DEV Community: Simonee

Privacy tools explained with Among Us

Simonee — Fri, 04 Sep 2026 03:09:51 +0000

When I was deep into the privacy community, doing stuff like fully encrypting my disk with VeraCrypt, keeping ProtonVPN on with a kill switch, and using Signal instead of Telegram, I came across a bunch of browser extensions that everybody seemed to recommend together. Adblocker, Privacy Badger, LocalCDN. I installed all of them and treated them as collectibles. More tools, more privacy.

It took me an embarrassingly long time to notice that the three of them do three different jobs, and that two of them barely overlap. Among Us is how it finally made sense to me, so that is how I will explain it.

A web page is not one place. When you open a news article, the article itself comes from the news site, but the fonts might come from Google, the script library from a CDN, the ads from an ad company, the comments from a company the news site contracted, and the Like button from Facebook. The Electronic Frontier Foundation, the nonprofit that makes Privacy Badger, opens its own explanation of the tool with this same picture. To check it was not an exaggeration I loaded the Inquirer front page once and logged every request. Four hosts were the Inquirer's own. Twenty-four were other companies, and they got fifty-four requests between them.

Company	Host	Requests
Inquirer	www.inquirer.net	29
	newsinfo.inquirer.net	2
	sports.inquirer.net	1
	analytics.inquirernetwork.net	2
Google	fundingchoicesmessages.google.com	14
	securepubads.g.doubleclick.net	4
	pagead2.googlesyndication.com	4
	fonts.gstatic.com	3
	ep2.adtrafficquality.google	3
	fonts.googleapis.com	2
	ep1.adtrafficquality.google	2
	cm.g.doubleclick.net	1
	www.google.com	1
	64020afcac2374c8919c09a1eb7e6a94.safeframe.googlesyndication.com	1
iZooto	cdn.izooto.com	4
	rec.izooto.com	1
	sbp.izooto.com	1
	nhwimp.izooto.com	1
New Relic	bam.nr-data.net	2
	js-agent.newrelic.com	1
Yieldlove	cdn.yld.is	2
Criteo	static.criteo.net	1
	gum.criteo.com	1
Adobe	use.typekit.net	1
io Technologies	cdn.onthe.io	1
OpenX	oa.openxcdn.net	1
RTB House	invstatic101.creativecdn.com	1
Adgebra	adgebra.co.in	1

Every request the Inquirer front page made in one load on 5 September 2026, grouped by the company that received it.

In Among Us terms, the site you typed in is the ship you boarded. Every third-party request is a crewmate who walked in from somewhere else. Some of them are doing tasks, like the font and the script library. Some of them are impostors, like the analytics pixel whose only job is to remember you were here. The problem is that from the outside they look identical. Each one is a request leaving your browser, and each request carries your IP address and the page you are on.

The three tools are three different ways of dealing with the crew.

Adblockers

uBlock Origin, AdBlock Plus, and the rest work from filter lists. The big one is EasyList, which removes most adverts from international webpages and is maintained by four people (Fanboy, MonztA, Khrin, and Yuki2718) with help from a forum. Its sibling EasyPrivacy targets tracking rather than ads. A filter list is a long set of rules that match URLs and page elements. If a request matches a rule, the blocker stops it before it leaves your browser.

In the game this is an emergency meeting where everyone already has a list of names, and anyone on the list gets voted out on sight. It works well enough that almost everyone runs one, and it takes the ads out of the page entirely rather than only stopping the tracking part. The catch is that a tracker not on the list walks straight past, and keeps walking past until a maintainer notices and adds it.

If you can list everything, why is this not solved? Because the other side reads the list too, and the list is only ever a description of what the ads looked like last week. I pulled the EasyList commit history while writing this. In the first week of September 2026 the repository got between 138 and 187 commits a day. On the 8th, by mid-afternoon UTC, Fanboy alone had pushed over ninety commits titled "M: Update", roughly one every eight minutes since early morning.

Day	Commits to EasyList
1 Sep 2026	174
2 Sep	149
3 Sep	138
4 Sep	178
5 Sep	173
6 Sep	187
7 Sep	185

Most of those commits look like this one. Three new domains, all random letters, added to the ad server list.

+||donalpapmeat.com^
+||lzazqrrmqjvov.top^
+||wkzmfbrbxstzq.space^

Ad networks register throwaway domains faster than anyone can type them, which is why that one file has over forty thousand lines and grows every day. The other kind of commit goes the opposite direction. On the same day Khrin changed one existing rule because it was breaking something on CNN, and carved out an exception so the rule no longer applies to XMLHttpRequest calls.

