# Nik Cubrilovic

> Engineer writing about AI, data engineering, and tech. Long-form articles and observations on technology.

Personal site of Nik Cubrilovic (https://github.com/nc9).
Every post is available as Markdown: append `.md` to a post URL, or send
`Accept: text/markdown` to the canonical URL.

## Articles

- [Craig Wright is not Satoshi Nakamoto](https://nikcub.me/posts/craig-wright-is-not-satoshi-nakamoto.md) (2016-05-02): An investigation into Craig Wright's claims to be Bitcoin creator Satoshi Nakamoto, examining forged evidence and failed cryptographic proofs
- [Securing Blockchain.info Users with Tor and SSL](https://nikcub.me/posts/securing-blockchain-users-with-tor-and-ssl.md) (2014-12-03): Helping Blockchain.info become the second site after Facebook to offer a Tor hidden service with a CA-signed SSL certificate, protecting users from MITM attacks
- [FBI seizes fake Tor hosted Jihad funding website as part of Operation Onymous, leaves up real site](https://nikcub.me/posts/fbi-seizes-fake-tor-hosted-jihad-funding-website-as-part-of-operation-onymous-leaves-up-real-site.md) (2014-11-17): During Operation Onymous the FBI seized a fake clone of a jihad funding site while leaving the real version online, highlighting the scattershot nature of the takedowns
- [Large Number of Tor Hidden Sites Seized by the FBI in Operation Onymous were Clone or Scam Sites](https://nikcub.me/posts/onymous-part1.md) (2014-11-17): The FBI announced the seizure of a large number of darkweb sites to much fanfare. It turns out most of what they got were fake clone sites
- [60 Minutes Australia on Silk Road and Bitcoin](https://nikcub.me/posts/60-minutes-australia-on-silk-road-and-bitcoin.md) (2014-09-14): A breakdown of 60 Minutes Australia's story on Silk Road and Bitcoin, including their confusion between the Deepweb and Darknet concepts
- [Analyzing the FBI’s Explanation of How They Located Silk Road](https://nikcub.me/posts/analyzing-fbi-explanation-silk-road.md) (2014-09-07): A technical analysis of the FBI's claims about how they located Silk Road's server, showing their explanation doesn't match how Tor hidden services work
- [Notes on the Celebrity Data Theft](https://nikcub.me/posts/notes-on-the-celebrity-data-theft.md) (2014-09-02): An in-depth look at the underground networks behind "The Fappening" - how they operate, the techniques used to compromise iCloud accounts, and Apple's security weaknesses
- [Multiple Vulnerabilities in Disqus WordPress Plugin](https://nikcub.me/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin.md) (2014-08-12): Disclosure and fixes for a number of bugs in the Wordpress plugin for the popular Disqus commenting system
- [CS-Cart v4.2.0 Session Hijacking and Other Vulnerabilities](https://nikcub.me/posts/cs-cart-v4-2-0-session-hijacking-and-other-vulnerabilities.md) (2014-08-07): How weak session ID generation using uniqid() in CS-Cart allows session hijacking through targeted brute-force, plus a frustrating disclosure timeline
- [Multiple Vulnerabilities in MyGov, the Australian Government Single-sign-on Solution for Citizen Services.](https://nikcub.me/posts/multiple-vulnerabilities-in-mygov-australian-government.md) (2014-05-15): Discovering XSS, SQL injection indicators, and poor cookie security in Australia's myGov portal that could expose 2.2 million citizens' tax and health records
- [Two Google Chrome Privacy Issues](https://nikcub.me/posts/two-google-chrome-privacy-issues.md) (2012-08-08): Two privacy issues in Chrome where browsing history data persists after deletion - zoom level settings and DNS prefetch data leave traces of visited domains
- [Yahoo Axis Chrome Extension Leaks Private Certificate File](https://nikcub.me/posts/yahoo-axis-chrome-extension-leaks-private-certificate-file.md) (2012-05-24): Yahoo shipped their Axis browser extension with the private certificate file used to sign it, allowing attackers to create forged extensions that Chrome trusts
- [BlockPlus v4 - Block Google+ widgets and links from other Google sites](https://nikcub.me/posts/blockplus-v4-released-block-google-widgets-and-links-from-other-google-sites.md) (2012-02-21): An update to the BlockPlus browser extension which removes Google+ and other sites from the Google homepage and other properties
- [Facebook and many other sites also bypass Internet Explorer privacy controls](https://nikcub.me/posts/facebook-also-doesnt-honor-p3p.md) (2012-02-21): Microsoft called out Google for P3P bypass but ignored Facebook doing the same thing - and a survey shows 5% of top sites set invalid P3P headers
- [Facebook Is Losing E-Commerce](https://nikcub.me/posts/facebook-is-losing-e-commerce.md) (2012-02-19): Analysis of Facebook's declining e-commerce presence and why users prefer external shopping experiences over Facebook's platform integration
- [How Megaupload Was Investigated and Indicted](https://nikcub.me/posts/how-megaupload-was-investigated-and-indicted.md) (2012-01-20): A breakdown of the evidence and investigation methods used by the DOJ to indict Megaupload, examining internal emails, financial records, and publicly accessible details
- [The Google Firefox search deal, Chrome and Lady GaGa](https://nikcub.me/posts/google-firefox-chrome-lady-gaga.md) (2011-12-25): Why Google's claim that Chrome is purely altruistic doesn't match their $4.9B marketing spend including Lady Gaga ads and Super Bowl spots
