rapawel
The Privacy Manifesto
My conclusions after using Signed Exchanges on my website for 2 years
Stop obsessing about rendering performance
Swift Pilots Stablecoin on Linea, an Ethereum L2
YC X Coinbase RFS: Build Onchain
How Fairblock Is Unlocking Confidential Payments and Auctions on Arbitrum
AI Incident Database
OpenAI Moves into E-Commerce with Commission-Based Model for ChatGPT Sales
Is It Time to Un-Sass?
Hieroglyphs are easier than they look [video]
Phishing: Slash-like Unicode characters in URL [video]
The "Most Hated" CSS Feature: Cos() and Sin()
How fast do websites load from Google Search? Comparing loading methods
AI Political Compass Scores
Re:Show HN: Detect paid Cloudflare plans on any website via ECH
on Sunday September 14, 2025 @11:38AM (#45240609)
The tool only detects a subset of paid Cloudflare users - specifically those with the default ECH settings. If your site shows as undetermined, it likely means you're on a free plan or a paid plan with ECH enabled.
From what I've observed:
- Free plans: ECH is forcefully enabled (sni=encrypted)
- Paid plans: ECH is disabled by default (sni=plaintext), but can be manually enabled
The tool can only definitively distinguish between free plans and paid plans that use the default ECH settings.
Re:Show HN: Detect paid Cloudflare plans on any website via ECH
on Sunday September 14, 2025 @11:29AM (#45240535)
There are occasional false positives, but querying different Cloudflare data centers usually resolves this. I've found that switching VPN servers (which routes through different CF edge locations) eventually gives the correct result.
Re:Show HN: Detect paid Cloudflare plans on any website via ECH
on Sunday September 14, 2025 @11:00AM (#45240260)
Example website with paid subscription: Substack
https://experiments.pawelpokrywka.com/cloudflare-subscriptio...
Show HN: Detect paid Cloudflare plans on any website via ECH
https://experiments.pawelpokrywka.com/cloudflare-subscription-checker/
A tool that checks if any website uses a paid Cloudflare subscription by examining their public /cdn-cgi/trace endpoint. Cloudflare only allows disabling Encrypted Client Hello (ECH) in paid plans, so sni=plaintext indicates a paid subscription. Works on any Cloudflare-proxied site.
How websites load from Google Search and how to measure each method
NSA Spy Hub: The Most Secret Building in Manhattan [video]
The Hitchhiker's Guide to Dark Pools in DeFi
Re:Ask HN: Examples of AMP sites showing original URL after Google click?
on Sunday May 18, 2025 @06:05AM (#44020246)
Thanks for your response. I ran a test but I'm not sure if it's working as expected. I performed a Google search on my mobile device for "inurl:amp.cnn.com." However, when I clicked on a result, the page I saw did not appear to use AMP--it redirected me to edition.cnn.com instead.
Ask HN: Examples of AMP sites showing original URL after Google click?
I'm looking for examples of websites that implement AMP (Accelerated Mobile Pages) and, when accessed from Google Search results, display the original publisher URL in the browser address bar instead of a URL starting with google.com/amp. Specifically, I'm interested in sites using AMP Real URL (e.g., via Cloudflare with Signed Exchanges). If you know of any such sites, please share concrete...
Cartograms to better understand our world
World Password Day 2025 Survey: 72% of Gen Z reuse passwords
History of Aztec: Pioneering Privacy in Web3
Software Engineering Laws
You need to know your site's performance plateau (and how to find it)
Re:Show HN: Accessing a website you never visited before while being o...
on Wednesday April 16, 2025 @07:11AM (#43703890)
I published the repository with source code of the demo. The README contains detailed explanation how the demo works as well as instructions on how to host the demo yourself.