Top all-time · #283
Robert Heaton
Personal blog · robertheaton.comprogrammingwritingcareer
Robert Heaton's personal blog at robertheaton.com covers programming, writing and career. Since 2012, 171 different Hacker News readers have linked it 308 times, most often “How Tinder keeps your exact location (a bit) private”. It is still writing: the last post was on 2025-06-11, and you can follow it by feed.
Sometimes recommended · 11 of 40 sampled comments recommend it?
Why HN links it
HN readers link Robert Heaton's security and privacy investigations (Wacom, Stylish, Tinder location, HP printers) and his writing on programming, system design and parenting. Commenters call his writing witty and enjoyable.
- Recommended for · 11 comments
- Called witty, enjoyable and hilarious; readers recommend his parenting series, project prompts, Simpson's Paradox post and other articles.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Software engineer. One-track lover down a two-way lane
Most-linked posts?
- How Tinder keeps your exact location (a bit) private11 people · 11 mentions · first linked 2018-07-17
- The Wavefunction Collapse Algorithm Explained10 people · 11 mentions · first linked 2018-12-18
- “Stylish” browser extension steals all your internet history9 people · 9 mentions · first linked 2018-07-03
- How to date a recording using background electrical noise9 people · 9 mentions · first linked 2022-10-25
- I was seven words away from being spear-phished7 people · 7 mentions · first linked 2019-06-25
- Preventing impossible game levels using cryptography6 people · 6 mentions · first linked 2020-07-22
- Systems Design for Advanced Beginners5 people · 7 mentions · first linked 2020-04-07
- Making Peace with Simpson's Paradox5 people · 5 mentions · first linked 2019-02-28
- Wacom tablets track every app you open5 people · 5 mentions · first linked 2020-02-05
- A system to help you remember more of what you read5 people · 5 mentions · first linked 2018-06-25
What Hacker News says?
The initial bug in Ruby/Rails is striking in its stupidity.[1] You can send something to Ruby/Rails in a session cookie which, when unmarshalled, stores into any named global variable in the namespace of the responding program . It's not a buffer overflow or a bug like that. It's deliberately designed to work that way . It's like doing "eval" on untrusted input. This was on YC years ago.[2] Why was anything so idiot…
Comment linking /2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
on “Instagram's Million Dollar Bug”Submitted Wacom tablets track every app you open as a story · 1594 points
HN discussionI've been sort of meta-learning for the past couple of weeks, reading about study methods and note taking and memory techniques, etc. and one prevailing theme regardless of the method is that repetition and rephrasing are key to internalise the information. E.g. you learn and retain the information far more efficiently if you take the route of read -> write note -> create flashcards from the note. As opposed to auto…
Comment linking /2018/06/25/how-to-read/
on “Learn how to design large-scale systems”Submitted Systems Design for Advanced Beginners as a story · 945 points
HN discussionSame here. It may be basic and crappy, but if you want to read an unsuccessful blog with no attempt at monetization or ads or even visitor counting, mine[1] is where you should feel right at home. But I guess the author means a platform, not loose websites without a collective 'new' feed. I remember looking for one when wanting to make a new blog and I haven't found a platform that felt right, at least back then (pr…
Comment linking /
on “If I could bring one thing back to the internet it would be blogs”Submitted PySkyWiFi: Free stupid wi-fi on long-haul flights as a story · 917 points
HN discussionIt might be Jekyll according to https://robertheaton.com/2014/07/26/lessons-from-a-surprisin...
Comment linking /2014/07/26/lessons-from-a-surprisingly-successful-blog/
on “Systems Design for Advanced Beginners”Submitted Tracking friends and strangers using WhatsApp as a story · 828 points
HN discussionI write regularly about security, programming, and several other topics at http://robertheaton.com/ . They’re detailed, offbeat, and very funny. I’ve broken several high-profile privacy abuses, most notably: * Wacom drawing tablets track the name of every application that you open - https://robertheaton.com/2020/02/05/wacom-drawing-tablets-tr... * “Stylish" browser extension steals all your internet history - https:…
Comment linking /2019/04/06/how-does-tor-work/
on “Ask HN: What is your blog and why should I read it?”Submitted Wacom drawing tablets track the name of every application that you open as a story · 630 points
HN discussionThe author has a few well written pieces. These two are hilarious: https://robertheaton.com/2014/10/25/tales-from-a-san-francis... https://robertheaton.com/2014/07/14/getting-nothing-done-a-m...
