corpus.blog
41554 blogs · [ { "id": "01a08746-e843-70bb-9b63-44a62cb3836a", "title": "Teels: TEE + TLS, for the web", "url": "https://blog.daviddworken.com/posts/teels/", "published_at": "2025-04-15T00:01:00+00:00" }, { "id": "01a08746-e844-70a0-b101-1713ede413b5", "title": "Trusted Execution Environments: A Paranoid Assessment", "url": "https://blog.daviddworken.com/posts/tee-paranoid/", "published_at": "2025-04-14T00:00:00+00:00" }, { "id": "01a08746-e844-70a0-b101-1713ee6c85d8", "title": "Security Metrics: Abuse Metrics vs. Security Metrics", "url": "https://blog.daviddworken.com/posts/security-metrics-abuse-vs-security/", "published_at": "2025-03-30T05:00:00+00:00" }, { "id": "01a08746-e844-70a0-b101-1713ee6d7cd6", "title": "Security Metrics: Getting Aggregation Right", "url": "https://blog.daviddworken.com/posts/security-metrics-aggregation/", "published_at": "2025-03-10T03:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713eead929e", "title": "Google Blog: Leaving Traditions", "url": "https://blog.daviddworken.com/posts/leaving-tradition/", "published_at": "2024-12-04T07:00:00+00:00" }, { "id": "01a08746-e844-70a0-b101-1713eeb1dc17", "title": "XS-Leaks Summit: Stopping XS-Leaks at Scale (v2)", "url": "https://blog.daviddworken.com/posts/xs-summit-2024/", "published_at": "2024-09-09T08:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713efac15b0", "title": "LocoMocoSec: How blocking third-party cookies can fix the web", "url": "https://blog.daviddworken.com/posts/locomocosec-2024/", "published_at": "2024-07-18T19:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f0a6c736", "title": "Security Signals: Measuring Web Security Posture at Scale", "url": "https://blog.daviddworken.com/posts/security-signals/", "published_at": "2024-07-01T08:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f153f88f", "title": "Google Blog: A Recipe for Scaling Security", "url": "https://blog.daviddworken.com/posts/scaling-security/", "published_at": "2024-01-22T18:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f1bcd039", "title": "Truly Paranoid Software Updates", "url": "https://blog.daviddworken.com/posts/truly-paranoid-updates/", "published_at": "2023-10-28T02:12:37+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f21f1aef", "title": "Google Blog: Securely Hosting User Data in Modern Web Applications", "url": "https://blog.daviddworken.com/posts/secure-hosting/", "published_at": "2023-04-18T18:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f2e2e166", "title": "hiSHtory: Launching on HN and Reddit", "url": "https://blog.daviddworken.com/posts/hishtory-launched/", "published_at": "2022-11-04T06:37:10+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f3b0c8d9", "title": "hiSHtory: Cross-device Encrypted Syncing Design", "url": "https://blog.daviddworken.com/posts/hishtory-explained/", "published_at": "2022-10-15T20:12:52+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f4ac45b0", "title": "hiSHtory: Your shell history in context, synced, and queryable", "url": "https://blog.daviddworken.com/posts/hishtory/", "published_at": "2022-09-27T02:37:10+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f4c65ab2", "title": "The limits of the same-origin policy: cross-origin (but same-site) attacks", "url": "https://blog.daviddworken.com/posts/same-site-cross-origin/", "published_at": "2022-03-10T00:36:12+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f51f4094", "title": "Log4j Scanning", "url": "https://blog.daviddworken.com/posts/log4j-scanner/", "published_at": "2022-01-04T02:37:10+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f56fa60a", "title": "Stopping XS-Leaks at Scale", "url": "https://blog.daviddworken.com/posts/stopping-xs-leaks-at-scale/", "published_at": "2021-10-10T19:32:30+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f6475e5d", "title": "DEF CON 29 Presentation: Worming through IDEs", "url": "https://blog.daviddworken.com/posts/worming-through-ides/", "published_at": "2021-07-06T17:13:12+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f661c3ed", "title": "Three More Google Cloud Shell Bugs Explained", "url": "https://blog.daviddworken.com/posts/cloud-shell-bugs-explained/", "published_at": "2020-08-19T03:50:59+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f6ecd589", "title": "Compiler Fun", "url": "https://blog.daviddworken.com/posts/compiler-fun/", "published_at": "2020-07-21T23:51:32+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f76bd587", "title": "Playing