| 1 | Apr 16, '25 | Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google's infrastructure, and given their refu | 449× | 5.8M | 34k | 6k | 16k |
| 2 | Nov 16, '23 | An Open Letter RE: Blockchain Domain Name Patents Since its founding in 2017, ENS has been a consistent and outspoken advocate of open source, open standards, and the importance of | 55.6× | 722k | 1.6k | 497 | 208 |
| 3 | Apr 16, '25 | The first thing to note is that this is a valid, signed email - it really was sent from no-reply@google.com. It passes the DKIM signature check, and GMail displays it without any w | 29.7× | 386k | 3.6k | 153 | 266 |
| 4 | Apr 16, '25 | The Sites link takes you to a very convincing "support portal" page. They've cleverly used because they know people will see the domain is and assume it's legit. | 28.8× | 374k | 3.1k | 114 | 158 |
| 5 | Apr 16, '25 | Clicking on "Upload additional documents" or "View case" takes you to a signin page - again an exact duplicate of the real thing; the only hint it's a phish is that it's hosted on | 27.1× | 352k | 3.4k | 137 | 179 |
| 6 | Apr 16, '25 | From there, presumably, they harvest your login credentials and use them to compromise your account; I haven't gone further to check. So how did they do it - especially the valid e | 25.6× | 332k | 3.7k | 130 | 125 |
| 7 | Apr 16, '25 | The fake portal is fairly straightforward. is a legacy product from before Google got serious about security; it allows users to host content on a subdomain, and crucially it suppo | 24.9× | 324k | 3.5k | 127 | 181 |
| 8 | Apr 16, '25 | Obviously this makes building a credential harvesting site trivial; they simply have to be prepared to upload new versions as old ones get taken down by Google's abuse team. It hel | 23.8× | 310k | 2.3k | 64 | 48 |
| 9 | Apr 16, '25 | Google long ago realised that hosting public, user-specified content on is a bad idea, but Google Sites has stuck around. IMO they need to disable scrips and arbitrary embeds in Si | 22.7× | 295k | 2.8k | 83 | 71 |
| 10 | Mar 29, '20 | I'm a "senior developer". I helped launch Google App Engine and spent 4 years teaching others to use it. I wrote parts of the SDK that are still in use today. I just googled "App E | 22.6× | 0 | 6.4k | 1.4k | 151 |
| 11 | Apr 16, '25 | The email is much more sophisticated, and in my opinion much more obviously a security issue on Google's part. The first clues are in the email header: although it was signed by , | 21.9× | 284k | 2.5k | 119 | 191 |
| 12 | Apr 16, '25 | The second clue is here: below the phishing message is a lot of whitespace (mostly not shown) followed by "Google Legal Support was granted access to your Google Account" and the o | 18.9× | 245k | 1.7k | 46 | 63 |
| 13 | May 26, '24 | Apparently all it takes for people to vote for a seditionist and traitor is a little pandering on the campaign trail. | 17.9× | 233k | 839 | 50 | 38 |
| 14 | Apr 16, '25 | Here's how it works: First, they register a domain and create a Google account for 'me@domain'. The domain isn't that important but it helps if looks like some kind of infra. The c | 17.7× | 230k | 1.7k | 41 | 118 |
| 15 | Apr 16, '25 | Next, they create a Google OAuth application. For the name of the application, they enter *the entire text of the Phishing message* - newlines and all - followed by a lot of whites | 17.5× | 228k | 1.6k | 49 | 86 |
| 16 | Dec 15, '23 | Okay, so it's clear @Ledger has learned nothing about opsec from multiple breaches. At this point I don't think anyone should in good conscience recommend their hardware or use the | 16.7× | 217k | 714 | 86 | 37 |
| 17 | Apr 16, '25 | Now they grant their OAuth app access to their 'me@...' Google account. This generates a 'Security Alert' message from Google, sent to their 'me@...' email address. Since Google ge | 15.7× | 204k | 1.7k | 47 | 86 |
