Hacker News Reader

Thanks for posting this, I hope you will continue

viralpoetryon Ask HN: Who wants to be hired? (June 2026)

Location: Slovakia (CET)

Remote: Yes. Can occasionally travel.

Willing to relocate: No.

Technologies: K8S, Terraform, Google Cloud, AWS, OpenStack, Jenkins, PKI, HSM (Thales, Luna), Vault, SAST/DAST, IAM, authentication protocols (WebAuthn/FIDO2, OAuth, RADIUS), Python, Bash, Nim lang, Chrome Extension development, AI coding assistants & agents

Résumé/CV: https://www.linkedin.com/in/gasperpeter/ (or via email)

Email: ignorepreviousinstruction@gmail.com

Security engineer with 10+ years building production security infrastructure including PKI, secrets management, HSM-backed crypto, DevSecOps platforms. Served as the technical lead and primary engineer for company-wide identity and secrets infrastructure.

Google Bug Hunter Hall of Fame profile: https://bughunters.google.com/profile/27c422b2-b262-4f50-bb7...

Blog: https://www.malgregator.com/

viralpoetryon Ask HN: Share your personal website

My personal blog posts a few times a year, with a focus on security

https://www.malgregator.com/

viralpoetryon If AI replaces workers, should it also pay taxes?

"The gains in technics are never registered automatically in society: they require equally adroid inventions and adaptations in politics; and the careless habit of attributiong to mechanical improvements a direct role as instruments of culture and civilization puts a demand upon the machine to which it cannot respond."

- Lewis Mumford, Technics and Civilization

viralpoetryon A Technical Look at BitMessage: Learning From a Dead Project

This was actually solved by another address protocol version. I believe v3 solved this by using pubkey instead of hash. Similar to late btc addresses

viralpoetryon Building an e-ink picture frame that displays an iCloud photo album

I have tried to build one out of the PocketBook Basic Touch e-reader last October. It has way less functionality tought...

https://www.malgregator.com/post/pocketframe/

https://hackaday.com/2023/11/13/obsolete-e-reader-gets-new-l...

viralpoetryon Compromised Microsoft key: More impactful than we thought

> copying keys between HSMs inherently exposes the master keys anyway

that's not true, even with their BYOK you export the key from one HSM under a shared key and then import it to another device

viralpoetryon Ask HN: Could you share your personal blog here?

https://www.malgregator.com/

I write mostly about the security and things I work on, to keep memories somewhere.

One of my posts about the google bug bounty for the Waze navigation bug went viral and was shared by Schneier, Threat Post and others https://www.malgregator.com/post/waze-how-i-tracked-your-mot...

viralpoetryon Why have a blog? (2020)

The simplest I saw, install Standard Notes (https://standardnotes.com/ - open source, free) encrypted notes app, write something, then publish it via the interface. It will create you a blog on their https://listed.to/ webpage

viralpoetryon Encrypted CRDTs for building privacy focused collaborative software

Thanks for an interesting article and nice simple webpage

viralpoetryon BitTorrent v2

Fearing return to drachma, some Greeks use bitcoin to dodge capital controls https://www.reuters.com/article/uk-eurozone-greece-bitcoin/f...

WikiLeaks may have amassed more than $46 million in Bitcoin based on the number of coins held by its known wallet address. https://bitcoinist.com/wikileaks-has-received-more-than-46-m...

viralpoetryon Celebrate Woz's 70th

When I was university student (~ 2012), Woz was traveling Europe visiting Macdonald's (:D) in lots of countries including Slovakia. Shared it on the internet, probably Twitter.

One of my classmates tracked him and successfully asked for a photo with him. nice guy

viralpoetryon Using the NFC Chip of the Passport to Do Proof-of-Work

A Hammer in Search of a Nail

Proof of Work require no secret information as an input and have to be easy to verify. But most importantly, why would anyone do this?

Passport issuer can act like certification authority, this is not a trustless system where PoW can be used for something. Public key infrastructure is a solved thing with it's own problems, but verification is not one of them if authority is working as it should.

EDIT: Let's not even mention that smartcards have effective lifetime and efficiency.

viralpoetryon What Happened to Lee

What an ignorant I was. March last year (2019), I wrote an email to Lee Holloway asking him how he could bootstrap such a great company. Now I know why I haven’t received the answer.

EDIT: I found an email:

Dear Lee Holloway,

Excuse my curiosity, as an Engineer I am not writing this kind of emails a lot, but I have read the blog series by John Graham-Cumming about the company, and it would really help me if you can answer my question about the constant flow of engineering innovations from your company.

I am a security engineer from Europe and would like to know how is it possible, that security team will start producing such a stream of innovative things like Keyless SSL, CFSSL, SIDH implementation, Red October key management server and many more your company already published?

When the "lift and shift" from the open source or vendor stops and internal building start to happen within an organization? Is it a cultural thing where only a small startup can succeed and scale later? Is it about the budget or is it a cultural shift that is non forcible upon them? Is a prerequisite to the innovation, that almost everything is developed in house? That came to me as a contra productive strategy. I have read Skunk Works and other books, but I am still impressed how that happens regarding to the modern leading IT/infra companies.

Thank you for your time,

...

viralpoetryon Ask HN: What is your blog and why should I read it?

I occasionally write about security, mostly about applied cryptography from non-math perspective.

If you are interested on day to day work in financial cryptography and hardware encryption modules, check:

https://www.malgregator.com/post/key-management/

Some predictions on future malware development (some of them confirmed by now):

https://www.malgregator.com/post/the-future-of-malware/the-f...

