The Curious Engineer

All blogs / Security

Educated Guesswork

educatedguesswork.org

SecuritySoftware / engineering practiceAI / MLSociety / politics / economy

’20’21’22’23’24’25’26
Posts
144 from 29 Apr 2020 to 26 Jul 2026
Posting
monthly (7 in the last year)
Kind
personal blog
Feed
https://educatedguesswork.org/feed/feed.xml

2026 6

  1. What policy makers need to know about AI safety and security
  2. Notes on Amazon v. Perplexity
  3. Why your asthma inhaler is so expensive (in the US)
  4. Understanding age assurance accuracy
  5. How not to mandate device-based age assurance
  6. Let's build a tool-using agent

2025 11

  1. I automatically generated minutes for five years of IETF meetings
  2. Using Government IDs for Age Assurance
  3. Ultra Tour Monte Rosa (UTMR) Race Report
  4. Olympic Grand Loop (Deer Park Loop)
  5. Understanding Memory Management, Part 7: Advanced Garbage Collection
  6. Understanding Memory Management, Part 6: Basic Garbage Collection
  7. Understanding Memory Management, Part 5: Fighting with Rust
  8. Understanding Memory Management, Part 4: Rust Ownership and Borrowing
  9. Understanding Memory Management, Part 3: C++ Smart Pointers
  10. Understanding Memory Management, Part 2: C++ and RAII
  11. Understanding Memory Management, Part 1: C

2024 8

  1. Why it's hard to trust software, but you mostly have to anyway
  2. Overloaded fields, type safety, and you
  3. River of No Return 108K Race Report (2024)
  4. New EV Habits for ICE Vehicle Owners
  5. Notes on Post-Quantum Cryptography for TLS 1.2
  6. How to manage a quantum computing emergency
  7. Design choices for post-quantum TLS
  8. Sean O'Brien 100K Race Report (2024)

2023 17

  1. A hard look at Certificate Transparency: CT in Reality
  2. A hard look at Certificate Transparency, Part I: Transparency Systems
  3. Adventure Run Report: Northern Yosemite 50
  4. Maybe someday we'll actually be able to search the Web privately
  5. Desolation Wilderness Seven^H^H^H^H^HTwo Summits
  6. Private Access Tokens, also not great
  7. The endpoint of Web Environment Integrity is a closed Web
  8. How NATs Work, Part IV: TURN Relaying
  9. Broken Arrow Triple Crown Race Report
  10. How NATs Work, Part III: ICE
  11. Defending against Bluetooth tracker abuse: it’s complicated
  12. How NATs Work, Part II: NAT types and STUN
  13. Everything you never knew about NATs and wish you hadn't asked
  14. Architectural options for messaging interoperability
  15. Network-based Web blocking techniques (and evading them)
  16. Internet Transport Protocols, Part I: Reliable Transports
  17. Surprise, blockchains won't fix Internet voting

2022 43

  1. How to securely vote for (or against) Elon Musk
  2. One does not simply destroy a nuclear weapon
  3. Can we agree on the facts about QWACs?
  4. First impressions of Bluesky's AT Protocol
  5. How to hide your IP address
  6. Self-Driving Vehicles, Monoculture, and You
  7. On the Security and Privacy Properties of Public WiFi
  8. ELI15: PCR and PCR Testing
  9. Ultra-Trail du Mont-Blanc (UTMB) Race Report
  10. ELI15: Private Information Retrieval
  11. Can we make Safe Browsing safer?
  12. Discovery Mechanisms for Messaging and Calling Interoperability
  13. Pacifica Foothills Race Report
  14. Verifiably selecting taxpayers for random audit
  15. Tenaya Loop Adventure Run 2: Redemption
  16. An overview of browser privacy features
  17. Understanding The Web Security Model, Part VI: Browser Architecture
  18. First impressions of Web5
  19. On Blockchains/Ledgers and Identity Systems
  20. Understanding Online Identity
  21. Notes on Multiple Encryption and Content Filtering
  22. End-to-End Encryption and the EU's new proposed CSAM Regulation
  23. Understanding The Web Security Model, Part V: Side Channels
  24. Challenges in Building a Decentralized Web
  25. Understanding The Web Security Model, Part IV: Cross-Origin Resource Sharing (CORS)
  26. Lake Sonoma 50 Race Report
  27. End-to-End Encryption and Messaging Interoperability
  28. What's with the www prefix in www.example.com?
  29. Understanding The Web Security Model, Part III: Basic Principles and the Origin Concept
  30. Understanding The Web Security Model (Outtake): Cookies and Behavioral Advertising
  31. Understanding The Web Security Model, Part II: Web Applications
  32. Understanding The Web Security Model, Part I: Web Publishing
  33. Games, constraints, and the humanly possible
  34. Risks (or non-risks) of scanning QR codes
  35. Overview of Interoperable Private Attribution
  36. Ensuring Privacy For Age Verification
  37. DNS Security, Part VII: Blockchain-based Name Systems and Transparency
  38. DNS Security, Part VI: Blockchain-based Name Systems
  39. Privately Measuring Vaccine Doses
  40. DNS Security, Part V: Transport security for Recursive to Authoritative DNS
  41. Qualifying for prestige races (and why you won't get into Western States)
  42. DNS Security, Part IV: Transport security for DNS (DoT, DoH, DoQ)
  43. Privacy for Genetic Genealogy: Happy Goldfish Bowl Everyone