| 18 | Apr 16, '25 | I've submitted a bug report to Google about this; unfortunately they closed it as 'Working as Intended' and explained that they don't consider it a security bug. Obviously I disagr | 15.2× | 197k | 4.7k | 167 | 227 |
| 19 | Apr 16, '25 | Finally, they forward the message to their victims. Because DKIM only verifies the message and its headers and not the envelope, the message passes signature validation and shows u | 14.9× | 194k | 1.9k | 54 | 81 |
| 20 | Mar 15, '25 | Had to happen at some point: people trying to use the ledger database leak as extortion material. Don't fall for it. | 14.8× | 192k | 679 | 57 | 173 |
| 21 | Apr 16, '25 | Because they named their Google account 'me@', GMail shows the message was sent to 'me' at the top, which is the shorthand it uses when a message is addressed to your email address | 14.2× | 185k | 2k | 42 | 64 |
| 22 | Feb 7, '22 | True Names Limited (TNL), the nonprofit that funds and organises development on @ensdomains, has terminated the contract of Brantly Millegan effective today. | 13× | 0 | 2.3k | 312 | 188 |
| 23 | Jun 7, '23 | So excited that this is now public: .box will be the first Blockchain native DNS-routable TLD, and it's enabled via ENS! All registrations and transfers will be onchain, and the ow | 12.2× | 159k | 670 | 145 | 99 |
| 24 | May 2, '22 | View post on X | 11.6× | 0 | 4k | 288 | 32 |
| 25 | Nov 8, '21 | When I started ENS as a side-project at the Ethereum Foundation back in 2016, I never imagined it would be as successful and widely used as it is today - and we're only just gettin | 10.7× | 0 | 3.6k | 303 | 106 |
| 26 | Dec 15, '23 | Truly the end of an era. Here's the message I just sent to the ENS root keyholders, requesting the transfer of the last of their powers to the DAO. Thank you so much @jasoncarver @ | 10.2× | 132k | 656 | 111 | 22 |
| 27 | Apr 16, '25 | Turns out easydmarc have a good writeup on this attack too: | 9.7× | 127k | 2.2k | 157 | 598 |
| 28 | Nov 20, '23 | A primer on .eth and the DNS root We're frequently asked about the possibility of getting .eth added to the DNS root, so it would resolve in all browsers natively. Many will be awa | 9.7× | 125k | 548 | 120 | 190 |
| 29 | Apr 16, '25 | Absolutely loving the 5% of replies to this that are straight out of r/iamverysmart. Keep them coming! | 8.9× | 116k | 1.6k | 12 | 41 |
| 30 | Jul 25, '23 | Unpopular opinion: truly decentralised, trustless Sybil resistance or proof of humanity is impossible. We should stop trying to make it work, and instead focus on building systems | 8.3× | 108k | 653 | 96 | 41 |
| 31 | Apr 16, '25 | Outstanding news: Google has reconsidered and will be fixing the oauth bug! | 7.7× | 100k | 4.4k | 112 | 115 |
| 32 | Dec 19, '23 | It's done! Control over the ENS root has now officially been transferred to the DAO. I'm so proud to be able to claim that ENS is, in its entirety, effectively decentralized. | 6.8× | 89k | 708 | 149 | 34 |
| 33 | Jan 29, '24 | Gasless DNSSEC is now live on Ethereum mainnet! Now that the code is deployed, it needs to be enabled on a per-TLD basis. I'm running the script to do this now, but with nearly 150 | 6.6× | 86k | 455 | 114 | 60 |
| 34 | Apr 16, '25 | @MosheMalawach The easy solution here is to limit OAuth application names - don't allow newlines or URIs, and limit them to something reasonable (say, 50 characters). | 4.7× | 61k | 790 | 5 | 17 |
| 35 | Feb 6, '22 | From @BrantlyMillegan on the @ensdomains Discord: | 4.5× | 0 | 1.1k | 108 | 57 |
| 36 | Nov 28, '22 | Let's try this again: I've generated a random 12-word seedphrase, and sent 0.5 ETH to it. Then, I used it to generate these images with Midjourney v4. If you can guess the seedphra | 4.4× | 0 | 1k | 134 | 161 |
