imcotton
Re:My –/.ssh folder has NO private keys
on Wednesday May 27, 2026 @02:19AM (#48290377)
How many AI agent running on your system right now?
My –/.ssh folder has NO private keys
The Nginx default page hides 5 clues that lead to same 24-word BIP39 mnemonic
Re:Hierarchy view now available in GitHub Projects
on Friday January 16, 2026 @02:27AM (#46643953)
The first thing I need to do after creating a repo on GitHub, disable Project in repo settings.
Cloudflare is using timingSafeEqual incorrectly in its own example docs
Blending crypto wallet seed into an AI slop essay
Show HN: Use color strips to wrap your crypto wallet
Show HN: Constant Entropy Mixtape Vol.01
https://jsr.io/@imcotton/contropy/0.10.2/src/mix/vol01.ts
Tools for blend passphrase into public entropy. Quote from LLM:> contropy (CONstant enTROPY) is a TypeScript/JavaScript library that aggregates entropy data from multiple heterogeneous sources, providing both programmatic and command-line interfaces for accessing diverse streams of constantly changing information. The system is designed to offer reliable access to entropy through a unified...
Re:Show HN: Forced to Give Your Password?
on Sunday August 03, 2025 @02:35AM (#44774552)
xkcd/538 never gets old.
Re:Apple's Liquid Glass: When Aesthetics Beat Function
on Wednesday July 23, 2025 @02:22PM (#44662338)
I did this in console:
$('#container').style = 'display: unset'
Re:Don't Animate Height
on Wednesday July 23, 2025 @06:14AM (#44657511)
Does anyone have the courage to perform a similar inspection on the Cloudflare homepage like the author did? On my M4 Mac mini, Safari lagged with single-digit frames per second (FPS), which scared me so much that I had to close the page as quickly as possible.
Re:Reverse Proxy Deep Dive
on Saturday July 12, 2025 @02:43PM (#44544074)
Thanks, I have being putting medium domain into dns blocklist for years.
Re:Makefile.md – Possibly Use(Ful|Less) Polyglot Synthesis of Makefile...
on Monday June 09, 2025 @07:19PM (#44230700)
now try this:
cat Makefile.md | npx offmarkShow HN: Client side rendered static site without JavaScript
Re:Image Compression Basics and EXIF Privacy Guide (Client-Side Demo T...
on Monday May 26, 2025 @09:19AM (#44097181)
It's good to have a client side that does not send data to remote, improvements:
- CSP and security headers, currently this site scores D on https://securityheaders.com
- no SRI check on CSS or JavaScript files.
- by loading adsbygoogle.js which invalidates any privacy protection claims.
Re:Ask HN: How do you store private keys?
on Saturday May 17, 2025 @05:04AM (#44013029)
I have previously written a blog post on this very topic, tl;dr: deleting your keys.
Show HN: Generate Subresource Integrity (SRI)
Ask HN: Why Cloudflare kept sending email on Invoice Amount: $0.00?
I have never saw this dark pattern anywhere else on the internet, do you?
Show HN: Cutting 100k Pi digits offline (PWA)
By the way, you can also host it yourself. The download link is located at the bottom of the About page.
You can not lose your key, if you drop it first
Accessible settings to disable all hovercards on GitHub
Re:The Age of Agent Experience
on Friday February 07, 2025 @05:08PM (#42978061)
I also think OAuth could be used to better serve AX in the age of agent, but before the whole industry find the PMF, shall we not leave the humans (us) behind? Thus I made one for breaking the grip of big IdPs and offer a more secure and easier authentication solutions for humans [1].
You can find its dogfooding demo on the Show HN [2].
Port a URL Shortener Web App from Deno Deploy to Cloudflare
Show HN: Personal URL Shortener Web App (Via Hono and Deno KV)
playground: https://dash.deno.com/playground/demo-shortThis is a demo show case for the JSR package [1] that gives you a off-the-shelf Web App for URL Shortener that could deploy on your own cloud or locally.100% JSR (i.e. npm free); 100% test coverage; no docs yet, please read the source code.Auth support via Hono built-in middlewares, also example from https://sign-poc.js.org (Disclaimer:...
Spots Around Hyrule (TotK)
Re:You can not lose your private key, if you drop it first
on Friday August 16, 2024 @01:50AM (#41263515)
In case one not digging into the source code, the key stretching here is PBKDF2-HMAC-SHA512 with 400,000 iterations (OWASP recommended 210,000).
The reason for not using Argon2 or scrypt is because PBKDF2 is native provide by Webcrypto yet FIPS-140 compliance.
Re:You can not lose your private key, if you drop it first
on Friday August 16, 2024 @12:00AM (#41263047)
Now, brute-force my private key and post new blog entry with your wallet address, I will send you rewards.