My thoughts on topics in the power set of {software, engineering, privacy, writing}.
Originally published at https://shivankaul.com/blog/parable-of-the-sower . Parable of the Sower by Octavia E. Butler. Given how seminal Parable of the Sower by Octavia E. Butler is as a work of speculative and dystopian fiction, it’s surprising it took me this long to get to it. I think I was put off by how bleak I’d heard it to be. Also, while I’d loved Bloodchild , it had taken me a week to…
Originally published at https://shivankaul.com/blog/firefox-bundles-adblock-rust . Mozilla bundled adblock-rust (Brave’s Rust-based adblock engine, the same one my team works on ) into Firefox. Pretty exciting! It landed in Firefox 149 via Bugzilla Bug 2013888 . It’s clearly still an experiment: disabled by default, no usable UI, no filter lists, and as far as I can tell, no press coverage. I…
Originally published at https://shivankaul.com/blog/privacy-inflection-point . I gave the opening keynote talk at Global Privacy Leaders Summit @ RSA 2026 about how the role of the Chief Privacy Officer is changing. The thrust of the talk was that because of incoming AI regulation as well as increasing privacy law enforcement, the practice of privacy is increasingly becoming a systems problem, as…
Originally published at https://shivankaul.com/blog/cookbook-club . Good Things by Samin Nosrat. I’m part of a cookbook club with some friends. We pick a cookbook, everyone picks a recipe from the cookbook to make, and then we have a big potluck dinner. This is the sign-up sheet template we’ve been using (h/t my friend Bell for the original). We’ve done 2 cookbooks so far. The first one was…
Originally published at https://shivankaul.com/blog/the-correspondent . The Correspondent by Virginia Evans. I normally don’t read recently-published novels, firmly believing in the value of natural selection acting over several years to winnow the good from the merely fashionable. I’ll only read a finite number of words in my lifetime, and I want to make them count, etc. This heuristic has served…
Originally published at https://shivankaul.com/blog/adblock-memory-reduction . We spent a good chunk of 2025 working on memory savings for adblock-rust . This was important and long-overdue work, since while Brave shines in other departments (speed, CPU usage, battery consumption), we’re worse than Chrome for memory because we ship 100,000 adblock filters by default (several times an hour!) that…
Originally published at https://shivankaul.com/blog/claude-code-process-exhaustion . I’ve been using Claude Code on the CLI recently, and I keep running into annoying bugs. A particularly egregious one was where Claude Code spawned thousands of zombie processes and exhausted my process limit, essentially fork-bombing me. In the iTerm2 window where I had claude running, I saw the following output…
Originally published at https://shivankaul.com/blog/2025-wrapped . We had a suburban holiday season. The final days of 2025 slipped away in quiet, rain and rest. We didn’t travel anywhere, which was (finally) keeping in line with my everlasting resolution to travel less ( unlike 2024 ). I’m slightly worried that I’m turning into my Dad, who loves home with a burning passion, but I just hate the…
Originally published at https://shivankaul.com/blog/disable-claude-code-feedback-prompts . Claude Code sometimes pops a “How is Claude doing this session?” feedback survey mid-flow. There’s a simple way to disable it: Set CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 in your environment. The cleanest option is to put it in Claude Code’s ~/.claude/settings.json under env : { "env" : {…
Originally published at https://shivankaul.com/blog/hls-to-mp4 . I recently wanted to download a wedding video from a media-hosting platform that had no download button. If my browser could play it, the video data was clearly being streamed somewhere; how hard could it be to capture and save it as an MP4? Turns out: not very hard. With chrome://media-internals , DevTools and an (AI-generated)…
Originally published at https://shivankaul.com/blog/comet-privacy . Perplexity Comet leaks your entire browsing history to their servers, and there’s no way to turn it off. Update: as of June 27, 2026 on version 149.0.7827.197 this still reproduces. Comet’s security and privacy posture is terrible. Much electronic ink has been spilled over Comet’s security holes , including a lot by me , so I…
Originally published at https://shivankaul.com/blog/paste-bracketing-iterm2 . Here because of Claude Code? If you’re here because of Claude Code messing up paste bracketing in your terminal, try putting in the following in your .bashrc or .bash_profile : claude () { command claude " $@ " printf '\e[?2004l' } (credit: this GitHub issue comment ) I actually ended up writing a wrapper script for…
Originally published at https://shivankaul.com/blog/in-the-mood-before-sunrise . Before Sunrise and In the Mood for Love . I recently watched Before Sunrise and In the Mood for Love in quick succession, the latter for the first time. Having seen In the Mood for Love just the night before and finding Mrs. Chan’s character fascinating, I was thinking a lot about Celine while rewatching Before…
