./
hey, i’m merle.
i make things, break things, and occasionally write about it.
Recent
why even signal knocks on google & apple's door
·44 words·1 min
a talk about push notification infrastructure, what google and apple see, why metadata is enough, and what alternatives exist. presented at GPN24.
when your privacy service leaks everything
·981 words·5 mins
found a critical vulnerability in an address-hiding service. every customer’s real address was in the html source.
the zulip saga, part 1: how a messenger sent me down a rabbit hole
·306 words·2 mins
zulip mobile app doesn’t send push notifications reliably. so i built my own notification app and discovered how broken mobile push infrastructure really is.