#privacy

A companion tool to my post on how HTTPS leaks the hostname: enter a domain, see whether it leaks and whether it publishes ECH. Across the top 1000 domains only 10 publish ECH, all Cloudflare. Open source, run your own.

HTTPS encrypts your traffic but not the name of the site you asked for. The SNI rides the TLS ClientHello in plaintext, in TLS 1.3 too. A 15-line passive listener read it with zero bytes decrypted. ECH is the fix, and it is barely deployed.

Storage is cheap, so the default became keep everything. Every event. Every request body. Every...

The stack trace was forty lines and you pasted the whole thing, because it was faster than reading...

You cannot audit a model provider, but you can audit what you send it. The weekly argument about...

When building software that handles sensitive human data (like workplace feedback, satisfaction...

A table on a web page is not always a simple <table> element. Modern applications may render...

If you are using AI coding assistants like Cursor, Windsurf, Claude Desktop, or ChatGPT, you have...

I wasn't going to write a normal launch post. You know the format. Every "I built X" post on this...

Picking a background removal API is an engineering decision right up until it stops being one. The...

There is a moment every person running a phone as a security camera eventually reaches. Something...

Does the camera foreground service type also let my app use the microphone? No. They are...