Last summer I set the goal of riding every off-road route in the Surrey Hills, the wooded area just south-west of London. I linked my favourite bits into a single adventure, London Escape to Surrey Hills now published on Bikepacking.com: Rationale The route is designed to be the most varied escapist weekend you can ride straight out of the capital. I evaluated off-road rights of way for the…
$100,000 “World’s Hardest Riddle” Back in July 2020 Mr Beast published a “Solve This Riddle For $100,000” challenge . For my puzzle-loving friends, stuck indoors, this was an unmissable opportunity. Mr Beast called it “The World’s Hardest Riddle” but it was mainly a series of extremely tedious web challenges, including: a page that generated thousands of QR codes, only one of which worked a flappy…
I love exploring areas with a lot of footpaths that lead away from roads. This map aims to find the local authority districts with the highest proportion of “walkable” routes compared to “drivable” routes: The technique used to generate the map is described in my post on off-road cycling density . What is counted as “walkable”? Basically anything that you can legally walk on, that isn’t the…
Which area of England & Wales has the densest network of off-road cycle routes? Until recently, I would have had no idea how to answer this question. But with Overpass API, Datawrapper, and an LLM, I found it surprisingly easy to whip up some results. I enjoy cycling off-road and like to plot routes that avoid roads as much as possible. Will this help me find the ideal place to live? Note that the…
After years of playing the cybersecurity labs at Hack The Box , I finally had an idea for a machine. I spent some time in 2024 researching vulnerabilities in open source Command and Control (C2) frameworks , and simultaneously another researcher Chebuya was working on the same topic. We found that two of our exploits made a chain, combining for a full remote compromise of a C2 server behind a…
The South Downs Way is a 100-mile path running along the chalk hills of Hampshire and Sussex in South-East England. Due to the fact that the path is almost entirely offroad, has incredible views, and feels remote despite being not far from London, it is known as a fantastic long-distance trail to ride a mountain bike. Gravel Bike? Unfortunately I don’t have a mountain bike, after my Trek Marlin…
I love sitting down with a cup of tea and reading an incredible longform article. Here’s a list of my favourite longform articles, primarily focussed on technology and true crime. Airplanes What Really Happened Aboard Air France 447 (Popular Mechanics, 2020) Cybersecurity Juniper Mystery Attacks Traced to Pentagon Role and Chinese Hackers (Bloomberg, 2021) The Full Story of the Stunning RSA Hack…
How to make games that are both fun and educational? That’s what we tried to do with CryptoHack , but given more time and ambition I wonder how we could iterate on the concept and take it to the next level. Although it deals more with video games rather than games in general, the best talk that I’ve watched on this topic is Jonathon Blow’s Video Games and the Future of Education . He lays out a…
I was brainstorming a name for a side project, and wanted the name to be an available .com domain to register. There’s .net, .org, and many other TLDs but everyone knows that .com is the best. Google claims that TLDs are not a factor in Google search apart from in finding local results for international users. Nevertheless, there’s a trustworthiness factor to .com domains that can’t be matched,…
Intro Like a lot of others during the pandemic I got into cycling. I hadn’t been on a bike since I was kid, but after doing a lot of walking , I wanted to explore further and farther, as well as exercise more intensely. My main concern about cycling was safety, so I bought a mountain bike and stayed off the roads as much as I could. However the same few off-road trails nearby became dull pretty…
I was reviewing my monthly expenses and decided to cancel my subscription to The Economist . I thought this would be simple to do online, just like signing up was. But for a newspaper that treats its readers like adults, I was surprised at how annoying the process to unsubscribe was. First I had to dig around on their website to find the following page to start the cancellation process: Apart from…
I’ve recently been reading Admiral Cloudberg’s analyses of famous aviation disasters. They are clear, well-researched articles which present complex events in a way that a layman can understand. The articles end by showing how each incident led to improvements in procedure, engineering, or personnel training. There’s much that can be learned from these incidents and practices of the airline…
The London LOOP is a 150 mile (242 km) circular walk that takes you through green areas on the edge of Greater London. My motivation for completing this is that I really enjoyed walking the Capital Ring , and wanted to set a more ambitious challenge. Once again I am rating each section and listing good, bad, and unexpected moments. The TfL website has official maps for the route, but I instead…
