About

Matthew J. Harmon. Two decades in information security: incident response, threat intelligence, risk assessment, and the unglamorous work of making controls actually hold.

The fingerprints

Every entry ends with a receipt. It gives the date the entry was filed and the SHA-256 of its source file, front matter included. The list of entries shows the first eight characters.

A filed entry never changes. If something in it is wrong, the correction is filed as a new entry. The new entry links back to the original, and the original gains a note pointing forward. Its own bytes and fingerprint stay exactly as they were filed.

Each fingerprint is timestamped when the entry is filed, three ways. Two RFC 3161 time-stamping authorities (DigiCert and FreeTSA) sign it immediately. OpenTimestamps anchors it in the Bitcoin blockchain within a few hours. Nobody, including me, can produce a receipt dated earlier than the day the words existed.

Checking a receipt

Press Verify this entry at the foot of any entry, or use the Verify page. It checks the text, both timestamps and the Bitcoin anchor in your browser, and can also tell you whether a file you saved earlier matches anything that was filed.

To check without trusting this site’s own verifier, do it by hand. Each entry publishes its source and its proofs beside it. For an entry at /posts/<slug>/:

u=https://blog.itys.net/posts/<slug>
curl -sO $u/entry.txt -O $u/receipt.sha256 -O $u/receipt.digicert.tsr \
     -O $u/receipt.freetsa.tsr -O $u/receipt.ots

# 1. The text is what was filed: this hash is the first line of receipt.sha256.
sha256sum entry.txt; head -1 receipt.sha256

# 2. The receipt existed at the stamped time.
openssl ts -verify -data receipt.sha256 -in receipt.digicert.tsr \
  -CAfile /etc/ssl/certs/ca-certificates.crt
curl -sO https://blog.itys.net/freetsa-cacert.pem
openssl ts -verify -data receipt.sha256 -in receipt.freetsa.tsr -CAfile freetsa-cacert.pem
ots verify -f receipt.sha256 receipt.ots

Everything is also kept with parity data in an archive with object lock, so a flipped bit on a disk can be found and repaired rather than silently published.

The archive

Nothing that was here before has been deleted. It moved into two volumes, each frozen as it was published. Their posts were first fingerprinted on 2026-09-28, which proves they have not changed since then, but not when they were written. Volume 1 holds the talks from 2010 to 2018. Volume 2 holds the writing from 2022 to 2025. Old links redirect to the right volume.

Contact

Mail reaches me at social@mjh.email. Signal: mjh.42.