Top all-time · #3314
Talal Haj Bakry and Tommy Mysk
Personal blog · mysk.blogsecurity
Talal Haj Bakry and Tommy Mysk writes Mysk Blog, a personal blog at mysk.blog about security. Since 2020, 23 different Hacker News readers have linked it 28 times, most often “Link Previews: How a Simple Feature Can Have Privacy and Security Risks”. It is still writing: the last post was on 2026-08-25, and you can follow it by feed.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link Mysk's posts as original sources on iOS and app privacy, including clipboard access, Apple's Required Reason API, link previews, Safari tracking and Private Relay IP leaks.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cybersecurity & Mobile App Privacy Research. By Talal Haj Bakry and Tommy Mysk
Most-linked posts?
- Link Previews: How a Simple Feature Can Have Privacy and Security Risks4 people · 5 mentions · first linked 2020-10-26
- Psylo: A New Kind of Private Web Browser4 people · 4 mentions · first linked 2025-06-17
- TikTok Vulnerability Enables Hackers to Show Users Fake Videos3 people · 3 mentions · first linked 2020-04-13
- CVE-2026-28910: Breaking macOS App Sandbox Data Containers and Hijacking Apps3 people · 3 mentions · first linked 2026-05-21
- IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay2 people · 3 mentions · first linked 2026-08-04
- Popular iPhone and iPad Apps Snooping on the Pasteboard2 people · 2 mentions · first linked 2020-03-13
- Facebook and Instagram No Longer Generate Link Previews (Only in Europe)2 people · 2 mentions · first linked 2021-02-10
What Hacker News says?
iOS isn't free from this kind of snooping[1][2]. [1] "How popular apps can read your phone's clipboard without permission": https://www.mysk.blog/2020/03/10/popular-iphone-and-ipad-app... [2] "Popular iPhone and iPad Apps Snooping on the Pasteboard": https://www.telegraph.co.uk/technology/2020/03/30/popular-ap...
Comment linking /2020/03/10/popular-iphone-and-ipad-apps-snooping-on-the-pasteboard/
on “LinkedIn is copying the contents of my clipboard on every keystroke”Submitted iPhone apps can tell many things about you through the accelerometer as a story · 401 points
HN discussionIdentical situation when Facebook was asked to not show previews of the news articles, because of the ePrivacy directive. Could this go for the same legistlation? https://www.mysk.blog/2021/02/08/fb-link-previews/
Comment linking /2021/02/08/fb-link-previews/
on “Removing my site from Google search”Submitted Popular iPhone and iPad Apps Snooping on the Pasteboard as a story · 220 points
HN discussion"For example, Flo Health uses OHTTP for their app's Anonymous Mode, and Apple's Private Cloud Compute uses OHTTP to disassociate AI inference requests from user identities." Flo Health https://www.ftc.gov/news-events/news/press-releases/2021/06/... https://www.ftc.gov/enforcement/cases-proceedings/1923133/fl... https://www.ftc.gov/system/files/documents/cases/192_3133_fl... https://www.cbsnews.com/news/facebook-repo…
Comment linking /2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
on “Cloudflare OHTTP gateway”Submitted IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay as a story · 4 points
HN discussionOriginal source, buried within the article: https://www.mysk.blog/2024/05/03/apple-required-reason-api/
Comment linking /2024/05/03/apple-required-reason-api/
on “Google, Meta 'break' Apple's device fingerprinting rules”Submitted Psylo: A New Kind of Private Web Browser as a story · 4 points
HN discussionarticle w/ overview of how various platforms handle link-previews https://www.mysk.blog/2020/10/25/link-previews/ Discord: Downloads up to 15 MB of any kind of file. Facebook Messenger: Downloads entire files if it’s a picture or a video, even files gigabytes in size. * Google Hangouts: Downloads up to 20 MB of any kind of file. Instagram: Just like Facebook Messenger, but not limited to any kind of file. The server…
Comment linking /2020/10/25/link-previews/
on “Instagram servers download any link sent in Direct Messages even if it's 2.6 GB”Submitted Safari flaw can expose iPhone users in the EU to tracking as a story · 4 points
HN discussionThe original report, https://news.ycombinator.com/item?id=40208696 https://www.mysk.blog/2024/04/28/safari-tracking/
Comment linking /2024/04/28/safari-tracking/
on “Apple's 'incredibly private' Safari is not so private in Europe”Submitted Silent Replacement of Trusted macOS App Executables as a story · 3 points
HN discussion1776183767 | iCloud Private Relay is not secure | https://webrtchacks.com/apples-not-so-private-relay-fails-wi... | https://news.ycombinator.com/item?id=47767673 1785886306 | IP and DNS Leaks in WebKit Affecting Proxy Browsers and iCloud Private Relay | https://mysk.blog/2026/08/04/webkit-proxy-icloud-private-rel... | https://news.ycombinator.com/item?id=49176697 1785949588 | iCloud Private Relay leaks real IP addre…
Comment linking /2026/08/04/webkit-proxy-icloud-private-relay-ip-leak/
on “Apple's 'Private Relay' Is Exposing Users' Real IP Addresses”Submitted Psylo – A New Kind of Private Web Browser as a story · 3 points
HN discussionI'd like Psylo [1] to be available on other platforms like Linux and MacOS. Psylo puts each tab behind a VPN and give them their own cookie storage space. It feels like a dramatically more private tool than Orion. I tried Orion in Dec 2025 and it crashed more frequently than I could handle. It and/or VPNs I was using worked poorly with websites that I want to keep a page open on for days at a time. [1] https://mysk.…
Comment linking /2025/06/17/introducing-psylo/
on “Kagi releases alpha version of Orion for Linux”Submitted Facebook and Instagram No Longer Generate Link Previews (Only in Europe) as a story · 3 points
HN discussionMost ways to collect boot time are a "Required Reason API," so they declare through NSPrivacyAccessedAPITypeReasons, meaning AppLovin apps are (unsurprisingly) lying about what they are doing with the data. There's a fair amount of research into this, for example at https://mysk.blog/2024/05/03/apple-required-reason-api/ and https://blog.appicaptor.com/2025/02/05/apples-required-reaso... (which also documents a work…
Comment linking /2024/05/03/apple-required-reason-api/
on “I broke AppLovin's mediation cipher protocol”Submitted Psylo – A New Kind of Private Web Browser as a story · 2 points
HN discussionSubmitted Link Previews: How a Simple Feature Can Have Privacy and Security Risks as a story · 2 points
HN discussionSubmitted TikTok Vulnerability Enables Hackers to Show Users Fake Videos as a story · 2 points
HN discussionSubmitted Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps as a story · 1 points
HN discussionSubmitted Breaking macOS App Sandbox with Archive Utility as a story · 1 points
HN discussionSubmitted CVE-2026-28910: Breaking macOS App Sandbox Data Containers and Hijacking Apps as a story · 1 points
HN discussionSubmitted Link Previews: How a Simple Feature Can Have Privacy and Security Risks as a story · 1 points
HN discussionSubmitted Link Previews: How a Simple Feature Can Have Privacy and Security Risks as a story · 1 points
HN discussionSubmitted Link Previews: How a Simple Feature Can Have Privacy and Security Risks as a story · 1 points
HN discussionSubmitted TikTok Vulnerability Enables Hackers to Show Users Fake Videos as a story · 1 points
HN discussionSubmitted TikTok Vulnerability Enables Hackers to Show Users Fake Videos as a story · 1 points
HN discussion
