Projects
View all (17)
fineprint Compare VPNs on logging, jurisdiction, audits and payment, with a source for every claim
'%3e%3crect%20width='64'%20height='64'%20fill='%230019a8'/%3e%3cpath%20d='M32%209v46'%20stroke='%23fff'%20stroke-width='5'%20stroke-linecap='round'/%3e%3cpath%20d='M9%2046h11l22-22h13'%20fill='none'%20stroke='%23fff'%20stroke-width='8.5'%20stroke-linejoin='round'%20stroke-linecap='round'/%3e%3cpath%20d='M9%2046h11l22-22h13'%20fill='none'%20stroke='%23e32017'%20stroke-width='5'%20stroke-linejoin='round'%20stroke-linecap='round'/%3e%3ccircle%20cx='32'%20cy='34'%20r='6'%20fill='%23fff'/%3e%3ccircle%20cx='32'%20cy='34'%20r='3'%20fill='%230019a8'/%3e%3ccircle%20cx='32'%20cy='16'%20r='6.5'%20fill='none'%20stroke='%23ffd23f'%20stroke-width='1.2'%20opacity='.7'/%3e%3ccircle%20cx='32'%20cy='16'%20r='3.5'%20fill='%23ffd23f'/%3e%3c/g%3e%3c/svg%3e)
tubespotting Real-time London Underground map for live train locations
android-rom-compat Which Android ROMs run on your phone, feature availability and bootloader unlock status
token-usage-dashboard Dashboard for historical token usage for Claude, Codex and OpenCode
peng-top A system monitor for your browser: CPU, memory, disks, network, sensors and processes
git-star-ranking Where any GitHub user, organization or repo ranks by stars, updated every six hours
Writing
View all (32)- Your reverse proxy makes the internet look like localhost
- Linux thinks Ireland is on daylight saving all winter
- Self-hosted Mattermost sends your DMs via Google and Apple
- Chrome's dark mode stops flipping logos at 65 pixels
- jsDelivr handed out the hijacked axios 940,000 times
- Why the Wayback keeps saving Anubis's bot check
- npm's worms ride a few big accounts, not your dependencies
- Ubuntu 24.04 gets kernel fixes two months after Debian
- Can the server you SSH into read your screen?
- Wikipedia dropped this UUID in 2014. Now it's everywhere
Security Research
View all (125)CVE-2026-126192General sibling combinator inside :has() matches untrusted HTML in quadratic timeCVE-2026-126207CSS url() sanitization bypass via escaped parentheses in LoofahCVE-2026-117656Unverified Sign in with Apple callback parameter can override verified ID token claimsCVE-2026-118257sanitizeTranslatedHtml allows DOM XSS via iframe srcdocCVE-2026-106121JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSCVE-2026-102826RCE in simple-git 3.36.0 via customArgs include.pathCVE-2026-104845Memory exhaustion via unchecked TypedArray length in JSON deserializationCVE-2026-92091Quadratic key_ops duplicate check in JWK.import_key allows CPU-exhaustion DoSCVE-2026-84370SVGO: removeScripts allows executable links through namespace and control-character bypassesCVE-2026-75899fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingCVE-2026-104182JSONC parser re-scans the whole accumulated comment on every chunk, costing quadratic CPUCVE-2026-102990Quadratic-time CPU denial of service in the Client.list() Unix directory-listing parser
facelessuser/soupsieve
flavorjones/loofah
pow-auth/assent
intlify/vue-i18n
rabbitmq/rabbitmq-java-client
steveukx/git-js
lxsmnsyc/seroval
latchset/jwcrypto
svg/svgo
fastify/fast-uri
uhop/stream-json
patrickjuchli/basic-ftp
smartcorelib/smartcore
sveltejs/devalue
redis/rueidis
gotify/server
rust-lang/rust-forge
wazero/wazero
nvm-sh/nvm
predis/predis
ebitengine/purego
Automattic/mongoose
JanDeDobbeleer/oh-my-posh