Top all-time · #6280
shubs
Personal blog · shubs.iosecurity
shubs is a personal blog at shubs.io about security. Since 2016, 12 different Hacker News readers have linked it 15 times, most often “The down fall of bug bounties”. It is still writing: the last post was on 2026-09-26, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Security researcher's blog on bug bounties and authentication bypasses, including 2FA bypasses on Google services. HN readers cite its posts as evidence in threads on npm security and Google bug bounty rewards.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
offensive security and security research
Most-linked posts?
- The down fall of bug bounties3 people · 3 mentions · first linked 2026-05-18
- So, you want to get into bug bounties?3 people · 3 mentions · first linked 2022-11-26
- High frequency security bug hunting: 120 days, 120 bugs2 people · 2 mentions · first linked 2016-07-29
- Frontier class vulnerabilities: it gets worse before it (maybe) gets better2 people · 2 mentions · first linked 2026-08-01
What Hacker News says?
> they can if npm enforces the usage of TOTP for publishing. So what is going to happen to all of the packages published before TOTP is turned on? Not to mention that there have been many cases where second-factors have been bypassed (even Google's authentication[1]). Which means I'm forced to trust that there are no exploits in NPM's authentication system, as opposed to trusting that PGP signatures are not broken.…
Comment linking /how-i-bypassed-2-factor-authentication-on-google-yahoo-linkedin-and-many-others/
on “Malicious crossenv package on npm”Submitted High frequency security bug hunting: 120 days, 120 bugs as a story · 129 points
HN discussionUdacity has a Networking for Web Developers course[0], but I'd recommend trying out things (such as running a simple web-app on your own server). Things like: - Running https://certbot.eff.org/instructions - Trying out a few different web servers (apache/nginx/caddy) - Playing around with load-balancers on $cloud_provider. - Spending time with docker networking ( https://docs.docker.com/config/containers/container-n…
Comment linking /enumerating-ips-in-x-forwarded-headers-to-bypass-403-restrictions/
on “Ask HN: Good books/courses to learn networking essentials for web developers?”Submitted Do we still enjoy software engineering in the age of AI? as a story · 3 points
HN discussionAnd some services that do phone calls can be tricked to save to voicemail (which was the case for Google, Facebook and various others previously): https://shubs.io/how-i-bypassed-2-factor-authentication-on-g...
Comment linking /how-i-bypassed-2-factor-authentication-on-google-yahoo-linkedin-and-many-others/
on “Adding a security key to Gmail”Submitted The down fall of bug bounties as a story · 3 points
HN discussionHere's someone who found 120 bugs in 120 days (in addition to working full time). The bounties totaled $80k. https://shubs.io/high-frequency-security-bug-hunting-120-day...
Comment linking /high-frequency-security-bug-hunting-120-days-120-bugs/
on “Increasing Google and Alphabet VRP rewards”Submitted A hackers perspective on bug bounty triage as a story · 3 points
HN discussionSubmitted Frontier class vulnerabilities: it gets worse before it (maybe) gets better as a story · 2 points
HN discussionSubmitted The down fall of bug bounties as a story · 2 points
HN discussionSubmitted Frontier class vulnerabilities: it gets worse before it (maybe) gets better as a story · 1 points
HN discussionSubmitted The down fall of bug bounties as a story · 1 points
HN discussionSubmitted So, you want to get into bug bounties? (2022) as a story · 1 points
HN discussionSubmitted So, you want to get into bug bounties? as a story · 1 points
HN discussionSubmitted So, you want to get into bug bounties? as a story · 1 points
HN discussion
