Top all-time · #2103
Blargh
Personal blog · blog.habets.se · on HN as thomashabets2systemssecurityprogramming
Blargh is a personal blog at blog.habets.se about systems, security and programming. Since 2013, 35 different Hacker News readers have linked it 107 times, most often “Attention people who think UB is fine”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Too few sampled comments (17) to say how often HN recommends it.?
Why HN links it
HN readers link Blargh for practical SSH and hardware-key guides (Yubikey with gpg-agent, TPM-protected SSH keys, OpenSSH certificates) and for critiques of Go and C undefined behaviour.
Summarised by Claude from a sample of 17 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The blog where I write down random techy things I've found or done.
Most-linked posts?
- Attention people who think UB is fine5 people · 5 mentions · first linked 2026-10-23
- Go is still not good4 people · 4 mentions · first linked 2025-08-22
- Everything in C is undefined behavior3 people · 3 mentions · first linked 2026-05-19
- Seccomp – Unsafe at any speed (2022)2 people · 7 mentions · first linked 2022-07-14
- Gettimeofday() should never be used to measure time (2010)2 people · 5 mentions · first linked 2020-06-18
- /2021/06/The-uselessness-of-bash.html2 people · 5 mentions · first linked 2021-07-07
- /2019/11/TCP-MD5.html2 people · 4 mentions · first linked 2020-05-15
- BPF: The Future of Configs (2020)2 people · 2 mentions · first linked 2020-12-21
- You cannot sell AI written software2 people · 2 mentions · first linked 2026-05-12
- /2013/02/GPG-and-SSH-with-Yubikey-NEO.html2 people · 2 mentions · first linked 2018-01-14
What Hacker News says?
Reminds me of my (very limited) experience in China: https://blog.habets.se/2017/10/Internet-in-China.html
Comment linking /2017/10/Internet-in-China.html
on “Please stop using CDNs for external JavaScript libraries”Submitted Go is still not good as a story · 646 points
HN discussionYou can use a Yubikey NEO to handle key authentication on your computer's behalf: https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO
Comment linking /2013/02/GPG-and-SSH-with-Yubikey-NEO
on “OpenSSH: client bug CVE-2016-0777”Submitted Io_uring, kTLS and Rust for zero syscall HTTPS server as a story · 496 points
HN discussionAh, sorry I misunderstood. Addressed, yeah, but I would not say solved for the general case of all the namespaces. "Just put me in a (sand)box" is actually really tricky with namespaces, and depends on if you started off as root or not. More on using namespaces to drop privs: https://blog.habets.se/2022/03/Dropping-privileges.html (another backburner project) It's early morning so I may be wrong, but my testing seem…
Comment linking /2022/03/Dropping-privileges.html
on “Show HN: Porting OpenBSD Pledge() to Linux”Submitted Everything in C is undefined behavior as a story · 58 points
HN discussionI don't think Linux will get pledge() for a long time, and this definitely won't do it in the general case either. More specific critique of seccomp here: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...
Comment linking /2022/03/seccomp-unsafe-at-any-speed.html
on “Show HN: Porting OpenBSD Pledge() to Linux”Submitted TPM chip protecting SSH keys from being copied or stolen as a story · 50 points
HN discussionThanks for your work! As someone else who's banged their head against seccomp and given up (put on hold) I have to say that you're missing one roadblock though. It's not enough that the kernel gets pledge(), but libc needs to cooperate too. E.g. as I found in https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h... the first printf() you do will do a newfstatat() syscall. So really there's no way for user spa…
Comment linking /2022/03/seccomp-unsafe-at-any-speed.html
on “Show HN: Porting OpenBSD Pledge() to Linux”Submitted AX.25 in User Space as a story · 17 points
HN discussionThe Linux security space is pretty screwed up in general. E.g. seccomp is pretty much unusable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h... Another post of mine about how to drop privileges in Linux, and how hard it is: https://blog.habets.se/2022/03/Dropping-privileges.html I've started writing a library for dropping privs (as if that should even be necessary), but the devil is in the details, s…
Comment linking /2022/03/Dropping-privileges.html
on “SELinux is unmanageable; just turn it off if it gets in your way”Submitted Attention people who think UB is fine as a story · 15 points
HN discussionDoes using the Yubikey in this manner protect your keys even if your machine has malware on it? I read through this tutorial [1], and they say you need read/write access to the device, so it seems to me like malware could access your keys while the smartcard is plugged in. If this is the case, I'm not sure how this setup is any more secure than simply keeping your keys on a USB flash drive and plugging it in wheneve…
Comment linking /2013/02/GPG-and-SSH-with-Yubikey-NEO
on “Secure Secure Shell”Submitted Attention people who think UB is fine as a story · 7 points
HN discussionThis is much more stable for SSH than the article: https://blog.habets.se/2016/01/Yubikey-4-for-SSH-with-physic... (and also has physical presence proof). I've been using it for years on many machines. It's great. It's worked perfectly. Yes, the gpg-agent solution proposed in the article (which is what I used before PIV) was less stable. Nowhere near as bad as you describe though.
