Top all-time · #198
Moxie Marlinspike
Personal blog · moxie.orgsecurityprogramming
Moxie Marlinspike's personal blog at moxie.org covers security and programming. Since 2013, 221 different Hacker News readers have linked it 249 times, most often “My First Impressions of Web3”. The last post was in 2024, but the archive is still widely read.
Sometimes recommended · 6 of 40 sampled comments recommend it, 3 are critical?
Why HN links it
HN readers link Moxie Marlinspike's blog for his arguments on PGP usability, Lavabit, privacy, and web3 and self-hosting, and cite his stories page. Commenters mostly use the posts as support; some dispute the self-hosting claim.
- Recommended for · 6 comments
- Stories called highly entertaining; privacy post among best arguments; web3 critique nailed; a favourite
- Criticised for · 3 comments
- Says no solutions and dated on public keys; claim people won't self-host called wrong, naive and destructive
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hard to say.
Most-linked posts?
- My First Impressions of Web355 people · 58 mentions · first linked 2022-01-07
- GPG and Me (2015)15 people · 15 mentions · first linked 2020-11-29
- GPG and me (2015)12 people · 14 mentions · first linked 2016-05-01
- We Should All Have Something to Hide12 people · 12 mentions · first linked 2016-05-15
- The Cryptographic Doom Principle10 people · 10 mentions · first linked 2016-05-03
- /2013/06/12/we-should-all-have-something-to-hide.html9 people · 10 mentions · first linked 2020-06-06
- The Cryptographic Doom Principle (2011)9 people · 10 mentions · first linked 2020-09-20
- /software/sslstrip/9 people · 9 mentions · first linked 2016-10-12
- A Crypto Challenge for the Telegram Developers (2013)9 people · 9 mentions · first linked 2016-04-19
- /blog/lavabit-critique/8 people · 9 mentions · first linked 2016-04-16
What Hacker News says?
Yep. On any other site I’d assume that comment was satire. Nothing’s changed in the last decade: https://moxie.org/2015/02/24/gpg-and-me.html https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
Comment linking /2015/02/24/gpg-and-me.html
on “After self-hosting my email for twenty-three years I have thrown in the towel”Submitted My First Impressions of Web3 as a story · 3393 points
HN discussionIt sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0] Even when they do use it, it’s easy to mess up. The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way t…
Comment linking /blog/gpg-and-me/
on “Zoom Acquires Keybase”Submitted Scene report from the Chernobyl Zone as a story · 397 points
HN discussionMoxie is currently completing New Year's resolutions that his friends have assigned him: https://moxie.org/stories/year-of-the-challenge/
Comment linking /stories/year-of-the-challenge/
on “Keep your phone number private with Signal usernames”Submitted What makes a good engineer also makes a good engineering organization (2024) as a story · 337 points
HN discussion> They issued fraudulent SSL certificates in 2011: https://www.schneier.com/blog/archives/2011/03/comodo_group_... Moxie had an amusing anecdote about this incident in his Blackhat 2011 talk "SSL and the future of authenticity"[0]. Apparently the same IP as was used by the "sophisticated attacker" and disclosed by Comodo downloaded sslsniff[1] from moxies server the next day, referred by a video tutorial about inter…
Comment linking /software/sslsniff/
on “Defending Our Brand”Submitted The Cryptographic Doom Principle (2011) as a story · 139 points
HN discussion> great way to explain privacy limitations to a non-tech-savvy person is to walk them through using GPG. Have you ever actually successfully done this? More than once? And they continue to use it? It's a usability nightmare. https://moxie.org/blog/gpg-and-me/
Comment linking /blog/gpg-and-me/
on “Facebook Secretly Saved Videos Users Deleted”Submitted The Worst (2012) as a story · 131 points
HN discussionThat's the sort of PoC that should be PGP encrypted to the Signal authors instead of publicly posted. Iran will have a field day with it being posted like this. Except, of course, that posting public keys is too 1990s for him https://moxie.org/2015/02/24/gpg-and-me.html (which contains some good arguments but offers no solutions, so whatcha gonna do, post a phone number and trust the signal servers to give you the r…
