Research Backlog
Candidates being researched before they earn an article. Nothing in this
file is published content — it exists so nobody skips validation and turns
a seed name into an unsourced page.
Status values
TODO— name identified, no research done yet.RESEARCHING— actively gathering sources.VERIFIED— identity and core facts confirmed by reliable sources.ARTICLE_READY— verified and enough material for a full page per the
structure in templates/person.json.
PUBLISHED— article is live.
How to use this file
- Add a candidate row with what you're trying to confirm and why they
matter.
- Move status forward only when you actually did the work (found sources,
confirmed identity, resolved ambiguity).
- Never jump straight to
PUBLISHED— if there's noVERIFIEDstep behind
it, the article shouldn't exist yet.
- Link sources you've already found in the "Potential Sources" column even
at TODO/RESEARCHING stage — half-done research is still useful to the
next contributor.
Candidates
| Candidate | Reason | Area | Potential Sources | Status |
|---|---|---|---|---|
| Dan Kaminsky | 2008 DNS cache poisoning vulnerability, major internet infra impact | DNS / Network Security | See data/people/dan-kaminsky.json | PUBLISHED |
| Joanna Rutkowska | Blue Pill, Qubes OS, virtualization security research | Virtualization / OS Security | See data/people/joanna-rutkowska.json | PUBLISHED |
| HD Moore | Metasploit Framework creator, standalone personal biography | Exploit Development | See data/people/hd-moore.json | PUBLISHED |
| Katie Moussouris | Bug bounty program pioneer (Microsoft, Pentagon) | Bug Bounty / Vulnerability Disclosure | See data/people/katie-moussouris.json | PUBLISHED |
| Mudge (Peiter Zatko) | L0pht, Senate testimony, DARPA Cyber Fast Track, Twitter whistleblower | Vulnerability Research / Policy | See data/people/mudge-peiter-zatko.json | PUBLISHED |
| Solar Designer (Alexander Peslyak) | John the Ripper, Openwall, standalone personal biography | Password Security / Open Source Tools | See data/people/solar-designer.json | PUBLISHED |
| Robert Tappan Morris | Morris Worm author, standalone personal biography | Internet History / CFAA | See data/people/robert-tappan-morris.json | PUBLISHED |
| Tsutomu Shimomura | Tracked Kevin Mitnick, standalone personal biography | Internet History / Incident Response | See data/people/tsutomu-shimomura.json | PUBLISHED |
| Halvar Flake | Binary analysis / reverse engineering, zynamics/BinDiff, Rowhammer | Reverse Engineering | See data/people/halvar-flake.json | PUBLISHED |
| Charlie Miller | iPhone/Pwn2Own research, Jeep Cherokee remote hack (2015) with Chris Valasek | Exploit Development / Automotive Security | See data/people/charlie-miller.json | PUBLISHED |
| Chris Valasek | Jeep Cherokee remote hack (2015) with Charlie Miller | Automotive Security | See data/people/chris-valasek.json | PUBLISHED |
| Samy Kamkar | MySpace "Samy" worm (2005), later hardware/RF security research | Web Security / Hardware Hacking | See data/people/samy-kamkar.json | PUBLISHED |
| Barnaby Jack | ATM jackpotting, medical device security research | Hardware Hacking / Embedded Security | See data/people/barnaby-jack.json | PUBLISHED |
| Bruce Schneier | Cryptographer, security author, public-interest security policy commentary | Cryptography / Policy | See data/people/bruce-schneier.json | PUBLISHED |
Explicitly out of scope until validated
Any name listed only in a planning/prompt document (including this
project's own master instructions) is a lead, not a fact of notability.
Confirm the person exists as a distinct, documented individual, with
sufficient reliable material, before promoting past TODO.
