Top all-time · #5212
Ryan Castellucci
Personal blog · rya.nc · on HN as ryan-csecurityprogramming
Ryan Castellucci's personal blog at rya.nc covers security and programming. Since 2015, 14 different Hacker News readers have linked it 43 times, most often “DKIM: Show Your Privates”. It is still writing: the last post was on 2025-10-04, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Ryan Castellucci's security and cryptography posts, including a presentation on the Bitcoin puzzle key cracking, a note on why ASIC mining hardware can't crack hashes, and DKIM private keys.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Ryan Castellucci’s blog - posts on computer security, programming, systems administration, electronics and general geekery
Most-linked posts?
- DKIM: Show Your Privates3 people · 5 mentions · first linked 2020-11-02
- Recreating the Craig Wright's Sartre file2 people · 4 mentions · first linked 2016-05-02
- Hacking a Virtual Power Plant2 people · 2 mentions · first linked 2024-08-08
- Ryan Castellucci: Forensic Bitcoin Cracking2 people · 2 mentions · first linked 2016-09-17
- /asic-cracking.html2 people · 2 mentions · first linked 2016-09-23
What Hacker News says?
https://rya.nc/files/paketto-2.00pre5.tar.gz I'm not sure whether I got it directly from him or if I had a saved copy, but that's the most recent version.
Comment linking /files/paketto-2.00pre5.tar.gz
on “Dan Kaminsky has died”Submitted Stupid certificate tricks as a story · 224 points
HN discussionI remember attending Dan Kaminsky’s talk at DEFCON 12 and being blown away by it. Three years later, I went on the original “Hackers on a Plane” trip and ended up seated next to Dan on one of the flights. We quickly became friends. His mentorship over the years had an enormous impact on me. We both went back to CCCamp in 2011. I excitedly told him about a reverse DNS scanning project (0.0.0.0/0 in 12 hours on AWS fo…
Comment linking /threads/dakami-eulogy.html
on “Dan Kaminsky has died”Submitted Hacking a Virtual Power Plant as a story · 189 points
HN discussionI've been doing this since around 2018, and have seen a few others implement it. https://rya.nc/dkim-privates.html
Comment linking /dkim-privates.html
on “Cracking a 512-bit DKIM key for less than $8 in the cloud”Submitted DKIM: Show Your Privates as a story · 132 points
HN discussionThey don't need to break into separate sites though - the issue at hand is that a single failure in the centralised "control plane" from the vendor (i.e. the API server that talks to consumers' apps) can be incredibly vulnerable. Here's a recent example where a 512-bit RSA signing key was being used to sign JWTs, allowing a "master" JWT to be signed and minted, giving control of every system on that vendor's control…
Comment linking /vpp-hack.html
on “The gigantic and unregulated power plants in the cloud”Submitted Putting an xz Backdoor Payload in a Valid RSA Key as a story · 37 points
HN discussionSure, here is a nice little presentation on the puzzle: https://rya.nc/forensic-bitcoin-cracking.html The main discussion thread on the bitcoin forum is this but it has a low signal-to-noise ratio: https://bitcointalk.org/index.php?topic=1306983.0 There is a secondary thread here: https://bitcointalk.org/index.php?topic=5218972.0 The point of the puzzle is indeed to brute force some private keys (not public keys), b…
Comment linking /forensic-bitcoin-cracking.html
on “Bitcoin puzzle #66 was solved: 6.6 BTC (~$400k) withdrawn”Submitted Storybits: Error Resistant Mnemonics as a story · 27 points
HN discussionYou may enjoy this (I believe it was on HN last year): "DKIM: Show Your Privates" [0]. [0] https://rya.nc/dkim-privates.html
Comment linking /dkim-privates.html
on “Hoax email blast abused poor coding in FBI website”Submitted Bitfi's hardware wallet is terrible as a story · 22 points
HN discussionYeah, it's kind of my thing :-) One of the previous times I hit the front page of HN it was for inserting snark into an X509 certificate and then using it on my site. https://rya.nc/cert-tricks.html
Comment linking /cert-tricks.html
on “Terminal escape sequences in Git commit email field”Submitted Why I'm releasing a brainwallet cracker at Defcon 23 as a story · 5 points