Comment linking /2015/02/24/gpg-and-me.html
on “Help users in Iran reconnect to Signal”Submitted GPG and Me (2015) as a story · 101 points
HN discussionI got the impression that his web3 post [0] only talks about token incentives, DAOs and other decentralisation for decentralisation's sake. There's no mention of MobileCoin, which I gather he just sees as tool to facilitate anonymous payments (it's a token on top of Stellar). [0] https://moxie.org/2022/01/07/web3-first-impressions.html
Comment linking /2022/01/07/web3-first-impressions.html
on “New Year, New CEO”Submitted GPG and me (2015) as a story · 101 points
HN discussionI couldn't disagree more. The fact that our laws are subjectively interpreted is a blessing. There are so many laws that the Congressional Research Service can't even count them all. In other words, we are all breaking laws every day.[0] Absolute law enforcement is a bad idea, for the fact that it provides no path towards civil disobedience[1] Take for example the Texas "sodomy" law, that prevented homosexual couple…
Comment linking /blog/we-should-all-have-something-to-hide/
on “I Turned a Routine Traffic Ticket into a Constitutional Trial”Submitted A Crypto Challenge for the Telegram Developers (2013) as a story · 77 points
HN discussionHighly entertaining stories https://moxie.org/stories.html (Moxie Marlinspike)
Comment linking /stories.html
on “Ask HN: Favorite Blogs by Individuals?”Submitted A Saudi Arabia Telecom's Surveillance Pitch (2013) as a story · 59 points
HN discussion"People don’t want to run their own servers, and never will". Moxie Marlinspike https://moxie.org/2022/01/07/web3-first-impressions.html
Comment linking /2022/01/07/web3-first-impressions.html
on “Web3 is centralized and inefficient”Submitted Your app shouldn't suffer SSL's problems (2011) as a story · 44 points
HN discussionI think the blog post of Moxie Marlinspike is related to this. It was also discussed some weeks ago: https://news.ycombinator.com/item?id=29845208 https://moxie.org/2022/01/07/web3-first-impressions.html
Comment linking /2022/01/07/web3-first-impressions.html
on “Web3 is centralized and inefficient”Submitted GPG and Me (2015) as a story · 26 points
HN discussionI still can't get over that NFT's are just a URL pointing to the data. They don't even have an on-chain hash of the digital asset. It's like selling a sign pointing to houses for the price of the house, and claiming you own the house, hoping that the sign will increase in value the way the house does, and bragging about it. For reference: https://moxie.org/2022/01/07/web3-first-impressions.html
Comment linking /2022/01/07/web3-first-impressions.html
on “Web3 is centralized and inefficient”Submitted Signal’s Founder on GPG (2015) as a story · 19 points
HN discussion- nl · 2022-03-23
This is a pretty weak piece. > Your wallet (MetaMask), marketplaces (OpenSea), APIs (Alchemy) are all central platforms. The whole point of the blockchain as a decentralized database idea is that people are free (in the "you don't need permission" sense) to build on it. Just because OpenSea is a popular interface for trading NFTs it doesn't mean you can't also trade those same NFTs elsewhere. And your wallet isn't "…
Comment linking /2022/01/07/web3-first-impressions.html
on “Web3 is centralized and inefficient” Submitted GPG and Me (2015) as a story · 18 points
HN discussionI guess this is a good opportunity to review Matthew Green and Moxie's posts on PGP, too: https://blog.cryptographyengineering.com/2014/08/13/whats-ma... https://moxie.org/blog/gpg-and-me/
Comment linking /blog/gpg-and-me/
on “I'm giving up on PGP”Submitted What makes a good engineer also makes a good engineering organization as a story · 11 points
HN discussionSee my comment above about the unencrypted backup. It's basically a UX tradeoff: You can not promote default E2E + no autobackups -- people in mass are not ready to lose their data when losing the device. Nor they are ready to store the key separately in a confidential manner. Nor they are ready to manually transfer the key among different devices. All this UX situation is defined by Moxie (the author of Signal and…
Comment linking /2015/02/24/gpg-and-me.html
on “Arrest of Pavel Durov, Telegram CEO, charges of terrorism, fraud, child porn”Submitted The Worst (2012) as a story · 10 points
HN discussion