- [The Crunchpad is proof of obviousness in the iPad design](https://nikcub.me/posts/crunchpad-proof-obviousness-in-ipad-design.md) (2011-12-09): How the CrunchPad tablet project demonstrates the obviousness of the iPad's design, challenging Apple's claims of revolutionary innovation
- [The Download Dot-Con](https://nikcub.me/posts/the-download-dot-con.md) (2011-12-08): How CNet's Download.com bundles adware and toolbars with popular open source software, making them no different from the fake download sites they claim to protect against
- [Google Android -  The Accidental Empire](https://nikcub.me/posts/google-android-the-accidental-empire.md) (2011-12-07): How Larry and Sergey purchased Android for $50M without telling Eric Schmidt, and accidentally created a smartphone empire that crushed Nokia and Blackberry
- [Introducing Frictionless - Taking the friction out of Facebook social-sharing applications](https://nikcub.me/posts/frictionless-browser-plugin.md) (2011-12-04): Launching Frictionless, a Chrome extension that bypasses Facebook's social reader apps and takes you directly to the original article without sharing your activity
- [Lies, Damn Lies and Google+ Statistics](https://nikcub.me/posts/lies-damn-lies-and-google-statistics.md) (2011-10-11): Debunking the viral "Google+ traffic drops 60%" story based on flawed Chitika statistics with no published methodology - and misunderstanding launch bumps
- [Unicode U+F8FF - aka. The Apple Logo Character, on Macs](https://nikcub.me/posts/unicode-uf8ff-aka-the-apple-logo-character-on-macs.md) (2011-10-08): The Apple logo character U+F8FF only renders on Mac - on Windows it shows as boxes, Elvish, Tibetan, or embarrassingly as the Windows logo in Wingdings
- [Facebook Re-Enables Controversial Tracking Cookie](https://nikcub.me/posts/facebook-re-enables-controversial-tracking-cookie.md) (2011-10-03): Facebook quietly re-enabled the datr tracking cookie on third-party sites after previously removing it, setting cookies on users who never visited Facebook
- [How To Setup secure and private Facebook browsing](https://nikcub.me/posts/howto-setup-secure-and-private-facebook-browsing.md) (2011-10-02): Step-by-step guide to securing your Facebook account with two-factor authentication, disabling tracking features, and setting up private browsing
- [Facebook Fixes Logout Issue, Explains Cookies](https://nikcub.me/posts/facebook-fixes-logout-issue-explains-cookies.md) (2011-09-27): Follow-up on Facebook's response to the logout cookie tracking issue, detailing the fixes they made and their explanation of how each cookie is used
- [Logging out of Facebook is not enough](https://nikcub.me/posts/logging-out-of-facebook-is-not-enough.md) (2011-09-25): When it comes to losing track of Facebook online and preserving your digital privacy - being logged out is far from enough. We find some privacy issues with Facebook and report them.
- [Persistent and Unblockable Cookies Using HTTP Headers](https://nikcub.me/posts/persistant-and-unblockable-cookies-using-http-headers.md) (2011-08-19): Using HTTP headers as unblockable super-cookies
- [BlockPlus - A browser extension to block Google+ notifications](https://nikcub.me/posts/blockplus-a-browser-extension-to-block-google-notifications.md) (2011-07-06): Releasing BlockPlus, a Chrome extension that removes Google+ links and notifications from the nav bar to prevent the constant distraction of the new social network
- [Numeronym](https://nikcub.me/posts/numeronym.md) (2011-04-07): What i18n and l10n have in common with a16z - the history and rising popularity of numeronyms where letters between first and last are replaced with a count
- [Pain and Gain](https://nikcub.me/posts/pain-and-gain.md) (2010-12-21): The true story of Miami bodybuilders turned amateur criminals using torture as a motivational tool, later adapted into a Michael Bay film
- [Finding a Technical Co-Founder](https://nikcub.me/posts/finding-a-technical-co-founder.md) (2010-11-05): Advice on finding a technical co-founder including where to network, how to prepare your startup materials, and evaluating technical capabilities
- [Guide to Finding a Good and Safe Company or Product Name](https://nikcub.me/posts/guide-to-finding-a-good-and-safe-company-or-product-name.md) (2010-11-04): A comprehensive guide to selecting a business or product name, covering domain availability, trademark safety, SEO considerations, and social media presence
- [The Google IPO Skeptics](https://nikcub.me/posts/the-google-ipo-skeptics.md) (2010-11-03): A look back at the skepticism that surrounded the Google IPO in 2004, when tech industry experts warned investors away from buying shares
- [Relevance Time for Twitter](https://nikcub.me/posts/relevance-time-for-twitter.md) (2010-10-29): Why chronological ordering in Twitter is baggage from old computer systems and why relevance-based sorting using user gestures is inevitable
- [Fidelio - A browser plugin for secure web browsing](https://nikcub.me/posts/fidelio-a-browser-plugin-for-secure-web-browsing.md) (2010-10-27): Releasing Fidelio, a Chrome plugin that defends against Firesheep by forcing HTTPS, rewriting embedded widgets, and setting secure flags on existing cookies

## Asides


## Pages

- [About](https://nikcub.me/about)
- [Contact](https://nikcub.me/contact)

## Optional

- [Full content](https://nikcub.me/llms-full.txt): this file plus the complete Markdown body of every article