Expansion roadmap (queued candidates, not yet researched)
Goal: grow toward a much larger, still fully-verified archive, with
deliberate coverage across the United States, Europe, and Asia (Latin
America to follow in a later pass; Brazil specifically deferred for now
per maintainer note). Everything below is TODO — a name here is a
research lead, not a claim. Each one needs the same WebSearch-backed
verification pass as the published entries before it gets an article. Do
not use this list to justify skipping verification.
People — United States
| Candidate | Reason | Area | Status |
|---|---|---|---|
| Alex Stamos | Former Yahoo/Facebook CSO, election-security and disinformation research | Security Leadership / Policy | See data/people/alex-stamos.json — PUBLISHED |
| Window Snyder | Security architecture at Microsoft, Mozilla, Apple, Intel; co-author "Threat Modeling" | Security Engineering | See data/people/window-snyder.json — PUBLISHED |
| Chris Wysopal | @stake co-founder, L0pht member, Veracode co-founder | Application Security | See data/people/chris-wysopal.json — PUBLISHED |
| Marc Maiffret | eEye Digital Security co-founder, Code Red worm analysis | Vulnerability Research | See data/people/marc-maiffret.json — PUBLISHED |
| Jeff Moss ("The Dark Tangent") | DEF CON/Black Hat founder, ICANN CSO, DHS Advisory Council | Conferences / Policy | See data/people/jeff-moss.json — PUBLISHED |
| Elias Levy ("Aleph One") | "Smashing the Stack for Fun and Profit," Bugtraq moderator | Exploit Development | See data/people/elias-levy.json — PUBLISHED |
| Dave Aitel | Immunity Inc. founder, former NSA, CANVAS/SPIKE | Exploit Development | See data/people/dave-aitel.json — PUBLISHED |
| Dino Dai Zovi | Early Mac OS X exploitation research, first Pwn2Own win (2007) | Exploit Development | See data/people/dino-dai-zovi.json — PUBLISHED |
| Natalie Silvanovich | Google Project Zero, zero-click iMessage/messaging-app vulnerability research | Vulnerability Research | See data/people/natalie-silvanovich.json — PUBLISHED |
| James Forshaw | Google Project Zero, Windows security research, "Attacking Network Protocols" author | Vulnerability Research | See data/people/james-forshaw.json — PUBLISHED |
| Tavis Ormandy | Google Project Zero founding member, Cloudbleed, Zenbleed | Vulnerability Research | See data/people/tavis-ormandy.json — PUBLISHED |
| Jeremiah Grossman | WhiteHat Security founder, web application security research | Web Security | See data/people/jeremiah-grossman.json — PUBLISHED |
| Robert Hansen ("RSnake") | XSS research, ha.ckers.org, clickjacking, Slowloris | Web Security | See data/people/robert-hansen.json — PUBLISHED |
| Marcus Ranum | Early firewall design (DEC SEAL, TIS), intrusion detection research | Network Security | See data/people/marcus-ranum.json — PUBLISHED |
| Brian Krebs | Investigative security journalist, Krebs on Security, Mirai/vDOS reporting | Threat Research / Journalism | See data/people/brian-krebs.json — PUBLISHED |
| Jon Erickson | Author of "Hacking: The Art of Exploitation" | Exploit Development | See data/publications/hacking-art-of-exploitation.json (published as a publication entry — too little independently verifiable biographical detail beyond the book itself) — PUBLISHED |
| Jennifer Granick | Security/privacy lawyer, EFF, Stanford, defended Aaron Swartz | Policy / Law | See data/people/jennifer-granick.json — PUBLISHED |
| Moxie Marlinspike | SSLstrip, Signal Protocol, Signal Messenger founder | Cryptography / Privacy | See data/people/moxie-marlinspike.json — PUBLISHED |
| Nate Cardozo | EFF security/privacy attorney | Policy / Law | See data/people/nate-cardozo.json — PUBLISHED |
| Runa Sandvik | Tor Project, TrackingPoint smart-rifle hack, journalist-security work at NYT | Privacy / Anonymity | See data/people/runa-sandvik.json — PUBLISHED |
| Kevin Mahaffey | Lookout Mobile Security co-founder | Mobile Security | See data/people/kevin-mahaffey.json — PUBLISHED |
| Zach Lanier | Mobile/IoT security research | Mobile / IoT Security | See data/people/zach-lanier.json — PUBLISHED |
