GrapheneOS, JWT Pitfalls, and the Hidden Power Inside Every Bash Shell

GrapheneOS — the hardened, privacy-focused Android fork that strips Google tracking infrastructure and adds multiple layers of exploit mitigation — has been successfully ported to Android 17, with official releases described as coming soon. The project runs primarily on Pixel hardware, which Google designs with the security features necessary to support GrapheneOS's modifications. A rapid port to a newly released major Android version signals both technical capacity and ongoing community support; major Android upgrades frequently introduce changes that break the extensive modifications the project requires, and maintaining pace with upstream development is not guaranteed for a project of this size.

A post titled 'Stop Using JWTs,' by Sam Scheschuk, attracted 413 upvotes and 239 comments and reflects a debate with no clean resolution. The piece argues that JSON Web Tokens are frequently misused in ways that create security vulnerabilities — specifically, that their stateless nature makes token revocation extremely difficult, that cryptographic flexibility leads developers to choose weak algorithms or implement verification incorrectly, and that the scalability benefit of statelessness is often illusory for applications that must check database state on every request regardless. The Hacker News community is genuinely divided: experienced security engineers who have seen JWT misuse cause real breaches broadly agree, while others contend that the described problems are implementation failures rather than flaws in the standard itself, and that JWT remains sound when used correctly in distributed systems with short-lived tokens.

A separate writeup on Microsoft IIS vulnerabilities — titled 'Humiliating IIS servers for fun and jail time,' with the 'jail time' reference pointing to the legal consequences of exploitation rather than a demonstration — drew 280 upvotes for its detailed walkthrough of attack vectors against a web server that still powers a significant portion of the internet. Community discussion focused on the piece's value for defenders seeking to understand the vulnerability categories they are protecting against, as distinct from operational attack guidance.

Perhaps the most widely appreciated discovery of the day came from a post revealing that Bash has included a built-in pseudo-device at /dev/tcp since at least version 2.04 — allowing raw TCP connections, and therefore raw HTTP requests, to be made directly in shell scripts without installing curl, wget, or any other external tool. The post scored over 400 upvotes, with many experienced Bash users expressing genuine surprise at a feature that has existed for decades. The community's enthusiasm for the find, rather than embarrassment at not knowing it, reflects a consistent norm: intellectual curiosity is valued over the performance of prior knowledge.