Originally published at https://shivankaul.com/blog/beyond-cookies-browser-fingerprinting-in-2025-2 . This is part two of a blog post summarizing the state of browser fingerprinting in 2025. You can read part one here ), where I went over the what, who, why, and how of browser fingerprinting. In this post, we’ll discuss how browsers protect against fingerprinting, and how you can protect yourself.…
Originally published at https://shivankaul.com/blog/beyond-cookies-browser-fingerprinting-in-2025-1 . Earlier this year, I was asked to give a talk on the state of browser fingerprinting by the Public Interest Technology Group ( PITG ). I wrote a blog post based on the talk that was published on the PITG blog . I decided to reproduce it in full on my own blog because I made some edits…
Originally published at https://shivankaul.com/blog/prompt-injections-in-agentic-browsers . In August 2025 we found, responsibly disclosed and wrote about an indirect prompt injection attack in Perplexity’s Comet browser. The attack exploited agent-controlled browsing in Comet. We followed this up with several new disclosures which proved that this wasn’t a one-off case of bad security practices…
Originally published at https://shivankaul.com/blog/2024-wrapped . I’m writing this on the flight back to SF from Delhi. Sleep is elusive and there’s no Wi-Fi on Air India to guilt me with its siren song of Slack notifications. Here are some 2024 highlights: Making SF a home We moved to San Francisco last year, but spent about a year settling in properly. I’m a double-immigrant at this point (h/t…
Originally published at https://shivankaul.com/blog/victory-city . Victory City by Salman Rushdie. Salman Rushdie’s latest novel Victory City includes a public blinding. It is horrifically ironic that the author himself lost an eye and barely escaped with his life in an assassination attempt while promoting the novel at a public lecture in New York (incredibly, the lecture was on how the U.S. is a…
Originally published at https://shivankaul.com/blog/movie-review-valley-of-saints . Valley of Saints , directed by Musa Syeed. The Kashmiri reading group I’m a part of recently saw Valley of Saints , a 2012 Sundance-winning docudrama indie film made by Musa Syeed set in Srinagar, Kashmir which is where my family is from. We’ve been trying to consume more Kashmiri art and literature in the group;…
Originally published at https://shivankaul.com/blog/privacy-engineering-archetypes . As a self-proclaimed privacy engineer, I build privacy-centric products for users and review features across the company to prevent privacy flaws from shipping. At a previous company, I worked on infrastructure, making sure that the company’s DNS was not leaking sensitive customer data in transit. Prior to that, I…
Originally published at https://shivankaul.com/blog/trust-issues . I recently published an essay on increasing centralization in Internet privacy in Meatspace Press ’s new book called “Eaten by the Internet” . I admire the work of many of my co-contributers so this was a cool experience. You can read the book online here . I’ve reproduced the essay here on my blog. … Trust issues: internet privacy…
Originally published at https://shivankaul.com/blog/sf . It’s been around half a year since I moved from Vancouver to San Francisco. Time has never passed by faster. Some observations about the cities and my life in general: SF has strong Main Character Energy. I think America in general does. Everyone loves to love and loves to hate SF (Canadians included) with a passion that Canadians just do…
Originally published at https://shivankaul.com/blog/pepr-2023 . This week was USENIX PEPR 2023 . This was my second year attending; last year I gave a talk on shipping adblocking in Brave and was on a panel on DNS privacy . This year I was on the Program Committee , gave a talk on privacy-preserving telemetry and chaired a session on Web Privacy. PEPR is interesting because it’s technically an…
Originally published at https://shivankaul.com/blog/vinyl . I was recently gifted an Audio-Technica AT-LPW30TK turntable for my birthday. It’s beautiful! I’ve been trying to acquire vinyl copies of albums I love. These are the records I currently have: Carrie & Lowell by Sufjan Stevens The Dark Side of the Moon by Pink Floyd Texas Sun by Khruangbin and Leon Bridges Good Thing by Leon Bridges…
Originally published at https://shivankaul.com/blog/delegated-domain-verification . In the previous post I talked about the work we’re doing at the IETF to establish best practices around DNS-based domain verification. One thing we don’t really discuss in the draft yet is delegated domain verification. The context here is that you use an intermediary or a content delivery network (CDN) for your…
Originally published at https://shivankaul.com/blog/domain-verification-using-dns . We’ve been working on describing best practices for doing domain verification using DNS at the IETF. The Internet Draft is here , and has been adopted by the DNSOP Working Group as a Best Current Practice document. I started working on this when I was on the Salesforce Public DNS team where we had to deal with a…
Originally published at https://shivankaul.com/blog/april-1-2021-rfc . Some folks and I wrote and published a satirical April Fools’ Day RFC : RFC 8962 . You can read it here ! Very IETF-niche humour.