-||brightline.tv^$third-party
+||brightline.tv^$third-party,~xmlhttprequest

The bigger players do not bother with new domains. Facebook in 2019 started splitting the word Sponsored on its ads into scrambled pieces of text so that no rule could match it, the maintainers wrote rules for the scrambling, and Facebook changed it again. Some trackers get served from a subdomain of the site you are on, through a CNAME record that quietly points at the tracking company, so a blocker that only looks at the hostname sees a first-party request and lets it through. uBlock Origin on Firefox has been able to unmask those since 2020. When YouTube started blocking adblock users outright in late 2023, the lists were updated within hours, YouTube changed its detection, the lists were updated again, and that went on for weeks. A filter list is never finished. It works because a handful of people keep it current, every day, by hand.

Privacy Badger

Privacy Badger is made by the EFF and it deliberately does not use a list. Their FAQ says: "we define what tracking looks like, and then Privacy Badger blocks or restricts domains that it observes tracking in the wild." Whether something counts as a tracker depends on how the domain behaves, not on a maintainer's judgment.

Concretely, it watches the third-party domains that embed images, scripts, and ads in the pages you visit, and it looks for the techniques trackers use: cookies that uniquely identify you, local storage "supercookies", canvas fingerprinting. If it sees the same third-party host doing that on three separate sites, it stops loading anything from that host. Three is not many. I opened the Inquirer, Rappler, and Philstar front pages in a row and these eight domains were on all of them.

Domain	Inquirer	Rappler	Philstar
googlesyndication.com	5	26	43
doubleclick.net	5	27	32
google.com	15	24	22
adtrafficquality.google	5	5	5
criteo.com	1	3	9
creativecdn.com	1	3	4
criteo.net	1	1	1
openxcdn.net	1	1	1

Front pages of the Inquirer, Rappler, and Philstar, loaded one after another on 5 September 2026. Each number is how many requests that domain received during the load.

In the game this is the crewmate nobody reported, who keeps turning up in rooms it has no reason to be in, until after the third room the Badger calls the meeting and ejects it. Because the rule is about behaviour rather than a name, it catches trackers nobody has written a rule for yet. A fresh install does not start from zero either. The EFF runs a training project called Badger Sett that visits thousands of popular sites and pre-learns the trackers on them, and ships that with the extension.

Privacy Badger does not block ads for being ads, only the ones that track you, which the EFF says is deliberate, to give advertisers a reason to behave. It also sends the Global Privacy Control and Do Not Track signals to every site, and if a tracker ignores them the Badger learns to block it anyway. Social widgets like the Like button get replaced with a click-to-activate placeholder, so the button does not phone home until you press it.

LocalCDN

The third tool deals with a leak that the other two mostly leave alone. Sites do not host every script themselves. A large share of them load jQuery, Bootstrap, Font Awesome, or a Google font from a shared content delivery network: ajax.googleapis.com, cdnjs.cloudflare.com, code.jquery.com, cdn.jsdelivr.net, unpkg.com. Those scripts are legitimate, crewmates doing tasks, but every time your browser fetches one, the CDN operator, usually Google or Cloudflare, gets your IP address and the page that asked for the file.

An adblocker will not touch these because they are real code the page needs, and Privacy Badger usually will not either, because serving a file is not tracking by its definition. The request goes out on every site that uses the library, which is most of them.

	Without LocalCDN	With LocalCDN
Page asks for	cdnjs.cloudflare.com/.../jquery.min.js	cdnjs.cloudflare.com/.../jquery.min.js
Answered by	Cloudflare	a copy bundled in the extension
Leaves your browser	yes	no
Cloudflare learns	your IP, the page you were on	nothing

The same jQuery request with and without LocalCDN installed.

LocalCDN describes itself as emulating content delivery networks. It intercepts the request, finds the same library at the same version in a bundle it ships with, and injects that instead, so nothing leaves the browser. In the game you never have to go to MIRA HQ to pick up your tools, because somebody already stocked the storage room on the ship.

If the name Decentraleyes rings a bell, it is the same idea. LocalCDN started in 2020 as a fork of Decentraleyes with a longer list of libraries and CDNs, and it is the one that still gets regular updates. Run one or the other, never both, or they will fight over the same requests.

The old argument against this was that shared CDNs were good for speed, because a copy of jQuery cached from one site could be reused on the next. That stopped being true a few years ago. Browsers now partition the HTTP cache by the site you are on, so a file cached from site A does not help on site B. Safari has done this since 2013, Chrome since version 86 in late 2020, and Firefox since version 85 in early 2021. What is left of the shared CDN is the privacy cost.

Put the three side by side and the overlap is smaller than the "install all of these" advice suggests.

uBlock Origin, AdBlock Plus, Privacy Badger, LocalCDN, Decentraleyes

The adblocker with EasyList and EasyPrivacy removes ads and every tracker that someone has already written a rule for, which is most of them.
Privacy Badger catches the trackers that are not on any list yet, and handles the social widgets and the opt-out signals.
LocalCDN closes a specific leak, the shared library request, that neither of the others considers a problem.

