This was originally written on July 10, 2020 and published on LinkedIn. I’ve decided to move the posts here for better searchability. Those that know me well, know that I am a video game history researcher, and this is just some of my random published articles. The 1990s were undeniably some of the most exciting...

In my last two posts, I outlined how to clean up the right-click menu in Firefox to remove useless buttons, using either about:config or userChrome.css, respectively. One of my major complaints was that when right-clicking a link, I was presented with two buttons: one for ‘Copy Link’, and one for ‘Copy Clean Link’ –...

Cleaning up right-click with userChrome.css In my previous post, I wrote about using Firefox’s about:config to cut the right-click menu from a massive 26 buttons down to just 15, decluttering the commonly used right-click menu. Freshly installed Firefox, right-clicking *Firefox right-clicking, after disabling...

On a fresh installation of Firefox on MacOS, right-clicking an image while some text on the page is highlighted (to show as many buttons as possible) looks like so: Freshly installed Firefox, right-clicking To be blunt: holy fucking shit, what the fuck is all of this shit? 26 rows of which 2 are greyed-out (aka:...

Today I learnt about the NS_ERROR_INVALID_CONTENT_ENCODING error (or “Content Encoding Error”) in Firefox, which started popping up in my Network tab while trying to access ChatGPT. Indeed, while having access to ChatGPT has allowed me to keep up the charade that I actually know what I’m doing in...

I recently decided to fork and maintain a new version of the Gixy nginx security tooling, calling my fork Gixy-Next. The official website is https://gixy.io/, and the source code is available on GitHub at MegaManSec/Gixy-Next. The Python package is available on PyPi, but there’s also an online scanner which can be...

This year, I’ve reported more issues via bug bounties than perhaps the past 10 years combined. The issues were all in completely random places, and the only reason they were reported via bug bounty programs is because it is generally impossible to get a human response any other way from tech companies (even when you...

Some time ago, a friend of mine and I hired a helicopter to fly us from Vienna to Wrocław. The story regarding this is, in my humble opinion, extremely funny, albeit long. Therefore, I decided to write it up so that instead of explaining it for ~45 minutes each time somebody asks, I can simply link this post. A trip...

In my last two posts, I outlined different stories about my experiences dealing with developers that had offloaded their work to low-quality LLMs, resulting in frustrating performance degradation. Today, I’ll be writing about a similar experience, wherein responding to a potential security incident, my professional...

In October, I reported two security issues to Okta’s auth0/nextjs-auth0 project, here and here. The latter bug, an oauth parameter injection, allows for a range of types of abuse, like scoping tokens for unintended services, setting redirect_uri and scope to arbitrary values to leak tokens, and so on. The patch was...

From gixy to Gixy-Next gixy is an old static analyzer for nginx configurations, which allows the operator to automatically discover vulnerabilities in statis nginc files. It works by reading the configuration into memory, and performing various static checks on the serialized, full configuration, with plugins...