2 mentions · first linked 2026-09-16
What Hacker News says?
You can. The author made the source code of the app itself available: https://micahflee.com/heres-the-source-code-for-the-unoffici...
Comment linking /heres-the-source-code-for-the-unofficial-signal-app-used-by-trump-officials/
on “Technical analysis of the Signal clone used by Trump officials”Submitted Technical analysis of the Signal clone used by Trump officials as a story · 807 points
HN discussionTeleMessage is a prominent, infamous such product: https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-...
Comment linking /tm-sgnl-the-obscure-unofficial-signal-app-mike-waltz-uses-to-text-with-trump-officials/
on “Signal Protocol and Post-Quantum Ratchets”Submitted DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage as a story · 666 points
HN discussionRegarding that "disclaimer" in the corner, here's why it was added: https://micahflee.com/2013/11/canonical-shouldnt-abuse-trade...
Comment linking /2013/11/canonical-shouldnt-abuse-trademark-law-to-silence-critics-of-its-privacy-decisions/
on “Fix Ubuntu”Submitted OnionShare makes it easy to publish anonymous, uncensorable websites as a story · 620 points
HN discussion“Important to note that nothing Wikileaks has published has ever had to be retracted. They've told the truth to the public about governments“ That isn’t true for their social media: https://micahflee.com/2019/01/lies-that-wikileaks-tells-you/
Comment linking /2019/01/lies-that-wikileaks-tells-you/
on “Key witness in Assange case admits to lies in indictment”Submitted TeleMessage, used by Trump officials, can access plaintext chat logs as a story · 262 points
HN discussionThey provide gpg signed sha hashes, it's apparently just not documented: https://micahflee.com/2016/02/backdoored-linux-mint-and-the-...
Comment linking /2016/02/backdoored-linux-mint-and-the-perils-of-checksums/
on “Linux Mint downloads (briefly) compromised”Submitted OnionShare 2 adds anonymous dropboxes as a story · 241 points
HN discussion> Yasha Levine dug up (showing that Tor gave intelligence services early notice of vulnerabilities that had not been patched) That's an unfounded accusation. Micah Lee wrote a very concise refutation of his smear campaign.[1] > I would be sure someone couldn't pierce the veil of anonymity. That still doesn't contradict the fact that using Tor is better than not. [1] : https://micahflee.com/2014/12/fact-checking-pand…
Comment linking /2014/12/fact-checking-pandos-smears-against-tor/
on “Italian Anti-Corruption Authority Adopts Onion Services”Submitted Exploring the Paramilitary Leaks as a story · 239 points
HN discussionWhat does "[dupe]" mean. When is it a misnomer. Consider some scenarios A. Two or more stories on the same topic on /active simultaneously, i.e., multiple threads of discussion on same topic Recent examples On Aug 30 2026, for example, we had two stories about Iceland both on /active at the same time https://www.bbc.com/news/articles/cn45vdxyvvlo http://www.ft.com/content/53b5abd8-2919-4dc6-8dd6-81fc054e8b... This h…
Comment linking /the-server-called-paranoia-defend-autistici-inventati/
on “US Government designates host of noblogs.org a "global terrorist"”Submitted TeleMessage Customers Include DC Police, Andreessen Horowitz, JP Morgan,Hundreds as a story · 176 points
HN discussionWell, they're not even using Signal, but a wrapper that's less secure. https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-...
Comment linking /tm-sgnl-the-obscure-unofficial-signal-app-mike-waltz-uses-to-text-with-trump-officials/
on “How Obama’s BlackBerry got secured (2013)”Submitted Just say no to OpenAI and Anthropic as a story · 171 points
HN discussionFreedom of the Press Foundation (disclosure: I am an employee) ships grsecurity kernels for SecureDrop. You have to build them yourself, but it really isn't that hard to do. We're working on making this easier for everybody by publishing guides [0] to building your own grsecurity kernel, as well as developing an Ansible playbook to automate building hardened kernels [1]. This is all still a work in progress, but exp…
Comment linking /2016/01/debian-grsecurity/
on “Analysis and Exploitation of a Linux Kernel Vulnerability”Submitted ICEBlock handled my vulnerability report in the worst possible way as a story · 161 points
HN discussionGiving an author 90 minutes of lead time before public negative press doesn’t count as responsible disclosure. Especially when that press doesn’t mention the specific security vulnerabilities you’re reporting to them. Here is a link to the blog post which accompanied the OP’s text: https://micahflee.com/unfortunately-the-iceblock-app-is-acti... Is it reasonable to expect a maintainer to assume in good faith when the…
Comment linking /unfortunately-the-iceblock-app-is-activism-theater/
on “ICEBlock handled my vulnerability report in the worst possible way”Submitted Unfortunately, the ICEBlock app is activism theater as a story · 137 points
HN discussionDisclaimer: UK citizen. I don’t know anything about ICE or whose side I’m “supposed to be on” politically here. I’m just responding to the details in the article. The app might as well be TodoApp. The vulnerability couldn’t have been reported in a worse way. OP gave unreasonably short deadlines, allowed moral opinions about the software to interfere with responsible disclosure, and interspersed details about the pot…
Comment linking /unfortunately-the-iceblock-app-is-activism-theater/
on “ICEBlock handled my vulnerability report in the worst possible way”Submitted TeleMessage Explorer: a new open source research tool as a story · 116 points
HN discussionFor reference here was his previous article https://micahflee.com/unfortunately-the-iceblock-app-is-acti...
Comment linking /unfortunately-the-iceblock-app-is-activism-theater/
on “ICEBlock handled my vulnerability report in the worst possible way”Submitted Why I’m Leaving Ubuntu for Debian as a story · 67 points
HN discussionhttp://blog.erratasec.com/2014/11/the-pando-tor-conspiracy-t... https://micahflee.com/2014/12/fact-checking-pandos-smears-ag...
Comment linking /2014/12/fact-checking-pandos-smears-against-tor/
on “A New Era at the Tor Project”Submitted The Operating System That Can Protect You Even if You Get Hacked as a story · 64 points
HN discussionThis app wasn't even the safest, see here: ICEBlock handled my vulnerability report in the worst possible way | https://micahflee.com/iceblock-handled-my-vulnerability-repo...
Comment linking /iceblock-handled-my-vulnerability-report-in-the-worst-possible-way/
on “Google removes ICE-spotting app following Apple's ICEBlock crackdown”Submitted Source code for the unofficial Signal app used by Trump officials as a story · 56 points
HN discussionFrom the other article which shared the email domains found in the heap. Sorry in advance for the poor formatting. --- Source: ` https://micahflee.com/telemessage-customers-include-dc-polic... ` ### I. Industry Breakdown *Financial Services (Dominant):* This is by far the most represented sector. It encompasses a wide array of sub-sectors: * *Investment Banking & Brokerage:* A large number of domains belong to globa…
Comment linking /telemessage-customers-include-dc-police-andreesen-horowitz-jp-morgan-and-hundreds-more/
on “TeleMessage Explorer: a new open source research tool”Submitted Flock cameras are riddled with security vulnerabilities and hardcoded creds as a story · 49 points
HN discussion