with DigitalOcean Kubernetes", "url": "https://blog.daviddworken.com/posts/digitalocean-k8s/", "published_at": "2020-07-19T19:42:09+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f8135a03", "title": "Discovering an XXE in Postgres (CVE-2020-13692)", "url": "https://blog.daviddworken.com/posts/pgjdbc-xxe/", "published_at": "2020-06-09T03:53:49+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f8ab3ac5", "title": "Fuzzing libsignal-protocol-c with libfuzzer and OSS-Fuzz", "url": "https://blog.daviddworken.com/posts/libsignal-fuzzing/", "published_at": "2020-05-19T00:18:02+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f8eb376e", "title": "Rediscovering CVE-2019-18212: RCE in Eclipse Theia", "url": "https://blog.daviddworken.com/posts/eclipse-theia-ide-rce/", "published_at": "2020-05-14T03:54:24+00:00" }, { "id": "01a08746-e844-70a0-b101-1713f9796057", "title": "Keybase SSH: An Open Source SSH CA", "url": "https://blog.daviddworken.com/posts/keybase-ssh/", "published_at": "2019-08-23T15:42:10+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fa6c0869", "title": "Measuring Open Proxies v2", "url": "https://blog.daviddworken.com/posts/malicious-open-proxies/", "published_at": "2018-07-15T03:32:10+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fa7383a9", "title": "Pwning River Hawk's Bootloader Without DPA or Glitching", "url": "https://blog.daviddworken.com/posts/pwning-river-hawks-bootloader-without-dpa-or-glitching/", "published_at": "2017-04-26T18:29:48+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fb1ecdcc", "title": "XSS and SQLi Scanning with mitmproxy", "url": "https://blog.daviddworken.com/posts/xss-and-sqli-scanning-with-mitmproxy/", "published_at": "2017-03-09T04:32:04+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fb720859", "title": "XSS in pypi (and Uber!)", "url": "https://blog.daviddworken.com/posts/xss-in-pypi-and-uber/", "published_at": "2016-04-18T02:41:05+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fbd24954", "title": "CSV Injection in business.uber.com", "url": "https://blog.daviddworken.com/posts/csv-injection-in-businessubercom/", "published_at": "2016-04-18T02:30:03+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fc4fdfec", "title": "XSS in getrush.uber.com", "url": "https://blog.daviddworken.com/posts/xss-in-getrushubercom/", "published_at": "2016-04-18T01:58:50+00:00" }, { "id": "01a08746-e844-70a0-b101-1713fce874d6", "title": "Simple Image Steganography", "url": "https://blog.daviddworken.com/posts/simple-image-steganography/", "published_at": "2016-03-04T23:38:42+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c74c56056", "title": "Website Hosting with KBFS", "url": "https://blog.daviddworken.com/posts/website-hosting-with-kbfs/", "published_at": "2016-02-19T00:56:33+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c74df12f3", "title": "Slope Field Generator", "url": "https://blog.daviddworken.com/posts/slope-field-generator/", "published_at": "2016-02-17T18:17:52+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c75b05220", "title": "KBFS On Linux", "url": "https://blog.daviddworken.com/posts/kbfs-on-linux/", "published_at": "2016-02-16T18:16:54+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c768884ad", "title": "(Ab)using Google’s Unlimited Photo Storage for Fun and Profit", "url": "https://blog.daviddworken.com/posts/abusing-googles-unlimited-photo-storage-for-fun-and-profit/", "published_at": "2015-08-06T18:14:20+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c76998643", "title": "Bug Bounties List!", "url": "https://blog.daviddworken.com/posts/bug-bounties-list/", "published_at": "2015-03-29T18:13:18+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c76c528ca", "title": "pyWMATA", "url": "https://blog.daviddworken.com/posts/pywmata/", "published_at": "2015-02-07T18:08:10+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c775a2751", "title": "Scanning for Malicious Proxies", "url": "https://blog.daviddworken.com/posts/scanning-for-malicious-proxies/", "published_at": "2015-01-12T18:00:39+00:00" }, { "id": "01a08746-e845-734c-8f4c-776c77774de2", "title": "Recoverable Secret Generator", "url": "https://blog.daviddworken.com/posts/recoverable-secret-generator/", "published_at": "2015-01-06T17:53:05+00:00" } ] posts Claim your blog
Back to blog.daviddworken.com
Blog · corpus.blog/blogs/blog.daviddworken.com/posts