None of them do anything about the first party. The site you are on still sees everything you do on it, and the Privacy Badger FAQ says plainly that this is out of scope. If you are logged in, that site knows who you are. They do not hide your IP address from anyone you actually connect to, which is what the VPN was for. They can also break things. Privacy Badger's placeholders exist because blocking a widget outright would leave a hole in the page, and LocalCDN can only substitute a library it has a copy of, so a site that uses an unusual version will fall back to the network anyway.

What I run now is an adblocker with the two Easy lists, Privacy Badger, and LocalCDN on Firefox. Firefox's own tracking protection overlaps with the Badger, and the EFF says the two get along. I stopped thinking of them as a collection once I understood that they are three crewmates doing three different tasks, and I have stopped expecting any one of them to do the other two's job.

Sources: the Privacy Badger FAQ (how it works, the three-site rule, Badger Sett, GPC and DNT, what counts as a third party); EasyList (maintainers, EasyPrivacy) and its GitHub repository (commit counts and diffs, pulled 8 September 2026); LocalCDN (supported CDNs and libraries); Chrome's HTTP cache partitioning announcement and Mozilla's network partitioning post (why shared CDN caching no longer helps).

Originally published at stimmie.dev. Also on Dev.to and daily.dev. A shorter first version is on Medium. Source and images on GitHub.

The Death of the Easter Egg

Simonee — Fri, 04 Sep 2026 01:04:22 +0000

There is a flight simulator inside Microsoft Excel 97.

I wasn't around for it. I learned about it the way most people my age learn about anything from before they were born, which is to say late at night, from a video, with the volume low, and with the vague feeling of having missed something. You open a blank sheet, press F5, type X97:L97, press Tab, and hold Ctrl and Shift while clicking the chart wizard. The spreadsheet disappears. What is left is a range of purple hills under a black sky, and you are flying over them.

This is a screenshot of Microsoft Excel.

If you flew long enough you would find a grey monolith standing in the middle of the terrain, and on its face the names of the people who built Excel would scroll upward, slowly, like the credits of a film. There was a lagoon nearby. Nobody asked for a lagoon.

The monolith. Those are real people. Some of them are probably still at Microsoft.

The same terrain, another day. It was generated at random, which meant no two people saw quite the same hills.

I think about this more than I probably should. A handful of engineers put an entire small world inside a program meant for accountants, and for a few years every finance department on earth carried it around without knowing, which is a strange thing to be moved by and yet here I am. It had no purpose and it wasn't in the manual. It existed, as far as I can tell, because the people who made Excel wanted, in some quiet and probably unexamined way, to be found.

That won't happen again. I want to be careful about how I say this, because it sounds like nostalgia for a decade I didn't live in, and I am suspicious of my own nostalgia in general. But I've come to believe that the easter egg, the real kind, the kind no one approved, is gone, and that I know, or at least strongly suspect, what took it.

The first one

The first easter egg came out of a grudge. In 1979 Atari did not print the names of its programmers anywhere. A person would spend the better part of a year alone with four kilobytes, and the box would go out with a painting of a dragon and no human being credited on it. Warren Robinett wrote Adventure under those terms and decided he would not be erased.

So he built a room. To reach it you had to find a single grey dot hidden in a wall, carry it across the map, and squeeze through a gap that was not supposed to be there. Inside, in flashing letters, the game said: Created by Warren Robinett. He told no one and left the company. About a year later a teenager found the room and wrote to Atari, and Atari, after working out what a recall would cost, decided to leave it in.

The room.

I keep returning to what the room needed in order to exist. It needed one person holding the entire program in their head, with no one else reading the code, on a cartridge that shipped once and could never be patched. Most of all it needed someone who had been in there long enough to feel that the thing was theirs.

What happened to it first

Several things had already gone wrong with the easter egg by the time I was old enough to notice, though I did not notice.

Microsoft stopped allowing them in 2002. Bill Gates had sent a memo about trust, and somebody realised that a customer like a government cannot buy a product with code in it that nobody documented. A hidden flight simulator and a hidden backdoor look the same from the outside. So the flight simulator went, and the pinball game in Word went with it, and no one at Microsoft has been allowed to hide anything since. That's compliance for you.

Everywhere else, code review did the same job. A secret needs a place to hide, and there is nowhere to hide in a codebase where two other people read every line before it is merged. If someone opens a pull request and finds four hundred lines of terrain generation in a spreadsheet, they ask what it is for, and the moment there is an answer it becomes a ticket with an owner.

Around the same time software started being measured, and an easter egg has no number attached to it, so it never got scheduled. And the internet made the whole thing brief anyway. A hidden room in a game today is on a wiki with the exact button presses within the hour, often before the game is even out.

