Top all-time · #8334
Tim Cotten
Personal blog · blog.cotten.ioeconomicssecurity
Tim Cotten's personal blog at blog.cotten.io covers economics and security. Since 2018, 9 different Hacker News readers have linked it 35 times, most often “Ghost Emails: Hacking Gmail's UX to Hide the Sender”. It is still writing: the last post was on 2024-12-04, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Tim Cotten's blog for posts on email security, such as MIME parsing attacks and iOS mail exploits, plus a Bitcoin fork piece. Commenters cite these posts as sources without judging the writing.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Ghost Emails: Hacking Gmail's UX to Hide the Sender2 people · 5 mentions · first linked 2018-11-17
- Bitcoin Cash Fork – SV is burning $1,500 an hour trying to keep up2 people · 2 mentions · first linked 2018-11-20
- Delaying the Inevitable: Muir Glacier and the Ethereum Difficulty Bomb2 people · 2 mentions · first linked 2020-01-02
- We Burned Down Players’ Houses in Ultima Online2 people · 2 mentions · first linked 2022-12-24
What Hacker News says?
> So discover them. Roll in your piles of cash from those easy picking bounties. Prove your point. Sure, I already did. I earned the second highest bounty for Fastmail back in 2019 for exactly this kind of exploit. Since then I've reported to dozens of programs (OpenSSL, ClamAV, SpamAssassin, ProtonMail, Hey, Missive, Yahoo Mail, Yandex, Spark, Trello, Missive, AWS, Google Chrome) and rolled in a few tidy piles. I h…
Comment linking /ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff
on “Can I Email?”Submitted We Burned Down Players’ Houses in Ultima Online as a story · 564 points
HN discussion> some email providers also filter incoming messages and remove malformed MIME components that are needed to reach a vulnerability. I wrote @ronomon/mime [1] for this purpose, to protect downstream user email clients from MIME bombs [2], invalid charsets which can crash Apple Mail, multiple From headers which can exploit Gmail [3], attachment directory traversals, malicious continuation indices, truncated MIME messa…
Comment linking /ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff
on “The Fully Remote Attack Surface of the iPhone”Submitted Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector as a story · 114 points
HN discussionI wrote @ronomon/mime ( https://github.com/ronomon/mime ) as a strict fuzz-tested MIME parser in a memory-safe language to prevent similar attacks such as: 1. Malicious character encodings that can crash email clients such as Apple Mail. 2. Malicious RFC 2231 continuation indices designed to cause overallocation. 3. Base64 data containing illegal characters such as null bytes. 4. Unterminated comments and quoted-str…
Comment linking /ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff?gi=48cba6771ff7
on “You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild”Submitted A Blockchain Analysis of the July 13th Mueller Indictment as a story · 109 points
HN discussionIf you don't expect your users to receive shell script email attachments from untrusted sources (which could be the initial attack vector here), then blocking the SH extension would be one simple step. Of course, there are a few more things you could do: blocking shell script shebang signatures, zipped files with the executable bit set etc. If this is something you want from your email provider, along with some othe…
Comment linking /ghost-emails-hacking-gmails-ux-to-hide-the-sender-46ef66a61eff
on “HiddenWasp Malware Stings Targeted Linux Systems”Submitted Delaying the Inevitable: Muir Glacier and the Ethereum Difficulty Bomb as a story · 90 points
HN discussionAlso, there seems to be a 'war' going on between the two forks. [1] 1. https://blog.cotten.io/bitcoin-coin-fork-satoshi-vision-losi...
Comment linking /bitcoin-coin-fork-satoshi-vision-losing-1-500-an-hour-7b49a5e5bae1
on “End of Cryptocurrency is near as Bitcoin drops to new lows”Submitted A Very Sleepy MySQL Attack as a story · 70 points
HN discussionSubmitted Russia's Bitcoin Hacking Funds: How the Mueller Investigation Ties It Together as a story · 7 points
HN discussionSubmitted Ghost Emails: Hacking Gmail's UX to Hide the Sender as a story · 7 points
HN discussionSubmitted Bitcoin Crashes Below Energy Cost as a story · 4 points
HN discussionSubmitted We Burned Down Players’ Houses in Ultima Online as a story · 3 points
HN discussionSubmitted Decentralizing a Certificate of Deposit as a story · 3 points
HN discussionSubmitted Bitcoin Isn't Dying, but Another Big Crash Is Coming as a story · 3 points
HN discussionSubmitted Another Bitcoin Price Crash Imminent? as a story · 3 points
HN discussionSubmitted Bitcoin Cash Fork – SV is burning $1,500 an hour trying to keep up as a story · 3 points
HN discussionSubmitted We Burned Down Players’ Houses in Ultima Online as a story · 2 points
HN discussionSubmitted Fixing SEM Campaigns with Python as a story · 2 points
HN discussionSubmitted How to Eat Gas in Ethereum – Consuming 99.9% of the Gas Limit as a story · 2 points
HN discussionSubmitted Greedy ‘Connect 4’ for Fun and Profit – Kaggle's New Simulations Contest as a story · 2 points
HN discussionSubmitted Wash Trading: How Crypto Exchanges Are Faking 67% of Trade Volume as a story · 2 points
HN discussionSubmitted An Overview of Bitcoin Transaction Types and Methods of Laundering as a story · 2 points
HN discussionSubmitted Congress on Market Manipulation and Crypto Regulation as a story · 2 points
HN discussionSubmitted Hacking Node.js “May I Have This Repo?” – The Danger of Upstream Dependencies as a story · 2 points
HN discussionSubmitted Gmail Vulnerability Allows Anonymous Emails as a story · 2 points
HN discussionSubmitted We Burned Down Players’ Houses in Ultima Online as a story · 1 points
HN discussionSubmitted Tracing the Twitter Hacked Bitcoins as a story · 1 points
HN discussionSubmitted Apple News Shows “Brown *****” on Front Page – Thanks BuzzFeed as a story · 1 points
HN discussion