blog.daviddworken.com

blog.daviddworken.com

2025

Teels: TEE + TLS, for the weboriginal ↗
15 Apr 2025
Trusted Execution Environments: A Paranoid Assessmentoriginal ↗
14 Apr 2025
Security Metrics: Abuse Metrics vs. Security Metricsoriginal ↗
30 Mar 2025
Security Metrics: Getting Aggregation Rightoriginal ↗
10 Mar 2025

2024

Google Blog: Leaving Traditionsoriginal ↗
4 Dec 2024
XS-Leaks Summit: Stopping XS-Leaks at Scale (v2)original ↗
9 Sept 2024
LocoMocoSec: How blocking third-party cookies can fix the weboriginal ↗
18 Jul 2024
Security Signals: Measuring Web Security Posture at Scaleoriginal ↗
1 Jul 2024
Google Blog: A Recipe for Scaling Securityoriginal ↗
22 Jan 2024

2023

Truly Paranoid Software Updatesoriginal ↗
28 Oct 2023
Google Blog: Securely Hosting User Data in Modern Web Applicationsoriginal ↗
18 Apr 2023

2022

hiSHtory: Launching on HN and Redditoriginal ↗
4 Nov 2022
hiSHtory: Cross-device Encrypted Syncing Designoriginal ↗
15 Oct 2022
hiSHtory: Your shell history in context, synced, and queryableoriginal ↗
27 Sept 2022
The limits of the same-origin policy: cross-origin (but same-site) attacksoriginal ↗
10 Mar 2022
Log4j Scanningoriginal ↗
4 Jan 2022

2021

Stopping XS-Leaks at Scaleoriginal ↗
10 Oct 2021
DEF CON 29 Presentation: Worming through IDEsoriginal ↗
6 Jul 2021

2020

Three More Google Cloud Shell Bugs Explainedoriginal ↗
19 Aug 2020
Compiler Funoriginal ↗
21 Jul 2020
Playing with DigitalOcean Kubernetesoriginal ↗
19 Jul 2020
Discovering an XXE in Postgres (CVE-2020-13692)original ↗
9 Jun 2020
Fuzzing libsignal-protocol-c with libfuzzer and OSS-Fuzzoriginal ↗
19 May 2020
Rediscovering CVE-2019-18212: RCE in Eclipse Theiaoriginal ↗
14 May 2020

2019

Keybase SSH: An Open Source SSH CAoriginal ↗
23 Aug 2019

2018

Measuring Open Proxies v2original ↗
15 Jul 2018

2017

Pwning River Hawk's Bootloader Without DPA or Glitchingoriginal ↗
26 Apr 2017
XSS and SQLi Scanning with mitmproxyoriginal ↗
9 Mar 2017

2016

XSS in pypi (and Uber!)original ↗
18 Apr 2016
CSV Injection in business.uber.comoriginal ↗
18 Apr 2016
XSS in getrush.uber.comoriginal ↗
18 Apr 2016
Simple Image Steganographyoriginal ↗
4 Mar 2016
Website Hosting with KBFSoriginal ↗
19 Feb 2016
Slope Field Generatororiginal ↗
17 Feb 2016
KBFS On Linuxoriginal ↗
16 Feb 2016

2015

(Ab)using Google’s Unlimited Photo Storage for Fun and Profitoriginal ↗
6 Aug 2015
Bug Bounties List!original ↗
29 Mar 2015
pyWMATAoriginal ↗
7 Feb 2015
Scanning for Malicious Proxiesoriginal ↗
12 Jan 2015
Recoverable Secret Generatororiginal ↗
6 Jan 2015