The Capital Ring is a 78 mile (126 km) circular walk that is designed to take you through suburban London’s parks, open spaces, and nature reserves. It’s split into 15 sections, each of which is easy to reach from public transport. My motivation for walking this, besides exercising and enjoying lovely scenery, is to try and understand better how London fits together. As an excellent blog puts it,…
Yesterday while sipping my morning coffee I found an interesting post “Activists release code to generate free public transportation tickets” . It links to a Tor onion service where the “Public Transport Pirate Association of the United Kingdom” claims to have reverse engineered transportation ticketing software of most major UK cities. The link was later removed, but was possible to recover using…
Today I received notification from Offensive Security that I passed my OSCP exam. I’ve spent the last two months absorbed in this hands-on penetration testing course, and want to share some things I’ve learned. There are already many blogs describing the basic structure of the course so I won’t go into that. Instead I’m going to dive straight into describing my exam experience. Next I list useful…
Last week I competed in the European Cyber Security Challenge , and I spent the first morning working on a “modified Vigenère” challenge. This post describes a highly effective method of cryptanalysing Vigenère ciphers and how it was adapted to solve the challenge. Background The Vigenère was invented in the 16th century and over the following centuries developed a reputation of being extremely…
Yesterday I gave a talk on Drupalgeddon2 to a group of security enthusiasts and software developers. Drupal is a content management system (CMS) which powers up to 5% of all websites, including websites of most of the world’s governments , so an unauthenticated remote code execution vulnerability in it is a Very Big Deal. It has become impossible to ignore the political effects of exploits like…
What are the most challenging codeword clues? Why does Kenya appear to be full of codeword addicts? How many people are even interested in codewords anyway? My Codeword Solver has now been running for over three years, during which time it has gathered plenty of data about codewords and the people who like to solve them. Recently I open sourced the code and wanted to see what insights could be…
The 1981 mystery game Sherlock Holmes Consulting Detective is ranked as one of the best 100 board games , but until recently you could only play it ten times before you ran out of cases. Following the 2015 reprint of the game, several fans have created and published excellent cases of their own. This table aims to keep track of these cases in a clean format: Case Case Date Author(s) Publish Date A…
Recently I’ve been translating some stories with an American friend, and we’ve often run into the issue of mixing American English and British English. Each dialect carries thousands of exclusive meanings and connotations, and this leads to unexpected misunderstandings. I once embarrassed myself by asking an American whether I could borrow his “rubber”. Neither of us were aware of the dual meaning…
The f04cb41f154db2f05a4a subreddit is one of the Internet’s many mysteries. It has been listed amongst the weirdest, creepiest, most insane subreddits ever, and made an appearance in The Daily Telegraph ’s list of the most bizarre subreddits ever created . In short, the cryptic messages on the subreddit have received a great deal of attention, yet little progress has been made as to what they…
Security by obscurity isn’t security, but it can make for a confounding layer on top of strong cryptography. Unfamilar characters like the Korean Hangul or Chinese Hanzi tend to be filtered out by people who can’t read them, which presents a fun opportunity to hide information in plain sight. The Unicode Shift Cipher converts plaintext in one language to ciphertext that appears to be in another…
This Valentine’s Day I spent a romantic evening with a glass of wine and a computer, compiling a list of around 2000 rhyming anagrams. I call these unique words ‘anagrhymes’. Anagrhymes are rather like Kim Kardashian’s love affairs: they sound as if they might be interesting, but turn out to be extremely dull. It eased my own loneliness to discover that almost all of the word groups turned out to…
evolution savannah dust trails whistling thorn hovers above hungry giraffe grows
About a year ago I was stuck on a fiendish codeword. Not wanting to pay the extortionate rates that papers charge for puzzle helplines, I created a codeword solver. During this process, I found it fascinating to study the way that words are constructed. English is unique in the vastness of its foreign influences, and several of the most difficult clues are loan words, like “verandah”. They do not…