./
hey, i’m merle.
i make things, break things, and occasionally write about it.
Recent
when your privacy service leaks everything
·981 words·5 mins
found a critical vulnerability in an address-hiding service. every customer’s real address was in the html source.
the zulip saga, part 1: how a messenger sent me down a rabbit hole
·306 words·2 mins
zulip mobile app doesn’t send push notifications reliably. so i built my own notification app and discovered how broken mobile push infrastructure really is.