| 37 | Jun 2, '21 | Wait, what? | 4.3× | 0 | 1.2k | 154 | 43 |
| 38 | Aug 21, '23 | Being into crypto and not liking speculation is like being into gardening and not liking weeds. | 4.3× | 56k | 364 | 29 | 8 |
| 39 | May 4, '23 | Incredible to think @ensdomains is 6 years old today. Going from a personal project to one of the largest projects and DAOs in the space, and one of the only that's self-sustaining | 3.7× | 48k | 588 | 112 | 15 |
| 40 | Dec 4, '23 | I think that projects that are VC funded should not qualify for RPGF funding. Once you accept VC dollars, with their implicit expectation of a financial return, you're not a public | 3.6× | 47k | 461 | 49 | 14 |
| 41 | Mar 28, '23 | The NameWrapper, and new versions of the PublicResolver, ETHRegistrarController, and ReverseRegistrar have all been deployed to mainnet. Addresses of these new contracts can be fou | 3.6× | 47k | 319 | 110 | 11 |
| 42 | Apr 16, '25 | @LefterisJP I did. A friend still working there was able to get it escalated to reopen it (it was initiall denied as 'not reproduceable'), but then it was closed again, based I thi | 3.6× | 47k | 857 | 4 | 9 |
| 43 | Nov 22, '21 | I hear people are interested in buying the constitution? | 3.5× | 0 | 1.1k | 125 | 27 |
| 44 | Nov 3, '21 | Recently we were made aware of a cluster of accounts that appeared to be designed to farm the @ensdomains $ENS token airdrop. We've taken a close look at the accounts, and consider | 3.5× | 0 | 915 | 133 | 55 |
| 45 | Nov 1, '21 | I've spent the past ~5 years building ENS, and it feels like it's all been leading up to today. I couldn't be happier that ENS is taking its next big step towards decentralisation: | 3.5× | 0 | 1.1k | 97 | 31 |
| 46 | Aug 13, '21 | Frances tried to block me again, but I was offline so it didn't work. | 3.2× | 0 | 1.2k | 46 | 2 |
| 47 | Nov 20, '23 | You didn't *really* think I'd forget to renew it, did you? | 2.9× | 38k | 316 | 22 | 4 |
| 48 | Nov 7, '21 | I've published the repo with the @ensdomains governance contracts and the (final) airdrop merkle tree. If you're curious what your total is, you can search for your address in the | 2.9× | 0 | 691 | 111 | 80 |
| 49 | Jul 27, '22 | Waking up to discover that VCs value a for-profit competitor to ENS with a fraction of the reach and no real utility at a billion dollars and feeling pretty good, really. | 2.7× | 0 | 842 | 94 | 19 |
| 50 | May 4, '22 | The one millionth live ENS name just got registered! Congratulations to winnersclub.eth. | 2.7× | 0 | 866 | 96 | 5 |
| 51 | Aug 31, '21 | Ever wonder why Ethereum folks seem so positively disposed towards Polygon? Also, holy crap. I'm not for sale, but if I was it'd be for a lot more than a one-time payment of $500. | 2.5× | 0 | 665 | 65 | 43 |
| 52 | Nov 29, '21 | A historic moment; the ENS DAO's first proposal, to request transfer of funds and crucial admin controls from the multisig to the DAO, has just passed. All four measures were appro | 2.5× | 0 | 742 | 104 | 22 |
| 53 | Feb 6, '22 | Brantly's statements on gender, sexuality, cis/trans status, etc don’t reflect my views, or True Names Limited’s. | 2.4× | 0 | 814 | 44 | 20 |
| 54 | Mar 5, '24 | ENS is 1% of Ethereum state. 😲 | 2.3× | 30k | 369 | 48 | 21 |
| 55 | May 22, '22 | May is now an All Time High for every single ENS metric we track - registrations, renewals, revenue (ETH & USD) and income (ETH & USD). And there's still a week of May left | 2.3× | 0 | 493 | 152 | 31 |
| 56 | Apr 10, '20 | Internet, please meet my daughter. | 2.3× | 0 | 833 | 9 | 0 |
| 57 | Nov 16, '23 | In January of this year, Unstoppable Domains was granted its first patent, number US11558344, Resolving Blockchain Domains. This patent is based entirely on innovations that ENS de | 2.1× | 28k | 397 | 41 | 8 |