2021 50

  1. DNS Security, Part III: DANE and the WebPKI
  2. DNS Security, Part II: DNSSEC
  3. DNS Security, Part I: Basic DNS
  4. A look at the Dutch vaccine passport system
  5. Privacy Preserving Vaccine Credentials
  6. Highline Trail Adventure Run Report
  7. Privacy for license plates
  8. A quick look at the New Zealand Vaccine Pass
  9. Privacy Preserving Measurement 5: Randomization
  10. Modelling grade's impact on running pace
  11. The EU vaccine passport compromise and how to (maybe) fix it
  12. Sean O'Brien 100K Race Report
  13. Privacy Preserving Measurement 4: Heavy Hitters
  14. Privacy Preserving Measurement 3: Prio
  15. Privacy Preserving Measurement 2: Anonymized Data Collection
  16. Privacy Preserving Measurement 1: Background
  17. Fantastic memory issues and how to fix them
  18. Tenaya Loop Adventure Run Report
  19. What's an ultramarathon?
  20. Do you know what your computer is running?
  21. Perceptual versus cryptographic hashes for CSAM scanning
  22. SF/Fantasy you should be reading
  23. What does the NeuralHash collision mean? Not much
  24. More on Apple's Client-side CSAM Scanning
  25. Overview of Apple's Client-side CSAM Scanning
  26. Securing Cryptographic Protocols Against Quantum Computers
  27. What's wrong with QR code menus?
  28. A look at the EU vaccine passport
  29. Bigfoot 73 Race Report
  30. What the heck is going on in New York's election?
  31. Science's broken publishing model
  32. What's in California's Vaccine Passport?
  33. So you want to watch people run
  34. Notes on supershoes
  35. Some Confusion in New York's Vaccine Passport Rollout
  36. The tech behind EG
  37. Blockchains/Ledgers and Vaccine Passports
  38. Against streaming apps
  39. Improving vaccine registration
  40. Lights for Running
  41. The (depressing) future of stalking tech
  42. Thoughts on personal tracker privacy
  43. Authentication for Vaccine Passports
  44. Notes on Implementing Vaccine Passports
  45. Some stuff about running pacers
  46. Addressing Supply Chain Vulnerabilities
  47. What WebRTC means for you
  48. Why getting voting right is hard, Part V: DREs (spoiler: they're bad)
  49. Why getting voting right is hard, Part IV: Absentee Voting and Vote By Mail
  50. Why getting voting right is hard, Part III: Optical Scan

2020 9

  1. Why getting voting right is hard, Part II: Hand-Counted Paper Ballots
  2. Why getting voting right is hard, Part I: Introduction and Requirements
  3. A look at password security, Part V: File and Disk Encryption
  4. Subject: A look at password security, Part IV: WebAuthn
  5. A look at password security, Part III: More secure login mechanisms
  6. A look at password security, Part II: Web sites
  7. A look at password security, Part I: history and background
  8. COVID Surveillance Part 2: Mobile Phone Location
  9. Looking at designs for COVID Contact Tracing Apps