Top all-time · #308
Thomas Ptacek
Personal blog · sockpuppet.org · on HN as tptaceksecurityprogramming
Thomas Ptacek writes A Final Ward, a personal blog at sockpuppet.org about security and programming. Since 2008, 163 different Hacker News readers have linked it 294 times, most often “Against DNSSEC (2015)”. It is still writing: the last post was on 2026-09-25, and you can follow it by feed.
Sometimes recommended · 8 of 40 sampled comments recommend it?
Why HN links it
HN readers link Thomas Ptacek's sockpuppet.org posts for his arguments on hiring, XTS disk encryption, DNSSEC and randomness in cryptography. Commenters cite them as the reference on those topics.
- Recommended for · 8 comments
- One commenter calls a post 'an amazing example'; others call posts 'pretty convincing', 'a nice post', and say to 'definitely read' one.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Thomas and Erin Ptacek on software, security, cryptography, hiring, and the occasional cocktail.
Most-linked posts?
- Against DNSSEC (2015)33 people · 47 mentions · first linked 2016-10-08
- The Hiring Post (2015)27 people · 46 mentions · first linked 2016-11-03
- The Hiring Post17 people · 20 mentions · first linked 2015-03-06
- How to safely generate a random number12 people · 20 mentions · first linked 2014-02-25
- You Don't Want XTS12 people · 18 mentions · first linked 2014-04-30
- How to Safely Generate a Random Number10 people · 15 mentions · first linked 2016-12-20
- DNS Nerds Don't Control the Internet (2016)9 people · 13 mentions · first linked 2016-10-28
- Against DNSSEC8 people · 19 mentions · first linked 2015-01-15
- You Don't Want XTS – Quarrelsome8 people · 8 mentions · first linked 2017-03-29
- Is Extended Random a Malicious NSA Plot?7 people · 8 mentions · first linked 2017-01-22
What Hacker News says?
Obligatory reference to tptacek's post at http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ -- see the end of chapter 2 for an amazing example
Comment linking /blog/2015/03/06/the-hiring-post/
on “Google: 90% of our engineers use the software you wrote (Homebrew), but...”Submitted I Went to SQL Injection Court as a story · 1230 points
HN discussionA pair of good articles on just this kind of thing: http://www.unlimitednovelty.com/2011/12/can-you-solve-this-p... http://sockpuppet.org/blog/2015/03/06/the-hiring-post/
Comment linking /blog/2015/03/06/the-hiring-post/
on “Google: 90% of our engineers use the software you wrote (Homebrew), but...”Submitted How to Write with an LLM as a story · 769 points
HN discussionThe HN post [0] is from February 9th, 2025, but the post the person you replied to was referencing [1] is from October 19th, 2018. [0] https://sockpuppet.org/blog/2025/02/09/fixing-illinois-foia/ [1] https://mchap.io/that-time-the-city-of-seattle-accidentally-...
Comment linking /blog/2025/02/09/fixing-illinois-foia/
on “I Went to SQL Injection Court”Submitted The Hiring Post as a story · 577 points
HN discussionReading https://sockpuppet.org/blog/2015/03/06/the-hiring-post/#work... , it looks like your process is better than most! However, I've walked away from interview processes that require a work sample that'll take more than a few hours or require lots of domain knowledge to get started. It just isn't worth my time, especially as a barrier to entry before talking to anyone. Things I am happy to do to see if I'm a good…
Comment linking /blog/2015/03/06/the-hiring-post/
on “When hiring senior engineers, you’re not buying, you’re selling”Submitted Starfighter, Summer 2015 as a story · 341 points
HN discussionA lot of this post seems pretty reasonable. But: In my experience, it’s fairly easy to judge technical skill. A friendly conversation about technical interests and recent projects can often be enough. Bullshit. Sounding credible in technical interviews is a skill, not the same skill as actually being a good programmer, and might even (statistically, in the large) be close to orthogonal to it. We found this out the h…
Comment linking /blog/2015/03/06/the-hiring-post/
on “When hiring senior engineers, you’re not buying, you’re selling”Submitted What even is an OS now? as a story · 311 points
HN discussiontptacek argues that DNSSEC is too flawed to actually do this: https://sockpuppet.org/blog/2015/01/15/against-dnssec/
Comment linking /blog/2015/01/15/against-dnssec/
on “Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds”Submitted The Starfighter Low-Level Tech Tree as a story · 261 points
HN discussion>This just shows how ignorant you (and most) are on the topic of port knocking. You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ if not - I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. >SPA port knocking is cryptographically secure and does not suffer from…
Comment linking /me/
on “Security by obscurity is underrated”Submitted Against DNSSEC as a story · 186 points
HN discussionIf you read http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ , you will see that this approach is looking to find folks that were not obviously good, as you say, but they found someone that is a stellar crypto breaker.
Comment linking /blog/2015/03/06/the-hiring-post/
on “Announcing Starfighter”Submitted Is Extended Random a Malicious NSA Plot? as a story · 157 points
HN discussionThe crypto challenges were how we (for instance) hired Alex: http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ I think we plan on making minimal demands of our users, and none of them involve grooming them for prospective employers. Look, the reality is, most of the people who participate aren't going to be looking for a job when they do. So all our incentives are to make the experience itself rewarding to part…
Comment linking /blog/2015/03/06/the-hiring-post/
on “Announcing Starfighter”Submitted Applied Cryptography Engineering as a story · 118 points
HN discussionDefinitely don't read Applied Cryptography! http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
Comment linking /blog/2013/07/22/applied-practical-cryptography/
on “Announcing Starfighter”Submitted A Liquid Nitrogen Cocktail Party as a story · 103 points
HN discussion> It's the "semblance of understanding" you're holding on to that is keeping your demand limited. I'm holding onto it as well, but I think these companies are assuming that human understanding will no longer be relevant for most codebases going forward. In short, seems to describe vibe-coding to me? What I don't understand about companies attempting to vibe code is if they realize that other people (especially somet…
Comment linking /blog/2026/09/25/what-even-is-an-os-now/
on “Sonnet 5.5”Submitted Applied Cryptography Engineering (2013) as a story · 79 points
HN discussionEncFS is horrible. However you should not use XTS with Dropbox http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/
Comment linking /blog/2014/04/30/you-dont-want-xts/
on “TrueCrypt suggesting migration to BitLocker?”Submitted You Don't Want XTS as a story · 64 points
HN discussionCheck this real-world example out: https://sockpuppet.org/blog/2015/03/06/the-hiring-post/ and CISO of LinkedIn, Cory Scott: https://www.linkedin.com/pulse/evaluating-technical-talent-t...
Comment linking /blog/2015/03/06/the-hiring-post/
on “Hire people who aren’t proven”Submitted Against DNSSEC (2015) as a story · 56 points
HN discussionSee http://sockpuppet.org/blog/2015/03/06/the-hiring-post/ and Matasano.
Comment linking /blog/2015/03/06/the-hiring-post/
on “Who Y Combinator Companies Want”Submitted The Hiring Post (2015) as a story · 44 points
HN discussion> . If you're in cyber and don't have knowledge of these things you're either in something insanely niche, in research of some sort, or lack critical knowledge that you should have Here are some things that counter this: https://users.ece.cmu.edu/~adrian/731-sp04/readings/Ptacek-N... : A paper that rocked the security industry at the time. Tptacek also was cofounder of Matasano, now part of NCC; also cofounder of La…
Comment linking /stuff/dnssec-qa.html
on “Google to buy Wiz for $32B”Submitted How to safely generate a random number as a story · 29 points
HN discussion