And still, through all of that, people kept hiding things.

Search for the word askew. Google still tilts the page. It also, now, explains the word to you first.

Every Minecraft changelog for fifteen years has ended the same way. Herobrine was never in the game.

Name a sheep jeb_ and it will not stop changing colour.

Chrome, when the internet is gone.

I love all of these. I want that on the record before I say the next thing. They were planned, and specified, and someone in legal nodded at them, and still, behind each one, there was a person who wanted to be there. None of this killed it, though. It limped for a long time, a little more corporate every year, but it limped.

What finally took it

What I think actually killed it was the code starting to write itself. Ask why those engineers built a planet inside a spreadsheet. No user wanted it and no metric moved. They built it because they had been living inside that codebase for two years. They knew the charting engine the way you know a house you grew up in, including the parts that were ugly, because they had been awake at two in the morning fixing them. Somewhere in all of that the suffering became a kind of ownership, and ownership, without meaning to, turned into something like love, and love wanted to carve a name into the underside of the desk.

Robinett's room was what months alone with four kilobytes does to a person.

I have watched an app appear in the time it takes to make coffee, and I have made some of them myself. You describe what you want to a text box and you step away, and when you come back it is there: the routing, the login, a dark mode toggle, a settings page no one will ever visit. It works, mostly. It took eleven minutes, and in those eleven minutes there was no two in the morning and no ugly corner you came to know by heart, only a wall of plausible code that arrived all at once and had never met you.

Somebody else's text box. This is the illustration on the Wikipedia article for vibe coding.

This is the part I find hard to say plainly, so I will say it the long way. It baffles me a little, but you don't want to leave a piece of yourself in that app, and I think it is because no piece of yourself went into it in the first place. The egg needed a person who had earned the right to be possessive about a codebase, and eleven minutes is not long enough to earn that.

You could ask the text box for one, of course, and it would give you one, and it would be a Konami code that makes confetti, and it would carry exactly as much of you as a birthday greeting from your bank.

The Konami code. Type it on the right website and confetti falls, or the page flips, or a dinosaur appears. It has been the default hidden thing since the eighties.

Over a thousand packages on npm that listen for it. You do not write the easter egg. You install it.

What I am not saying

It may be tempting to read all this as a plea to go back, and it isn't one. The old way of building software was slow and it hurt, and a great deal of the hurting was, if we are being honest, pointless. The tools are better and the things get built. I use the text box too, and I will keep using it, and I do not think there is anything to apologise for in that.

But the unauthorised easter egg was proof that a human being had been inside the machine for a long and unpleasant stay. The lawyers made that risky, code review made it visible, the dashboards left it unfunded, and the internet made it brief. Then the generated code took away the one thing it could not survive without, which was someone who had been there long enough to care.

The software still works, but it never met anyone.

I write this more solemnly than the subject deserves, and I know it. It is a spreadsheet with a flight simulator in it, and a sheep that changes colour. But I have noticed that the things I make quickly, I do not remember, and the things I made slowly and badly, at hours I should have been asleep, I can still walk through with my eyes closed.

If you are still building the slow way somewhere, on something no one asked you for, leave the room in, a line that only shows on one day of the year, or a command that is not in the help text and does something small and unnecessary. No one may ever find it, and that was never the point.

Perhaps the point was only ever this: that somewhere in the program there is a wall with a name on it, and the name is there because a person was.

Originally published at stimmie.dev. Also on Medium, LinkedIn, and daily.dev. Source and images on GitHub.

I just made a small contribution to modern mathematics!

Simonee — Sun, 05 Apr 2026 04:15:12 +0000

I was reviewing some competitive programming concepts in preparation for today's Div 4 Codeforces contest and I came across this sequence while doing a problem on recurrence relations (matrix exponentiation): https://oeis.org/A322054

My math senses were strong enough to spot a logical flaw (just one word!) in one of the examples written by Neil Sloane himself, the founder of the Online Encyclopedia of Integer Sequences, that remained undetected for EIGHT YEARS! (you can see in the image that the OEIS was indeed founded by Sloane and that he authored the sequence)

This led me to create an OEIS account and promptly fix the error :))

I'm excited to announce that I have climbed an excavator for the first time!

Simonee — Wed, 31 Dec 2025 08:28:43 +0000

Most people see a piece of heavy machinery. I see a metaphor for vertical integration. When I reached the top, I didn't just see a construction site. I saw:

The Power of Leverage: If you don't move the earth, the earth moves you.
Operational Excellence: Sometimes you have to get out of the office to understand the "ground floor" of your business.
Scalability: Why use a shovel when you can be the engine?

Stop dreaming about the view from the top and start climbing the iron. Who’s with me? #GrowthMindset #HeavyLifting #Disruption #InfrastructureLeadership