Originally published at https://shivankaul.com/blog/running-jekyll-locally-on-mac-m1 . I recently got a new M1 MacBook and wanted to set up Jekyll locally so I could write blog posts. However, I ran into some issues because of architecture issues. I got the following error: missing compatible arch in /Library/Ruby/Gems/2.6.0/gems/ffi-1.15.0/lib/ffi_c.bundle on trying to do a jekyll serve . After…
Originally published at https://shivankaul.com/blog/floc-block . I recently wrote a tiny Chrome extension to remove document.interestCohort() from every page so that a website cannot query your browser for its cohort ID. Why? So I could call it FLoC Block FLoC, short for Federated Learning of Cohorts, is the new mechanism used by Google Chrome to group users into buckets based on their interests.…
Originally published at https://shivankaul.com/blog/sudoku . For my Algorithms 1 course in Fall 2013, the final project was a choice between building a web search engine and an NxN Sudoku solver. Our prof told us that for the search engine he would give us a bunch of guidelines and classes to start us off, but wouldn’t give us anything for the Sudoku problem – it was billed as the more ‘open…
Originally published at https://shivankaul.com/blog/tls-pinning . I’ve been working on getting DNS servers talking to each other using DNS-over-TLS, and have found myself using TLS key-pinning. For more info about TLS key-pinning check out https://timtaubert.de/blog/2014/10/http-public-key-pinning-explained/ . For key-pinning you have to generate the SHA-256 pin. This can be done either using your…
Originally published at https://shivankaul.com/blog/consent-in-contact-tracing . There are several challenges involved in building true privacy-preserving and trust-inspiring contact tracing systems, and many organizations have released principles that should guide the development of contact tracing systems ( ACLU , CCC , Data Rights for Exposure Notification ). The principles vary somewhat, but…
Originally published at https://shivankaul.com/blog/contact-tracing-vs-exposure-notification . Some musings on the differences between (assisted) contact tracing and exposure notification. … Apple and Google recently updated their terminology to use the term “Exposure Notification” to describe what they’re offering through their jointly-developed APIs, rather than the broader term “Contact…
Originally published at https://shivankaul.com/blog/naming-maps . I’ve always struggled somewhat with finding the right name for map-like variables. Naming things is hard , but surely it’s redundant to name your map thingMap (as in Map<Thing> thingMap = new ... ), especially in languages that are strongly-typed. I try to name my maps XToY , where X is key and Y is value, and the Internet seems to…
Originally published at https://shivankaul.com/blog/keeping-in-touch . I have recently given up on making an active effort to keep in touch with friends and family. I learnt this from a friend who extended a work trip to San Francisco from Ontario to come up to Vancouver to spend a Sunday with me. We only got 14 hours, but we talked. so. much. So my new resolution is that if a friend is worth…
Originally published at https://shivankaul.com/blog/pearg-ietf-104 . IETF 104 was last week, and I’ve been trying to find the time and (mental-)space to do a mind-dump about it. Now that my ig is basically a Prague travelgram, the number of test failures/bugs assigned to me have been made peace with, beer/goulash/jet-lag have been recovered from and the Sunday after has lazily rolled around, I…
Originally published at https://shivankaul.com/blog/2018 . This year was interesting. Some highlights: Left Cisco I was surprisingly more emotional about leaving Cisco than I had anticipated. I liked my co-workers and loved my manager (apparently this is rare), but hated the city. The work was technically challenging, but writing C for a year definitely contributed adversely to my hair health. Got…
Originally published at https://shivankaul.com/blog/radio . Reading All The Light We Cannot See in a perfectly-background-voluumed after-hours cafe in downtown Vancouver. The noise of students, workers, families drinking tea and conversation envelopes like a warm hammock, the air-conditioning over-enthusiastic against the oppressively still night. In the book, I read about radios. How miraculous…