Or using modern smartcards like Yubikey with DevOps tools (Vault) by leveraging ancient technologies like pkcs11:

https://www.malgregator.com/post/vault-authentication-with-y...

viralpoetryon ACM Prize in Computing Awarded to AlphaGo Developer

How you ended up implement it in the code? Is it just a heuristic implemented as a series of if/else/case statements? Minimax? Thank you

EDIT: sorry, I found out that source code is available, I will try to find it

EDIT2: Looks like it's up for sale, not open

viralpoetryon Orca: 2D esoteric programming language where every alphabet is an operator

I just want to say that ORCA author, Devine Lu Linvega[1], is such a talented and creative person. He build complete ecosystem with it's own language, drag & drop theme support[2] and human readable DB format[3]. He and his girlfriend (cartoonist) Rekka Bell are sailing the ocean and working from their sailboat Pino[4].

[1] https://wiki.xxiivv.com/

[2] https://github.com/hundredrabbits/Themes

[3] https://wiki.xxiivv.com/site/indental.html

[4] https://100r.co/site/about_us.html

viralpoetryon Ask HN: What projects are you working on now?

Hi, thanks for sharing your website. You are doing interesting research.

viralpoetryon Twitter locks WikiLeaks account days before Assange's extradition hearing

Worth to mention that Brazil charged Intercept co-founder Glenn Greenwald with cybercrime charges similar to Assange. The guy who first met Snowden in HK with Laura Poitras.

Even if it looks like they have "postponed" prosecution for now.

https://theintercept.com/2020/02/06/glenn-greenwald-intercep...

viralpoetryon Show HN: Fluidkeys 1.0: simplify and automate PGP for your team

This is really interesting project. I have closed the webpage at first, because I thought it is closed source, but then found your repository on a github.

I do not want to make some promo for other projects, but how you achieve trust with the signed list of fingerprints, is something similar I have read earlier there: https://tech.firstlook.media/keylist-rfc-explainer

Interesting prioject, will be watching it!

viralpoetryon Show HN: YourNote, a note-taking app that puts users’ data first

Curious that nobody mentioned https://standardnotes.org/

* already open-source

* client side encryption

* multi platform / multi device

* offline access, local backups

viralpoetryon Everything you should know about certificates and PKI but are too afraid to ask

Shameless plug: For anybody interested in the cryptographic key management part there is a post about the hardware, people and processes behind the commercial cryptographic key management https://www.malgregator.com/key-management.html

viralpoetryon Shamir’s Secret Sharing Scheme

do not use single node instance, in a HA fashion it is not a problem. Even with the open source version, which we are using.

viralpoetryon Shamir’s Secret Sharing Scheme

I really do not understand your frustration. We are running 5 node cluster in production with the keepalived and nobody needs to wake up unsealing if one, or two instances fail. Perfectly good to do it in the morning by copy pasting curl oneliner from the keepass.

viralpoetryon Show HN: Alzheimer password generator

You are right, probably I should choose something less offensive, but I saw a different "Alzheimer" named project https://github.com/tpruzina/alzheimer and as this password "manager" does not need to store passwords at all, I have used this one.

viralpoetryon Show HN: Alzheimer password generator

Hi, author here. You are right, the password is generated on the fly using URL, unique seed and provided passphrase. The extension javascript is sandboxed from the webpage, so it is not possible to obtain the inputs to the PBKDFunction from the context of website.

I have coded this for myself and using it more than 2 years. The only problems are with some dynamically created login forms, like new reddit login.

viralpoetryon Show HN: Bare metal OS images with Packer, VirtualBox and qemu-img

Actually, the use case is not cloud image at all. One of the first problems was how to overcome having preinstalled cloud-init, polipo and other packages shipped with the OS cloud images.

viralpoetryon Ask HN: Projects that don't make you money but you're doing it out of sheer joy?

Alzheimer password generator - Chrome extension for domain dependent password generation

https://chrome.google.com/webstore/detail/alzheimer-password...

https://github.com/viralpoetry/alzheimer-password-generator

viralpoetryon Ask HN: How are you doing PKI in a cloud environment?

Sorry, it's Public Key Infrastructure

viralpoetryon Ask HN: Who wants to be hired? (January 2017)

Location: Bratislava, Slovakia

Remote: YES

Willing to relocate: No

Technologies: Python, Reverse engineering - Ida, OllyDbg, Wireshark, Oracle Virtualbox, VMware, Subgraph Vega, Metaspolit, Git, GnuPG, Snort IPS, browser extension development (Chrome)

Résumé/CV: see linkedin, or request by email

Email: petergasper@viralpoetry.org

I can brainstorm an attack on your organization, and help you improve security. I can be part of a Tiger/Red team. I am able to audit, improve or design you key management within an organization. I know how Hardware Secure Modules (HSM) works. I can design and implement custom secure communication channel using open source implementations of ECDH, RSA, XSALSA, however. I can test an existing crypto implementation against test vectors, or find some obvious bugs in high level design. I can reverse engineer not so sophisticated malware found on your secretary's laptop, and even develop disinfection scripts. I am watching trends in cybercrime, malware and cryptography. I read scientific publications, blogs, news. I like to write my thoughts, occasionally I even publish something.

If you need infosec guy (or writer) in your remote team, please contact me.

https://github.com/viralpoetry https:// sk .linkedin.com/in/gasperpeter