Comment linking /2014/07/14/getting-nothing-done-a-misguided-quest-for-productivity/
on “Tracking friends and strangers using WhatsApp”Submitted HP printers try to send data back to HP about your devices and what you print as a story · 497 points
HN discussionYes. See https://robertheaton.com/2018/08/16/stylish-is-back-and-you-... Use Stylus ( https://addons.mozilla.org/en-US/firefox/addon/styl-us/ ) instead.
Comment linking /2018/08/16/stylish-is-back-and-you-still-shouldnt-use-it/
on “Chrome users beware: Manifest v3 is deceitful and threatening”Submitted A blogging style guide as a story · 495 points
HN discussionIt is the better road, and the road chosen by most other things that aren't SaaS, including Google's other most popular thing, Android. Keep the default to auto-update, fine, but let me disable that, as the Android app store does. Attacks from previously trusted extensions (and apps) being updated and then doing malicious things (requesting new permissions to do them is not significant friction) are worse and more f…
Comment linking /2018/07/02/stylish-browser-extension-steals-your-internet-history/
on “Wikipedia article blocked worldwide by Delhi high court”Submitted Fun with your friend's Facebook and Tinder sessions as a story · 488 points
HN discussionIf you flip the setting, that doesn't solve a problem of a user installing the browser for the first time, installing an extension like Stylish †, going to a porn site in private mode and getting their private browsing history leaked to the extension operator together with their regular history. Who thought that is a good idea? :) † Stylish is a … special case [0]. But see also hypothes.is or any other extension tha…
Comment linking /2018/07/02/stylish-browser-extension-steals-your-internet-history/
on “Firefox 67.0 Released”Submitted “Stylish” browser extension steals all your internet history as a story · 484 points
HN discussionOh, but it gets better. When the furor over the app usage collection hit, they disabled the data collection via remote server 'kill switch' (the driver hits an XML file.) About a month later, after the furor died down - they flipped it right back on. https://robertheaton.com/2020/02/05/wacom-drawing-tablets-tr... Super fucking scummy.
Comment linking /2020/02/05/wacom-drawing-tablets-track-name-of-every-application-you-open/
on “Pens and Tablets for Linux”Submitted I was seven words away from being spear-phished as a story · 436 points
HN discussionHey this looks really helpful! I appreciate your commitment to privacy, that's a very important feature for me. Nonetheless, having been burned by Chrome extensions in the past [1], I'm worried about privacy and I'm wondering if you'd be willing to make it open source to allay those concerns. [1] https://robertheaton.com/2018/07/02/stylish-browser-extensio...
Comment linking /2018/07/02/stylish-browser-extension-steals-your-internet-history/
on “Show HN: I made a Chrome extension to stop mindless browsing”Submitted Lessons from a Silicon Valley job search as a story · 414 points
HN discussionYou can read up on it here: https://robertheaton.com/2019/01/15/a-brief-history-of-wi-fi... Looks like more recent phones are better about this, but there are still a lot of older phones out there! And there are still leakages that allow tracking. Note that with "real computers", just keeping the software up to date is enough to get you the latest in MAC randomization and whatnot; with phones, you may or may not be…
Comment linking /2019/01/15/a-brief-history-of-wi-fi-privacy-vulnerabilities/
on “The curious case of the Raspberry Pi in the network closet”Submitted A system to help you remember more of what you read as a story · 371 points
HN discussionGreat tips on writing, made me want to read more from the author and I found his post on WeSeeYou democratizing de-anonymization hilarious and thought provoking https://robertheaton.com/2017/10/17/we-see-you-democratizing...
Comment linking /2017/10/17/we-see-you-democratizing-de-anonymization/
on “A blogging style guide”Submitted Check you're wearing trousers first as a story · 321 points
HN discussionHere's an overview of the system Tinder currently uses, after their 2014 privacy fiascos: https://robertheaton.com/2018/07/09/how-tinder-keeps-your-lo...
Comment linking /2018/07/09/how-tinder-keeps-your-location-a-bit-private/
on “Telegram publishes users' locations online”Submitted The Wavefunction Collapse Algorithm Explained as a story · 304 points
HN discussionI really liked your article on how to take over Rails servers if they leak their secret. http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-u...
Comment linking /2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
on “Fun with your friend's Facebook and Tinder sessions”Submitted Take pride or fuck it as a story · 250 points
HN discussion