Originally published at https://shivankaul.com/blog/privacy-and-consent-in-the-age-of-browsers-the-question-of-webrtc . (cross-posted from ARTICLE 19’s blog ) Web browsers like Google Chrome, Mozilla Firefox and Safari allow us to view web-based content on all of our devices. As users, we expect them to act as our “agents” and protect us as we navigate an Internet increasingly filled with malware…
Originally published at https://shivankaul.com/blog/feedback-form-for-chrome-extensions . I created and maintain a Chrome Extension with a modest ~8,000 weekly active users. I quickly realized the importance of getting feedback from users, and settled upon a lightweight way of serving a Google Form to users when they uninstall the extension. I figured it might be helpful to other Chrome Extension…
Originally published at https://shivankaul.com/blog/zero-length-arrays . Today I learnt about flexible array members and zero-length arrays , and I learnt about them in the worst way possible. At work, I had to write some code that involved adding a member to a struct. Here’s a fictionalized (and heavily stripped out) version of the original struct (no real code was harmed in the making of this…
Originally published at https://shivankaul.com/blog/nfa-dfa-and-regexes . Finite State Automata Finite State Automata are abstract models of computation. In other words, they are sytems that take input (in form of symbols) and spit out a result (or, perform a computation). To do this, they read symbols and move internally between states. They can be described by 3 things: starting state list of…
Originally published at https://shivankaul.com/blog/thenews . I wrote a Chrome Extension that lets you read a breaking / live news headline every time you open a new tab. Here it is . I wrote it because I often lose track of what’s happening in the world: some days while participating in adult conversation, I speak exclusively in “Huh?”s. I’d previously released FrontPageNYT which did something…
Originally published at https://shivankaul.com/blog/typewriter . I made something that converts raw text like: I fall in love with ideas all the time: quantum mechanics, you, socialism. You're just a figure of my speech. into an image of the text in a typewriter-style font: Useful for Instagram poetry. You can check it out at the Typewriter GitHub repo .
Originally published at https://shivankaul.com/blog/clean-your-desk-yet-another-amazon-interview-experience . Some time back I had a second round interview with Amazon for an SDE role. This is my experience. The first round interview experience has already been documented well here . I’ve kept this brief, without excessive philosophizing about the Right Way to Interview, talking only about my…
Originally published at https://shivankaul.com/blog/redirect-loops-wi-fi-login-pages-getting-around-via-rails-network-configuration . I was travelling on VIA Rail today, and wanted use the free onboard Wi-Fi. I connected my phone to it easily enough - they had a standard login page. But when I tried to connect my Mac to the wireless open network ( VIA_WIFI_VIDEO ) and tried navigating to a…
Originally published at https://shivankaul.com/blog/git-fresh . In codebases that use Git, a common development strategy is to have a separate feature branch for a feature, push that to GitHub (or whatever equivalent you use) and then switch back to master, update, and start working on the next feature. I found myself doing that pretty often, so I wrote a simple git alias that does all that in one…
Originally published at https://shivankaul.com/blog/writing-a-compiler-in-haskell . This winter, I took Compiler Design with Prof Laurie Hendren . Ever since I began programming, I’ve been interested in programming languages. Languages (both the natural kind, like English (the rules of which you’re using to parse this sentence inside your head (unless you’re a bot, in which case 01101000 01101001…
Originally published at https://shivankaul.com/blog/markdown-pdf . Oh my god. I’ve spent the last 2 hours trying to get started taking notes for a class that has an exam tomorrow. I was taking them in Markdown when it occurred to me that it would be cool if I could then convert the file to pdf for viewing later. And of course, I had to configure this now . What followed was a horrific descent into…
Originally published at https://shivankaul.com/blog/boingo-hotspot-loophole . TL;DR: showing how you can tweak the URL to get unlimited Wi-Fi at a Boingo HotSpot at John F. Kennedy International Airport. WHY So I was in the US recently for an internship interview, and was travelling back home to Montreal from NYC. I was waiting for my flight at JFK, where American Airlines had just announced that…