| 58 | Nov 17, '21 | Did miss the 2x multiplier in the ENS airdrop because the account with a primary name was not the account that owned the name? The DAO is considering whether to send additional tok | 2.1× | 0 | 470 | 70 | 63 |
| 59 | Apr 16, '25 | @Airdrophop1 But it does? | 2.0× | 26k | 336 | 1 | 1 |
| 60 | Nov 28, '22 | I have generated a random 12-word seedphrase, and sent 0.5 ETH to it. Then, I used the seedphrase to generate these images with Midjourney v4. If you can guess the seedphrase, you | 2.0× | 0 | 510 | 60 | 65 |
| 61 | Jan 15, '22 | Applying a code of conduct retroactively to someone's past statements that were unrelated to the organisation - and in fact were made before the organisation even existed - seems l | 2.0× | 0 | 462 | 34 | 21 |
| 62 | Nov 16, '23 | Failing that, ENS Labs stands ready to challenge this patent, which we believe is entirely derivative of our own inventions; a position we are able and willing to demonstrate. | 1.9× | 25k | 367 | 18 | 2 |
| 63 | Feb 8, '22 | EIP 3668, AKA CCIP Read, the core component of ENS's L2 support and a vital primitive for fetching offchain data, is now Final! 🎉🎉🎉 | 1.9× | 0 | 515 | 98 | 25 |
| 64 | Nov 16, '21 | Snapshot have given me a final count: 84,350 ethereum accounts signed the ENS constitution! | 1.9× | 0 | 666 | 38 | 6 |
| 65 | Feb 7, '22 | Many of you were hurt by Brantly's comments over the past 24 hours, and we strongly believe that ENS should be an inclusive community. Going forward we'll continue to do everything | 1.8× | 0 | 455 | 10 | 3 |
| 66 | May 3, '22 | Looks like May 2 was another crazy day for ENS. Breaking records again: Highest revenue ($1.95M), most registrations (63k), most registration years (100k). | 1.7× | 0 | 448 | 96 | 8 |
| 67 | Sep 7, '21 | Today I accidentally burned the first ENS name ever registered. A short 🧵. | 1.7× | 0 | 382 | 64 | 45 |
| 68 | Dec 21, '21 | One big issue with ENS's DNS integration right now is that it requires a *lot* of gas to claim your ENS name. RSA signatures cost ~90k - 160k gas to verify, while ECDSA sigs cost ~ | 1.6× | 0 | 465 | 43 | 45 |
| 69 | Nov 9, '21 | Now that claims are open for $ENS at , everyone claiming will need to choose a delegate, who will vote on their behalf on DAO decisions. There's a dizzying array of candidates - ov | 1.6× | 0 | 343 | 67 | 66 |
| 70 | Jan 22, '22 | Did I miss something? Why is everyone suddenly 100% convinced we're in a bear market? | 1.5× | 0 | 471 | 19 | 7 |
| 71 | Nov 16, '23 | For transparency, we're also publishing our communications with UD on this matter, attached here. | 1.5× | 19k | 350 | 24 | 11 |
| 72 | May 13, '21 | I feel like we take @etherscan for granted so much of the time. The level of detail it grants to transaction data is invaluable; I don't know what I'd do without it. | 1.5× | 0 | 552 | 27 | 2 |
| 73 | Nov 10, '21 | Show me your best ENS memes! | 1.4× | 0 | 370 | 24 | 9 |
| 74 | May 16, '21 | I've found that a useful metric in life is to assume that when someone is deeply, obviously wrong about something you know well, it's safest to assume they're similarly wrong about | 1.4× | 0 | 478 | 46 | 9 |
| 75 | Nov 25, '22 | If you feel entitled to tell me I should avoid speaking my mind because you're worried it will hurt your bags, I kindly invite you to fuck off into the sun. | 1.4× | 0 | 388 | 40 | 2 |
| 76 | Jan 31, '22 | Neil Gaiman just announced he was raffling off an NFT to benefit a humanitarian charity, and the pushback from fans was so loud he deleted the tweet. People would literally rather | 1.4× | 0 | 385 | 42 | 7 |
| 77 | Nov 3, '21 | So we've decided to go with option 4. The 784 accounts we've identified from that cluster have been added to a blacklist, and the airdrop totals will be recalculated without those | 1.4× | 0 | 468 | 27 | 2 |
