S
sizeof.cat
sizeof.cat · Personal blog · on HN since 2017
Personal tech blog covering browser and Windows telemetry, privacy, security incidents like the Twitch leak, and Apple hardware tinkering.
What HN saysHN links it for its browser telemetry comparisons and leak write-ups. One commenter questions its methodology after getting different results with mitmproxy.
36HN people shared it
17linked it in comments
23stories submitted
70story points
11 months agolast shared
2017people per year2026
Most-shared posts
- 1Web Browser telemetry – 2025 edition8 people · 29 points · first shared 2025 · 2 comments on HN
- 2Twitch Leaks “An Extremely Poggers Leak”8 people · 8 points · first shared 2021 · 4 comments on HN
- 3Web Browser Telemetry3 people · 6 points · first shared 2021 · 1 comments on HN
- 4Windows Telemetry1 people · 12 points · first shared 2025 · 1 comments on HN
- 5Download macOS 11 Big Sur Developer Beta1 people · 3 points · first shared 2020 · discussion on HN
- 6Coa NPM package got some malicious code in a new version – sizeof(cat)1 people · 2 points · first shared 2021 · discussion on HN
- 7Huawei HarmonyOS Info1 people · 1 points · first shared 2021 · discussion on HN
- 8The Age of Nothingness1 people · 1 points · first shared 2022 · discussion on HN
- 9Nokia Booklet 3G1 people · 1 points · first shared 2022 · discussion on HN
- 10Being privacy-aware in 20161 people · 1 points · first shared 2017 · discussion on HN
- 11CSS Styles and Console.log()1 people · 1 points · first shared 2023 · discussion on HN
- 12Unbound on macOS1 people · 1 points · first shared 2018 · discussion on HN
- 13Discover Personal Websites1 people · 1 points · first shared 2023 · discussion on HN
- 14Oldest Registered .com Domains1 people · 1 points · first shared 2022 · discussion on HN
- 15Block ChatGPT from scraping your website1 people · 1 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
wuhhh · 2025-08-19
I've been trying All The Browsers lately and Arc is definitely still my favourite; I actually had no idea that development had stopped on it, that's a shame. Zen looks good, but they are off the charts on this graph! https://sizeof.cat/post/web-browser-telemetry-2025-edition/ What is going on there?
Their Privacy Policy says no telemetry, but then they have a section on those connections made at startup which apparently are "necessary for the proper functioning of the browser and are not used for tracking or profiling purposes"... they then go on to say "can be disabled through the browser flags (about:config)"
Does that mean the browser will no longer function correctly?
Among the connections made (according to the report) are x.com, google.com (plus a bunch of other google domains). reddit.com and notion.com, discordapp.com, cloudflareinsights.com
denysvitali · 2021-10-30
The private keys didn't leak (at least publicly).
What happened is that North Macedonia (among other countries [1]) was running a public facing and without authentication (or w/ hard coded credentials) server used as a frontend to generate the COVID-19 certificates for their country.
You can follow the discussion here [2] and read my comment [3] here.
On top of that, you can follow my analysis on this repo (RESULTS.md contains the generated results) [4].
[1]: https://sizeof.cat/post/private-keys-sign-eu-greenpass-leaked/
[2]: https://github.com/ehn-dcc-development/hcert-spec/issues/103
[3]: https://github.com/ehn-dcc-development/hcert-spec/issues/103#issuecomm…
[4]: https://github.com/denysvitali/covid-cert-analysis
KronisLV · 2021-10-06
You know, it's pretty eye opening, to see that many streamers make millions in just a few months, while it would take me more than 50 years of constant work in my country to make a single million. Though looking at the top earners is probably very demoralizing if you don't also see the median and average figures, which i'm curious to see.
Someone actually did a writeup of some of their personal findings, though i'm sure that we'll see more in the following weeks: https://sizeof.cat/post/twitch-leaks/
Of course, i can also understand that those with a lot of money probably don't want others to know how much they make, while those that are making less money sometimes don't want to be confronted with the truth because it's so depressing. Regardless, if nothing else, it's educational to see things like these and have them become a piece of humanity's history.
slater · 2025-08-16
Looks like it's back?
https://sizeof.cat/
baobun · 2025-12-19
What was your methodology in checking? I got different results using a local mitmproxy on a clean install.
https://sizeof.cat/post/web-browser-telemetry-2025-edition/
haunter · 2025-11-04
I use these on Mac https://sizeof.cat/project/ladybird-builds/
csdvrx · 2023-05-10
The MSI leak comments like https://sizeof.cat/post/leak-intel-private-keys-msi-firmware/ mentioned the bootguard keys maybe have been common to other manufacturers: "It is assumed that the keys for downloading the guard are not limited to compromising MSI products and can also be used to attack equipment from other manufacturers using Intel’s 11th, 12th and 13th generation processors (for example, Intel, Lenovo and Supermicro boards are mentioned)"
teddyh · 2022-03-22
Torrent (allegedly) here: https://sizeof.cat/post/okta-customers-leak/
howenterprisey · 2021-10-22
epse · 2021-10-07
Twitch, it seems https://sizeof.cat/post/twitch-leaks/#secrets-exposed
kevinsundar · 2021-10-07
Hardcoded database creds in code. Saw a post earlier with credentials to an rds instance. It said there were more examples.
EDIT Found it again: https://sizeof.cat/post/twitch-leaks/#secrets-exposed
Cycl0ps · 2021-10-06
I don't really get the image it redirects to, but the website does have information on leaks.
https://sizeof.cat/post/twitch-leaks/
blain · 2021-10-06
Here are a few screenshots of go and php: https://sizeof.cat/post/twitch-leaks/.
WARNING: do not click the link, copy it and paste it in new tab.
iamevn · 2021-10-06
Here's another link https://sizeof.cat/post/twitch-leaks/
Looks real to me based on the archive I managed to download so far
kurmouk · 2018-12-22
You could add a list of all Facebook-owned IPs to your host file and resolve them to localhost.
You can get that list here: https://sizeof.cat/post/compile-a-list-of-all-facebook-owned-ips/
acco102 · 2023-12-11
after DDOS Guard
https://sizeof.cat/img/hn.jpg
PrincessJess · 2021-10-07