Comment linking /2016/01/Yubikey-4-for-SSH-with-physical-presence-proof.html
on “Using a Yubikey for GPG and SSH”Submitted Rob Pike is wrong on bloat as a story · 5 points
HN discussionI prefer a physical presence proof for SSH instead of this proposed solution: https://blog.habets.se/2017/10/Yubikey-for-SSH-after-the-inf... (long version here: https://blog.habets.se/2016/01/Yubikey-4-for-SSH-with-physic... ) Before that I used the method described in the article, blogged at https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO....
Comment linking /2013/02/GPG-and-SSH-with-Yubikey-NEO.html
on “Using a Yubikey for GPG and SSH”Submitted BPF: The Future of Configs (2020) as a story · 4 points
HN discussionPlenty. Of the ones I use every day: * Parallel downloader ( https://github.com/ThomasHabets/rslurp ) * Email client ( https://github.com/ThomasHabets/cmdg ) * sudo replacement with phone auth: https://github.com/ThomasHabets/sim * Custom frontend to youtube: https://github.com/ThomasHabets/yurate * Scan-to-google-drive ( https://github.com/ThomasHabets/autoscan ) * My own RSS reader (not published. It will never be…
Comment linking /2016/01/Yubikey-4-for-SSH-with-physical-presence-proof.html
on “Ask HN: Have you created programs for only your personal use?”Submitted Fast Zero Copy Static Web Server with kTLS as a story · 3 points
HN discussionAlso, since it might be unfamiliar to many, here's another article that puts forward a criticism of Bitcoin, many of which are for ethical issues: https://blog.habets.se/2017/11/Why-bitcoin-is-terrible.html It's about bitcoin, and not everything applies to other cryptocurrencies, but most of these arguments do apply.
Comment linking /2017/11/Why-bitcoin-is-terrible.html
on “The Haskell Elephant in the Room”Submitted SSH over Bluetooth – Cleanly as a story · 3 points
HN discussion> C that does the right thing based on assumptions about the platform is possible What does that mean? "The right thing based on assumptions about the platform"? I hope it's not "but we know what this will actually do on my platform", because I just wrote another blog post about how UB is not predictable: https://blog.habets.se/2026/10/Attention-people-who-think-UB...
Comment linking /2026/10/Attention-people-who-think-UB-is-fine.html
on “Rust Style Guide”Submitted Attention people who think UB is fine as a story · 2 points
HN discussionIf you do want to decode it, it's probably not that hard. I was going to implement the transmission side when I did this, but then I moved. https://blog.habets.se/2017/04/Decoding-FSK.html
Comment linking /2017/04/Decoding-FSK.html
on “Attacking My Landlord's Boiler”Submitted Attention people who think UB is fine as a story · 2 points
HN discussionA curious question. Aside from my day job, this seems like a thing I do all day. :-) I'm not sure what the motivation for your question is. Do you feel like everything's been invented and built already, and it's just a matter of (at most) plugging the things together? I find myself constantly thinking "this should exist". I don't have time to make them all exist. https://github.com/ThomasHabets/arping Nothing like i…
Comment linking /2010/09/gettimeofday-should-never-be-used-to-measure-time.html
on “Ask HN: What are some tools / libraries you built yourself?”Submitted No way to parse integers in C as a story · 1 points
HN discussionIts possible to do, and once set up its a reasonably smooth process. - Init Your TPM - Create a key+cert on your TPM using certutil.exe - Grab your public key - Use WinCryptSSH ( https://github.com/buptczq/WinCryptSSHAgent ) as your SSH agent and away you go These are very simplified steps, but there are howtos floating around (eg https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.h... )
Comment linking /2016/10/Windows-SSH-client-with-TPM.html
on “Use TouchID to Authenticate Sudo on macOS”Submitted You cannot sell AI written software as a story · 1 points
HN discussion
