Top all-time · #3269
System Overlord
Personal blog · systemoverlord.comsecurityprogramming
System Overlord is a personal blog at systemoverlord.com about security and programming. Since 2014, 23 different Hacker News readers have linked it 24 times, most often “Lessons Learned from SSH Credential Honeypots”. It is still writing: the last post was on 2026-03-23, and you can follow it by feed.
Most-linked posts?
- /2020/06/14/private-ca-with-x-509-name-constraints.html6 people · 6 mentions · first linked 2021-03-23
- Lessons Learned from SSH Credential Honeypots5 people · 5 mentions · first linked 2020-09-05
- What the LastPass CLI Tells Us about LastPass Design2 people · 2 mentions · first linked 2015-09-17
- /blog/2015/08/16/so-is-windows-10-spying-on-you/2 people · 2 mentions · first linked 2015-08-21
What Hacker News says?
Here's an approach I've used before successfully. It's not perfect but it's better than nothing. 1. Create your own root Certificate Authority. 2. Create a script using your favorite language and libraries that will create a new certificate for each device something along the lines of "myiotdevice-AABBCCDD.local". The AABBCCDD needs to be some sort of serialized number that's assigned during manufacturing and won't…
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “Chrome’s address bar will use https:// by default”Submitted Building a Home Lab for Offensive Security and Security Research as a story · 93 points
HN discussionHere's a nice analysis by a well-known security researcher in response to that article. He could not confirm the results. https://systemoverlord.com/blog/2015/08/16/so-is-windows-10-...
Comment linking /blog/2015/08/16/so-is-windows-10-spying-on-you/
on “Updates Make Windows 7 and 8 Spy on You Like Windows 10”Submitted Posting JSON with an HTML Form (2016) as a story · 54 points
HN discussionIt does; they're called "name constraints". This page https://systemoverlord.com/2020/06/14/private-ca-with-x-509-... claims they're supported by "all current browsers". x509 extensions can be marked "critical" or not. If the name constraint was marked critical, then AIUI old software should (in theory) fail secure, and reject everything signed by the CA.
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “Increasing HTTPS Adoption”Submitted Lessons Learned from SSH Credential Honeypots as a story · 5 points
HN discussionDid anyone tried to MITM a Windows 10 install e.g. with adding his own cert to the certstore? Edit: Found this: https://systemoverlord.com/blog/so-is-windows-10-spying-on-y...
Comment linking /blog/so-is-windows-10-spying-on-you/
on “Windows 10 Enterprise telemetry network traffic analysis, part 1”Submitted What the LastPass CLI Tells Us about LastPass Design as a story · 5 points
HN discussionThank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “Special-use domain 'home.arpa.' (2018)”Submitted What the LastPass CLI Tells Us about LastPass Design as a story · 4 points
HN discussiondoes iphone support name constraints on CA certificates? ( https://systemoverlord.com/2020/06/14/private-ca-with-x-509-... )
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “iOS 18 breaks IMAPS self-signed certs”Submitted Lessons Learned from SSH Credential Honeypots as a story · 3 points
HN discussionThis advice operates from a mindset that both privacy and security risks are binary. They are not+. A third-party app that gives access to X,Y, and Z permissions is a larger security risk than an equivalent app that only has permissions for X. So if an app only needs X in its current version but requests Y and Z, then it is introducing unnecessary risk. + See e.g. https://systemoverlord.com/blog/2014/09/05/security-…
Comment linking /blog/2014/09/05/security-not-a-binary-state/
on “Spotify apologizes for new terms and conditions roll-out”Submitted Raspberry Pi as a Penetration Testing Implant (Dropbox) as a story · 3 points
HN discussionWhat, really? Your source is "some Czech guy?" I mean maybe it's true and maybe it's not, but at the same time an article that presumably doesn't link the original article because they don't want people just going directly there and which might be quoting the most lunatic fringe conspiracy theory is not worth taking particularly seriously. A five-minute search tends to indicate that this guy: https://systemoverlord.…
Comment linking /blog/2015/08/16/so-is-windows-10-spying-on-you/
on “A (Terrifying) Traffic Analysis of Windows 10”Submitted Lessons Learned from SSH Credential Honeypots as a story · 2 points
HN discussionName constraints https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “DNS-Persist-01: A New Model for DNS-Based Challenge Validation”Submitted Course Review: Reverse Engineering with Ghidra as a story · 2 points
HN discussionI have a CA for home services and was worried about this, so I use name constraints to limit the domains that it is allowed to sign certs for. This blog (not mine) goes into how to do it: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
Comment linking /2020/06/14/private-ca-with-x-509-name-constraints.html
on “Tailscale Has Partnered with Mullvad”Submitted Lessons Learned from SSH Credential Honeypots · System Overlord as a story · 2 points
HN discussionSubmitted Lessons Learned from SSH Credential Honeypots as a story · 1 points
HN discussionSubmitted SANS Holiday Hack Challenge 2016 as a story · 1 points
HN discussionSubmitted Security at the End of 2016 as a story · 1 points
HN discussionSubmitted Towards a Better Password Manager as a story · 1 points
HN discussion
