Top all-time · #2591
Nikolai Tschacher
Personal blog · incolumitas.com · on HN as incolumitassecurity
Nikolai Tschacher's personal blog at incolumitas.com covers security. Since 2016, 32 different Hacker News readers have linked it 39 times, most often “Typosquatting programming language package managers”. It is still writing: the last post was on 2026-09-17, and you can follow it by feed.
Nikolai Tschacher's ideas around IT security and computer science
Most-linked posts?
- Typosquatting programming language package managers10 people · 10 mentions · first linked 2016-06-08
- Typosquatting programming language package managers (2016)4 people · 4 mentions · first linked 2018-10-27
- Scrape like the big boys4 people · 4 mentions · first linked 2021-11-05
- Typosquatting in Programming Language Package Managers [pdf]3 people · 3 mentions · first linked 2016-06-08
- TCP/IP Fingerprinting for VPN and Proxy Detection2 people · 2 mentions · first linked 2021-05-05
- /2 people · 2 mentions · first linked 2022-03-10
What Hacker News says?
This attack has been previously described in the paper "Typosquatting package managers": Paper: http://incolumitas.com/data/thesis.pdf Blog post: http://incolumitas.com/2016/06/08/typosquatting-package-mana... Discussion: https://news.ycombinator.com/item?id=11862217 https://www.reddit.com/r/netsec/comments/4n4w2h/ The paper also discusses possible mitigation measures, including prohibiting registering new packages…
Comment linking /2016/06/08/typosquatting-package-managers/
on “Malicious crossenv package on npm”Submitted Typosquatting programming language package managers as a story · 486 points
HN discussionThe doc ( http://incolumitas.com/data/thesis.pdf ) does have a short section on ethics, but IMHO it completely misses the point of the ethical concerns in running unauthorized, non-sandboxed code on devices you don't own. Instead it justifies the research by saying the threat cannot be shown unless the vulnerability is exploited, which is true, but that fact does not justify the research. The acknowledgements mentio…
Comment linking /data/thesis.pdf
on “Typosquatting programming language package managers”Submitted Scrape like the big boys as a story · 374 points
HN discussion> In the thesis itself, several powerful methods to defend against typo squatting attacks are discussed. Therefore they are not included in this blog post. http://incolumitas.com/data/thesis.pdf section 5 "Practical implications". Just wanted to point out that in case you skipped it it's worth a read, some interesting proposals there that are worth discussing with package manager maintainers. I particularly like the…
Comment linking /data/thesis.pdf
on “Typosquatting programming language package managers”Submitted So you want to scrape like the big boys (2021) as a story · 321 points
HN discussionI appreciate the proactive approach. Is your project the author of the packages identified by NBU? If so: (1) Why is the tracking pingback obfuscated? (2) Why does the code include a cheeky hello instead of a link to https://www.pytosquatting.org/ ? (3) Why is there not a visible warning when installing one of these packages? ================= edit: Reading through the linked blog post [0], it appears these research…
Comment linking /2016/06/08/typosquatting-package-managers/
on “Malicious software libraries found in PyPI posing as well known libraries”Submitted TCP/IP Fingerprinting for VPN and Proxy Detection as a story · 4 points
HN discussionOk, here's some ugly backstory on this: This problem has been known for a while, yet both the pypi devs and the python security team decided to ignore it. Last year someone wrote his thesis describing python typosquatting and standard library name squatting: http://incolumitas.com/2016/06/08/typosquatting-package-mana... However after that the packages used in this thesis - the most successful one being urllib2 - we…
Comment linking /2016/06/08/typosquatting-package-managers/
on “Malicious software libraries found in PyPI posing as well known libraries”Submitted Typosquatting programming language package managers (2016) as a story · 3 points
HN discussionRelated to this? http://incolumitas.com/2016/06/08/typosquatting-package-mana...
Comment linking /2016/06/08/typosquatting-package-managers/
on “Malicious software libraries found in PyPI posing as well known libraries”Submitted Fuzzing the WPA3 Dragonfly Handshake as a story · 3 points
HN discussionBesides NPMgate? http://incolumitas.com/2016/06/08/typosquatting-package-mana... https://github.com/npm/npm/pull/4016 http://blog.npmjs.org/post/141702881055/package-install-scri...
Comment linking /2016/06/08/typosquatting-package-managers/
on “Felony – An open-source PGP keychain”Submitted Programming to Improve Your Life as a story · 3 points
HN discussionSure. https://github.com/NikolaiT/Crawling-Infrastructure And here I am writing about it (but its quite old): https://incolumitas.com/2019/08/31/web-scraping-puppeteer-aw...
Comment linking /2019/08/31/web-scraping-puppeteer-aws-lambda/
on “Scrape like the big boys”Submitted Typosquatting programming language package managers as a story · 3 points
HN discussionIt's easier to detect that someone is using a SOCKS tunnel – from memory, one way it might be exposed is if the packet TTL is incongruous [1] as I don't think SOCKS rewrites those. At the height of the pandemic I travelled to Denmark for work (on a clinical trial) and had a UK negative covid test to report to the UK government that I hadn't got around to – whose website geo-blocks people reporting covid tests from o…
Comment linking /2021/03/13/tcp-ip-fingerprinting-for-vpn-and-proxy-detection/
on “GoodbyeDPI: Deep Packet Inspection circumvention utility”Submitted Typosquatting in Programming Language Package Managers [pdf] as a story · 3 points
HN discussionThis has a lot of good info on how to cloudflare and others work, and more creative ways to bypass them if the easier options don't work https://incolumitas.com/2021/05/20/avoid-puppeteer-and-playw...
Comment linking /2021/05/20/avoid-puppeteer-and-playwright-for-scraping/
on “The State of Web Scraping 2022”Submitted Achieving Your Dreams as a story · 2 points
HN discussionSort of, and only with a lot of effort: https://incolumitas.com/2021/01/10/browser-based-port-scanni...
Comment linking /2021/01/10/browser-based-port-scanning/
on “Barclays using TeamViewer font to warn customers”Submitted Scrape like the big boys (2021) as a story · 2 points
HN discussionhttps://incolumitas.com/2016/06/08/typosquatting-package-man... https://news.ycombinator.com/item?id=11862217
Comment linking /2016/06/08/typosquatting-package-managers/
on “3500 packages uploaded to PyPI, pointing to a malicious URL”Submitted BotOrNot (2021) as a story · 2 points
HN discussion> I think there’s literally no way for the backend to tell that the request isn’t sent by my browser and is actually being sent by a random Python program. Oh my sweet summer child. Unfortunately, there is a whole industry built around this. This a great blog discussing different detection methods: https://incolumitas.com/
Comment linking /
on “How to use undocumented web APIs”Submitted Typosquatting programming language package managers (2016) as a story · 2 points
HN discussionWere the research / data leakage packages from the student who did their thesis on the security of pypi etc..? https://incolumitas.com/2016/06/08/typosquatting-package-man...
Comment linking /2016/06/08/typosquatting-package-managers/
on “Malicious Python libraries found and removed from PyPI”Submitted On High-Precision JavaScript Timers as a story · 2 points
HN discussionThis. Installing modules from npm is dangerous enough. Nice for education or playing around, unsuitable for a serious developers' workstation. Related: http://incolumitas.com/2016/06/08/typosquatting-package-mana...
Comment linking /2016/06/08/typosquatting-package-managers/
on “Show HN: Auto install npm dependencies as you code”Submitted Breaking the Google Audio ReCAPTCHA with Google's Own Speech to Text API as a story · 2 points
HN discussion
