Top all-time · #13420
Varun Biniwale
Personal blog · varun.ch · on HN as varun_chsecurityweb
Varun Biniwale's personal blog at varun.ch covers security and web. Since 2022, 5 different Hacker News readers have linked it 45 times, most often “Retrieving your browsing history through a CAPTCHA”. It is still writing: the last post was on 2025-07-24, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Commenters link the author's /history page as a demonstration of a CSS visited-link history leak, cited in threads on Asahi Linux and captcha data exfiltration. Other comments mention the author's projects.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Web developer and cybersecurity researcher.
Most-linked posts?
- Retrieving your browsing history through a CAPTCHA4 people · 6 mentions · first linked 2022-03-05
What Hacker News says?
https://varun.ch , having my fairly common first name (and the correct ccTLD) is pretty cool! It's just a static HTML website hosted with Vercel.
Comment linking /
on “Ask HN: Share your personal site”Submitted The most unhinged video wall, made out of Chromebooks as a story · 566 points
HN discussionI do something similar on my website: https://bini.wales returns 200 for all endpoints and logs all attempts, so it makes for a decent have a honeypot against automated attacks (mostly it just catches people mass scanning for vulnerable WordPress plugins or leftover backdoors). Similarly, https://varun.ch/login emulates a WordPress site (with a twist)
Comment linking /login
on “Portspoof: Emulate a valid service on all 65535 TCP ports”Submitted Retrieving your browsing history through a CAPTCHA as a story · 405 points
HN discussionI like this idea - even for little tips I find along the way when trying to solve challenges. But then the new issue I have is I end up cluttering my blog with these lower effort posts that get in the way of the longer pieces. How do others solve this? Like separate feeds or something? Here’s an example: https://varun.ch/posts/macos-keyboard/ I don’t think this should be among by “posts” but do others have a “fireho…
Comment linking /posts/macos-keyboard/
on “The benefits of learning in public”Submitted Exploring Google Hangouts' easter eggs as a story · 123 points
HN discussionI actually posted a demo of a modern spin on this here recently: https://news.ycombinator.com/item?id=30569396 :) Since browsers don't allow websites to detect the link colour, we can just trick the user into telling it for us. https://varun.ch/history After posting that, I got some emails from others, and someone shared a cool technique involving detecting how long it takes to paint the link to the screen. https://…
Comment linking /history
on “Barclays using TeamViewer font to warn customers”Submitted How to Hack the Breakthrough Prize (Ft. Session Confusion) as a story · 29 points
HN discussionThis is seriously awesome! I made something extremely similar called Dock'n'Roll, but this looks far more polished. I think we should make our own tools more often. https://varun.ch/projects/dockn
Comment linking /projects/dockn
on “Thinkserver: My web-based coding environment”Submitted You shouldn't need to write a scraper just to list the available electives as a story · 12 points
HN discussionThis reminds me of one of my favorite web things: https://incr.easrng.net/ It's a little button counter in an iframe that you can embed on your website. It also looks great next to 88x31s.. I have one in my footer https://varun.ch/ I think I just love the idea of making static pages a little more interactive by adding in these little widgets. I have an HTML form embedded on my contact page that's hooked up to `ntfy`…
Comment linking /
on “Open Heart Protocol”Submitted Retrieving your browsing history through a CAPTCHA as a story · 12 points
HN discussion@varun_ch : Great going! I saw your "About" [0] page and you are only 15! Awesome time to be learning and finding more about code. On a side note, I feel old :( [0] https://varun.ch/#projects
Comment linking /
on “Exploring Google Hangouts' easter eggs”Submitted There's something fishy about the Flappy Bird revival as a story · 9 points
HN discussionhttps://varun.ch/posts/history/ :)
Comment linking /posts/history/
on “Canvas Fingerprinting”Submitted Browsers need to change how autofill works as a story · 4 points
HN discussionI just did something similar last week: https://varun.ch/posts/elective-list/ it’s almost funny how similar the scraping code ends up looking for these kinds of things
Comment linking /posts/elective-list/
on “Vibe coding the MIT course catalog”Submitted How to turn Firefox into a usable web browser as a story · 4 points
HN discussionI built my new site ( https://varun.ch ) using 11ty, because they seem to commit to never making breaking API changes. They have a YouTube video where they build a pre 1.0 project in 2.0. https://youtu.be/bPtQmsjXMuo https://www.11ty.dev/blog/stability/
Comment linking /
on “Some Notes on Upgrading Hugo”Submitted Most 16-year-olds don't have servers in their rooms as a story · 4 points
HN discussionAsahi Linux is exploiting a browser vulnerability with that CSS trick, specifically the one that https://varun.ch/history shows off. Firefox has a mitigation for that vulnerability by turning off layout.css.visited_links_enabled.
Comment linking /history
on “Hacker News evading criticism by selectively adding noreferrer to certain links”Submitted Make your shell 370.52% faster with this easy trick (fix nvm startup times) as a story · 2 points
HN discussionthis looks like it's set by your org? https://varun.ch/posts/your-company/
Comment linking /posts/your-company/
on “Gmail thinks I'm stupid, so I left”Submitted ChatGPT's Initial Prompt for Programming Questions as a story · 2 points
HN discussionAlso, I’m also surprised an XSS attack like hasn’t yet been actually used to harvest credentials like passwords through browser autofill[0]. It seems like the worm code/the replicated code only really attacks stuff on site. But leaking credentials (and obviously people reuse passwords across sites) could be sooo much worse. [0] https://varun.ch/posts/autofill/
Comment linking /posts/autofill/
on “Wikipedia in read-only mode following mass admin account compromise”Submitted Trusted by [Your Company] as a story · 2 points
HN discussionIt is fantastic that Firefox gives us the benefit of choice though. Maybe Chrome or whatever has better UX taste out of the box, but good luck changing anything if you disagree. I wrote a blog post about how I customized Firefox exactly to what I wanted https://varun.ch/posts/firefox/ including a minimal UI, monospaced font, sidebar, etc etc. userChrome.css is a great feature and it’s amazing that it’s just exposed…
Comment linking /posts/firefox/
on “Making Firefox's right-click not suck with about:config”Submitted Copymarklets: Bookmarks for Copying Text as a story · 2 points
HN discussionFunny that this comes up today! I was just looking into adding a keyboard monitor to my website (I have a goal of making my 'contact me' page have oddly specific information). I wouldn't show the actual keys, just show a blinking light when there's activity, but I guess the timing really could expose quite a lot of information. I did add a trackpad monitor though. It shows my raw MacBook trackpad data. https://varun…
Comment linking /contact/
on “Why does SSH send 100 packets per keystroke?”Submitted This YouTube video contains its own ID as a story · 2 points
HN discussion