Writing
Notes
On privacy, security, and how to think about both — the same plain-spoken register the lessons use, at greater length. RSS.
Anonymous From Whom?
Almost every privacy decision people regret comes from skipping one question. It takes four honest answers, costs nothing, and decides whether the tool you are about to buy does anything for you at all.
Nobody Is Caught by Broken Encryption
People picture deanonymisation as cryptography failing. It is almost always a username, an old account, and patience. Here is how the search actually runs, and what it costs an attacker when you make it fail.
The Bug Is the Way You Built the String
SQL injection is thirty years old and still shipping, because it is taught as a trick to defend against rather than as a mistake you can stop making. There is nothing to patch except how the query gets assembled.
The Padlock Is Not a Trust Badge
HTTPS makes one specific promise and people hear three others. Phishing sites have padlocks too — here is what the icon actually guarantees, and the thirty seconds of address-bar reading that does the job people think it is doing.