| 78 | Apr 29, '22 | As of now, ENS now uses an exponential curve for premium pricing for recently expired names. Anyone want to spend $97.2M on structures.eth? | 1.4× | 0 | 355 | 41 | 10 |
| 79 | Jan 19, '22 | I'm delighted to announce the release of the first version of @ensdomains' toolkit for supporting offchain resolution of ENS names. | 1.4× | 0 | 343 | 77 | 20 |
| 80 | Jan 10, '22 | If you tag me in a "retweet and tag x friends" post, I *will* block you, no ifs buts or maybes. | 1.4× | 0 | 367 | 13 | 0 |
| 81 | Feb 6, '22 | I’ve been working with Brantly for a number of years now, and I’ve never seen Brantly treat anyone as different or lesser because of who they are. | 1.4× | 0 | 436 | 21 | 3 |
| 82 | Dec 22, '17 | I quite like Bitcoin Cash: It's given Bitcoiners something to irrationally hate instead of Ethereum. | 1.4× | 0 | 423 | 69 | 0 |
| 83 | Nov 28, '21 | What's the wrongest you've been about something in crypto? I thought punks were kind of fun, but not really worth the gas and time to claim them, because people would have forgotte | 1.3× | 0 | 338 | 13 | 10 |
| 84 | May 27, '21 | Today, @ensdomains took a giant leap forward in decentralisation. | 1.3× | 0 | 369 | 75 | 15 |
| 85 | Nov 25, '21 | I've put together an ENS dashboard, which tracks a number of interesting metrics for ENS adoption: - Registrations and renewals. - Active .eth names. - Revenue and income from name | 1.3× | 0 | 317 | 51 | 55 |
| 86 | Aug 24, '22 | The ENS team has such cool stuff planned for DevCon this year. Just wait 'til you see it. | 1.2× | 0 | 369 | 40 | 6 |
| 87 | Jun 2, '21 | I mean, I know you've been giving it away for free, but now you're selling it too? | 1.2× | 0 | 477 | 8 | 0 |
| 88 | Jun 2, '22 | Today I learned that I'm now popular enough that I'm not allowed to have opinions about stuff. | 1.2× | 0 | 361 | 10 | 4 |
| 89 | Aug 24, '21 | Unpopular take: I regret not getting a fidenza much more than a punk because many of the fidenzas are legitimately really pretty artwork. The 8 bit aesthetic is fun, but I wouldn't | 1.1× | 0 | 390 | 14 | 5 |
| 90 | Oct 18, '19 | I couldn't be happier to announce that we're now expecting our first child, a girl, due late April 2020. | 1.1× | 0 | 419 | 5 | 1 |
| 91 | May 11, '22 | I want to give an ENS constitution 📘 token to @VitalikButerin, but he's not answering my DMs. Vitalik, do you want a beautiful numbered copy of the most important constitution in | 1.1× | 0 | 344 | 33 | 5 |
| 92 | Sep 27, '21 | Devastated to hear about Virgil pleading guilty. The title of this talk at that conference was "blockchain and peace". His ambition was to use ethereum to make peace between North | 1.1× | 0 | 344 | 51 | 4 |
| 93 | Feb 13, '22 | I know there's a labour shortage, but this is ridiculous. | 1.1× | 0 | 403 | 22 | 1 |
| 94 | Apr 25, '22 | Holy shit. | 1.1× | 0 | 347 | 43 | 2 |
| 95 | May 12, '22 | Don't forget, every 3 letter ENS name is also a Maker variable name. | 1.1× | 0 | 335 | 24 | 4 |
| 96 | Nov 22, '21 | I've mostly been staying out of this fight, but "I'm not an insider, I only bought tokens at an 80% discount" is a pretty ridiculous take. | 1.1× | 0 | 366 | 12 | 19 |
| 97 | Dec 14, '21 | I honestly thought this was parody at first. | 1.0× | 0 | 330 | 16 | 7 |
| 98 | Feb 7, '22 | Brantly has been a valued team member of TNL for the past three years. However, as a team we felt that his position with TNL is no longer tenable. | 0.9× | 0 | 341 | 6 | 1 |
| 99 | Nov 12, '22 | Just proposed my first block as an eth 2 validator! 🎉 | 0.8× | 0 | 329 | 5 | 0 |
| 100 | Aug 21, '22 | Today was just me and my daughter for most of the day. We: - Went through a car wash - a first for her - Went to a toy museum - Went to a playground - Tried to feed ducks - Visited | 0.8× | 0 | 332 | 3 | 2 |
@karpathy
@levelsio
@paulg
@naval
@marclou
@illyism