Top all-time · #5764
Tim McCormack
Personal blog · brainonfire.net/blogsecurityprogramming
Tim McCormack writes Brain on Fire, a personal blog at brainonfire.net about security and programming. Since 2012, 14 different Hacker News readers have linked it 25 times, most often “What is a parser mismatch vulnerability? (2022)”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers cite Tim McCormack's posts as references on parser mismatch vulnerabilities, where two parsers read the same data differently, and on poisoning AI crawlers that scrape personal blogs.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- What is a parser mismatch vulnerability? (2022)5 people · 6 mentions · first linked 2023-12-22
- Poisoning AI Scrapers4 people · 4 mentions · first linked 2024-09-24
- Load Balancing: Beyond Healthchecks3 people · 4 mentions · first linked 2019-07-30
What Hacker News says?
Maybe this is unsuitable for your use-case, but these days it's pretty easy to embed video yourself with the <video> tag and an MP4 file. Example: https://www.brainonfire.net/blog/2018/03/23/oxalis-leaf-open...
Comment linking /blog/2018/03/23/oxalis-leaf-opening-time-lapse/
on ““My Google account got suspended because of NewPipe””Submitted What is a parser mismatch vulnerability? (2022) as a story · 78 points
HN discussionShould be possible to do this with a static site, even. Here's what I've been doing so far: https://www.brainonfire.net/blog/2024/09/19/poisoning-ai-scr... (serving scrambled versions of my posts to LLM scrapers)
Comment linking /blog/2024/09/19/poisoning-ai-scrapers/
on “This website is for humans”Submitted Cryptographic Shuffle as a story · 30 points
HN discussionYou can also just stick video on your own blog using <video> tags. It's super easy these days! No Javascript libraries or Flash required. Here's an example on my own site: https://www.brainonfire.net/blog/2018/03/23/oxalis-leaf-open... And here's the source code: <video src="https://www.brainonfire.net/hotlink/20180323-oxalis-timelapse/oxalis-160x.mp4" poster="https://www.brainonfire.net/hotlink/20180323-oxalis-time…
Comment linking /blog/2018/03/23/oxalis-leaf-opening-time-lapse/
on “Can Beethoven send takedown requests?”Submitted Poisoning AI Scrapers as a story · 5 points
HN discussionHeck, with the right plants you can see them grow over the course of minutes: https://www.brainonfire.net/blog/2018/03/29/seeing-plants-mo...
Comment linking /blog/2018/03/29/seeing-plants-move/
on “Video filmed at four trillion frames per second captures light in a flash”Submitted Poisoning AI Scrapers (2024) as a story · 2 points
HN discussionThis kinda fits, though it's on a personal blog level: https://www.brainonfire.net/blog/2024/09/19/poisoning-ai-scr...
Comment linking /blog/2024/09/19/poisoning-ai-scrapers/
on “Devs say AI crawlers dominate traffic, forcing blocks on entire countries”Submitted Load Balancing: Beyond Healthchecks as a story · 2 points
HN discussionThis looks like a classic case of a parser mismatch vulnerability [0]. [0] https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...
Comment linking /blog/2022/04/11/what-is-parser-mismatch/
on “Forging signed commits on GitHub”Submitted An informal security assessment of Imzy (part 2) (2017) as a story · 1 points
HN discussionWell, yes... Differentials in parsing of the same data can definitely lead to security vulnerabilities. Just some random examples: - https://www.ias.cs.tu-bs.de/publications/parsing_differentia... - https://www.ndss-symposium.org/ndss-paper/diffcsp-finding-br... - https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...
Comment linking /blog/2022/04/11/what-is-parser-mismatch/
on “Libxml2's "no security embargoes" policy”Submitted What is a parser mismatch vulnerability? (2022) as a story · 1 points
HN discussionThis is a great example of a parser mismatch vulnerability. :-) https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...
Comment linking /blog/2022/04/11/what-is-parser-mismatch/
on “SMTP Smuggling – Spoofing Emails Worldwide”Submitted Making redo rebuild when directory contents change as a story · 1 points
HN discussionThe safety driver is basically irrelevant, beyond being a scapegoat. I've written up some words on this: https://www.brainonfire.net/blog/2018/03/23/safety-driver-sh...
Comment linking /blog/2018/03/23/safety-driver-sham-scapegoat-uber-desert-bus/
on “Why collision avoidance is harder for an AI-based system”Submitted Load Balancing: Beyond Healthchecks as a story · 1 points
HN discussionSpeaking of which, I made this some years ago: https://www.brainonfire.net/rx/the-joke.png
Comment linking /rx/the-joke.png
on “Cloudflare error page generator”Submitted Securing a Clojure Webapp with Let's Encrypt as a story · 1 points
HN discussionI have such nostalgia for the blogosphere. The one thing it's missing is post privacy; I want to be able to journal privately (like on Dreamwidth) but also use my own hosting and not rely on someone else's platform. I've been toying around with writing my own social media software along those lines, using servers. Some noodling about on that topic: https://www.brainonfire.net/blog/tag/social-media/
Comment linking /blog/tag/social-media/
on “Let’s all go back to Tumblr”Submitted Seqs and Colls in Clojure as a story · 1 points
HN discussionI found less-than-great results in a simulation where there's a slight persistent difference between two of the options: https://www.brainonfire.net/blog/2019/07/21/load-balancing-b... (as part of a larger study on healthchecks that Don't Suck).
Comment linking /blog/2019/07/21/load-balancing-beyond-healthchecks/
on “The power of two random choices (2012)”Parser mismatch vulnerabilities. https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...
Comment linking /blog/2022/04/11/what-is-parser-mismatch/
on “How fast can you validate UTF-8 strings in JavaScript?”(I also have this posted up on my personal blog: https://www.brainonfire.net/blog/2019/07/21/load-balancing-b... )
Comment linking /blog/2019/07/21/load-balancing-beyond-healthchecks/
on “Load Balancing: Beyond Healthchecks”
