The Hidden Layer · hunt
S1 · Paratext — Read what the site leaks
A well-run site speaks outside its pages: in HTTP headers, comments, robots.txt, security.txt. First lesson of the trade: read a privacy vendor’s own site the way an adversary would — the paratext first.
Our HTTP responses carry a memorial. Fetch the headers and look for it. It follows a tradition born in a novel about a message-relay network ("a man is not dead while his name is still spoken"). Name the person that tradition honours.
Run this:
curl -sI https://onsecret.net/ | grep -i clacks
What this teaches. Where sites keep things: response headers, HTML comments, robots.txt, security.txt. The meta-lesson: "disallow" ≠ "secret", and a serious site advertises its key (see the Link: rel="pgpkey" header).