| Kymberlee Price | Vulnerability coordination / bug bounty program leadership | Bug Bounty | See data/people/kymberlee-price.json — PUBLISHED |
| Casey Ellis | Bugcrowd founder, disclose.io co-founder | Bug Bounty | See data/people/casey-ellis.json — PUBLISHED |
| Alex Rice | HackerOne co-founder | Bug Bounty | See data/people/alex-rice.json — PUBLISHED |
| Michael "Mudge" Zatko | Already published — cross-link only | (published) | PUBLISHED |
| Gordon "Fyodor" Lyon | Nmap creator, standalone person page | Network Security Tools | See data/people/gordon-lyon.json — PUBLISHED |
| Marcus Hutchins | Already published — cross-link only | (published) | PUBLISHED |
| Edward Snowden | 2013 NSA mass-surveillance disclosures, former CIA/NSA contractor | Whistleblowing / Surveillance Policy | See data/people/edward-snowden.json — PUBLISHED |
| Julian Assange | Teenage hacker 'Mendax', WikiLeaks founder, Espionage Act case (standalone person page; org history remains in the group entry) | Whistleblowing / Press Freedom | See data/people/julian-assange.json — PUBLISHED |
| Linus Torvalds | Creator of the Linux kernel and Git | Open Source / OS History | See data/people/linus-torvalds.json — PUBLISHED |
| Eric Corley ("Emmanuel Goldstein") | 2600 founder, Off The Hook radio, HOPE conference, DeCSS DMCA case (standalone person page; magazine history remains in the publication entry) | Hacker Culture / Media | See data/people/eric-corley.json — PUBLISHED |
| John Draper ("Captain Crunch") | 2600 Hz whistle discovery, blue box phreaking, EasyWriter, Apple connection | Phreaking History | See data/people/john-draper.json — PUBLISHED |
| Kevin Poulsen | 'Dark Dante', KIIS-FM Porsche hack, Wired journalist, Manning/Lamo story, SecureDrop | Phreaking / Journalism | See data/people/kevin-poulsen.json — PUBLISHED |
| the Grugq | Pseudonymous anti-forensics researcher, reported exploit broker, OPSEC commentator | Anti-Forensics / OPSEC | See data/people/the-grugq.json — PUBLISHED |
People — Europe
| Candidate | Reason | Area / Country | Status |
|---|---|---|---|
| Mikko Hyppönen | F-Secure/WithSecure malware research, Brain virus author tracking | Malware Research / Finland | See data/people/mikko-hypponen.json — PUBLISHED |
| Karsten Nohl | GSM A5/1 cracking, MIFARE RFID, BadUSB, Security Research Labs founder | Telecom / Wireless / Germany | See data/people/karsten-nohl.json — PUBLISHED |
| Ross Anderson | "Security Engineering" author, Cambridge academic security research, d. 2024 | Academic Security / UK | See data/people/ross-anderson.json — PUBLISHED |
| Michal Zalewski ("lcamtuf") | "Silence on the Wire," afl fuzzer, long Google security research career | Fuzzing / Poland | See data/people/michal-zalewski.json — PUBLISHED |
| Ralf-Philipp Weinmann | GSM baseband exploitation, mobile security research | Mobile Security / Germany-Luxembourg | See data/people/ralf-philipp-weinmann.json — PUBLISHED |
| Adam Laurie | RFID/Bluetooth security research (Bluejacking-era work), DEF CON | Wireless / UK | See data/people/adam-laurie.json — PUBLISHED |
| Felix "FX" Lindner | Phenoelit, router/embedded exploitation research | Embedded Security / Germany | PUBLISHED — see data/people/felix-fx-lindner.json |
| Jan "Starbug" Krissler | Biometric spoofing research (Touch ID, iris, fingerprint reconstruction from photos) | Biometrics / Germany | See data/people/jan-krissler.json — PUBLISHED |
| Frank Rieger | CCC spokesperson, security commentary | Policy / Germany | See data/people/frank-rieger.json — PUBLISHED |
| James Kettle | Burp Suite research lead, HTTP request smuggling/desync research | Web Security / UK | See data/people/james-kettle.json — PUBLISHED |
| PortSwigger (Dafydd Stuttard) | Burp Suite creator | Tool Creator / UK | See data/people/dafydd-stuttard.json — PUBLISHED |
People — Asia
Note: verify exact romanization/spelling and identity carefully before
promoting any of these past TODO — several are known primarily by
handle, and getting a name wrong is worse than not publishing.
