Matt Palmer, a systems engineer, writes about TLS certificates, key security, Debian vulnerabilities, and software pitfalls.
HN commenters link his posts on leaked private keys, the Debian weak keys vulnerability, and a follow-up on redacting private keys in documentation.
You got it! By approximate category and in no particular order:
## MISCELLANEOUS
- [Low Tech Magazine](https://solar.lowtechmagazine.com), a solar-powered website showcasing the amazing low-tech things you can do with a little ingenuity,
- [Stephen Wolfram's Blog](https://writings.stephenwolfram.com) on math, compsci, and everything else,
- [Cool Macrophotography](https://www.barrywebbimages.co.uk/Images/Macro/Slime-Moulds-Myxomycetes) for amazing pictures of tiny things (WARNING: Time Sink!),
## COMPUTER SCIENCE
- [While-True-Do](https://blog.while-true-do.io) has lots of stuff on Linux administration and self-hosting,
- [Backend Banter](https://www.backendbanter.fm) for a great podcast on backend development,
- [Two Wrongs](https://two-wrongs.com) for statistics and functional programming,
- [Math ∩ Programming](https://www.jeremykun.com/) where math and programming intersect! Written by a Googler...
- [Paul Bourke's site](https://paulbourke.net/) where you can get happily lost exploring old pages on every topic CS touches,
- [Jason Punyon's blog](https://jasonpunyon.com) for some fun algorithms and things,
- [Yossi Kreinin's blog](https://yosefk.com/blog) for C, Python, and plenty of non-technical topics,
- [Adrian Sampson's academic blog](https://www.cs.cornell.edu/~asampson/blog) for an academic's perspective,
- [Cool polyhedra viewer project](https://georgehart.com/virtual-polyhedra/vp.html) if you like geometry,
- [Another academic blog on…
Generating a new key for documentation seems incredibly easy, or even generating random base64 text. Most of all, searching Google for a random key to use as example seems easiest of all.
I find it hard to believe that anyone would take their actual production key and redact it for documentation. Does the author have evidence of this in practice, or did they see example keys and assume they were redacted production keys?
edit: It seems they have found one: https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key-redaction-redux.html
Thanks. How about we change the URL to the more general article, which has more information and doesn't shame anybody.
I've changed it from https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key-redaction-redux.html now.
If you haven't updated your Debian in a while, 1 in 30000 apparently: https://www.hezmatt.org/~mpalmer/blog/2024/04/09/how-i-tripped-over-the-debian-weak-keys-vuln.html
The author released another "follow-up" article today: https://www.hezmatt.org/~mpalmer/blog/2023/06/12/private-key-redaction-redux.html
It is the Debian associated one, he talks about the project on his blog:
https://www.hezmatt.org/~mpalmer/blog/