HN discussionI got around 50k hits to my "stupid cert tricks"[0] page from a combination of twitter, reddit and hackernews over a period of 48 hours. My site is static content generated with pelican[1], served by nginx and hosted on a $10/mo VPS. The page has one image, one stylesheet and a favicon. Peak rate was around 1.5 views per second (loads of the actual page - this does not include requests for assets). CPU usage was neg…
Comment linking /cert-tricks.html
on “Static Website Generators Are the Next Big Thing”Submitted Recreating the Craig Wright's Sartre file as a story · 4 points
HN discussionAFAIK bitcoin miners can't be used to crack hashes. See https://security.stackexchange.com/questions/62800/is-it-pos... , https://rya.nc/asic-cracking.html
Comment linking /asic-cracking.html
on “iOS 10: Security Weakness Discovered, Backup Passwords Much Easier to Break”Submitted HTTPS subresource validation fail as a story · 4 points
HN discussionThis is about Faketoshi Notamoto, right? click Yup. This guy is a pathological forger and is bad at it. Here's my write-up from when he got caught doing naughty things with ECDSA: https://rya.nc/sartre.html (as noted by another commenter, "pathological" is literal in this case)
Comment linking /sartre.html
on “Digital forgeries are hard”Submitted Ryan Castellucci: Forensic Bitcoin Cracking as a story · 3 points
HN discussionFYI, Ryan uses they/them pronouns ( https://rya.nc/about.html ).
Comment linking /about.html
on “Hacking a Virtual Power Plant”Submitted DKIM: Show Your Privates as a story · 2 points
HN discussionXombrero seems to be unmaintained and has severe security problems. It's HTTPS implementation is vulnerable to MitM script injection. See my post here: https://rya.nc/https-script.html
Comment linking /https-script.html
on “Show HN: Min – web browser with better search and built-in ad blocking”Submitted Strategically Holding Back Bugs and Patches [pdf] as a story · 2 points
HN discussionMany of the obscure WebKit browsers do not validate certificates on subresources, which allows MitM attackers to replace third party scripts with malicious ones. Some of them do this without even any UI indication that there is a problem. I have a test page here: https://rya.nc/https-script.html
Comment linking /https-script.html
on “On WebKit Security Updates”Submitted Plugin Secure: Exploiting Ambiguous Serialization as a story · 1 points
HN discussionI work for White Ops, which could reasonably be considered a verification vendor, though we prefer to be known as a security company. As you can imagine, specific techniques used for detecting fraudulent monkey patching (or even whether we attempt to do so) aren't generally something I can talk about. That said, there are a few slides about the cat-and-mouse games of .toString() here (starting about page 20): https:…
Comment linking /shmoo17
on “Two Cybercrime Rings and Eight Defendants Indicted for Digital Advertising Fraud”It isn't that ruse. I replicated the file that is verified in the screenshots - the ruse is that it contains an old bitcoin transaction from Satoshi rather than Sartre's writings. https://rya.nc/sartre.html
Comment linking /sartre.html
on “Is Craig Wright?”The code that checked for DRM support set the "distinctiveIdentifier" config option to "not-allowed" specifically to avoid being useful for tracking. Most of the stuff that people think is "fingerprinting" is just trying to confirm the browser is what it claims to be. It is (or was) tricky to make DRM work in chromium compiled from source. `!("a" == "a"[0])` just detects IE6/7, as they return undefined for "a"[0]: h…
Comment linking /files/A_nickel_tour_of_the_ad_fraud_ecosystem.pdf
on “Finding a random seed that solves a LeetCode problem (2023)”If I recall correctly, I downloaded all of them, then pruned any that appeared to have non-deterministic behaviour (for example, using random), then used the offline testing script[0] helpfully provided by the site. It was the first piece of code I put out that someone referred to as "art"[1]. Some others that hit the HN front page over the years: https://news.ycombinator.com/item?id=10195358 https://news.ycombinato…
Comment linking /threads/art-and-beauty.html
on “Finding a random seed that solves a LeetCode problem (2023)”