| Candidate | Reason | Area / Country | Status |
|---|---|---|---|
| Orange Tsai | DEVCORE researcher, ProxyLogon/ProxyShell Exchange Server disclosures, Pwn2Own record | Web Security / Taiwan | See data/people/orange-tsai.json — PUBLISHED |
| HITCON community founders | Taiwan's long-running hacker conference — verify as a group, not individuals, unless a specific founder is clearly documented | Conferences / Taiwan | See data/groups/hitcon.json — PUBLISHED (no single founder consistently documented; published as a group/organization entry per this row's own guidance) |
Groups
| Candidate | Reason | Region |
|---|---|---|
| LulzSec | High-profile 2011 hacktivist/breach spree, offshoot of Anonymous | International — See data/groups/lulzsec.json — PUBLISHED |
| Legion of Doom | Already published — cross-link only | (published) |
| Phone Losers of America | Long-running phreaking/prank-call community | US — See data/groups/phone-losers-of-america.json — PUBLISHED |
| Cypherpunks mailing list | Origin of much of modern privacy-cryptography culture and rhetoric | International — See data/groups/cypherpunks-mailing-list.json — PUBLISHED |
| Project Zero (Google) | Verify framing as a "group" entry distinct from individual researcher pages | US — See data/groups/project-zero.json — PUBLISHED |
| Keen Security Lab | Automotive/mobile vulnerability research team | China — See data/groups/keen-security-lab.json — PUBLISHED |
| DEVCORE | Web security research firm (Orange Tsai's team) | Taiwan — See data/groups/devcore.json — PUBLISHED |
| ShadowCrew | Early-2000s carding/identity-fraud forum, notable for the resulting Secret Service operation | US — See data/groups/shadowcrew.json — PUBLISHED |
Tools (9 published: Nmap, Wireshark, Metasploit, John the Ripper, Burp Suite, Ghidra, Mimikatz, BloodHound, IDA Pro)
| Candidate | Reason | Status |
|---|---|---|
| Burp Suite | Dominant web-app pentesting proxy/scanner | See data/tools/burp-suite.json — PUBLISHED |
| Ghidra | NSA-released reverse-engineering suite | See data/tools/ghidra.json — PUBLISHED |
| Mimikatz | Windows credential-extraction tool, huge impact on AD security practice | See data/tools/mimikatz.json — PUBLISHED |
| BloodHound | Active Directory attack-path analysis | See data/tools/bloodhound.json — PUBLISHED |
| IDA Pro | Long-standing commercial disassembler/decompiler standard | See data/tools/ida-pro.json — PUBLISHED |
| radare2 | Open-source reverse-engineering framework | See data/tools/radare2.json — PUBLISHED |
| Frida | Dynamic instrumentation toolkit | See data/tools/frida.json — PUBLISHED |
| Hashcat | GPU-accelerated password recovery | See data/tools/hashcat.json — PUBLISHED |
| Aircrack-ng | Wi-Fi security auditing suite | See data/tools/aircrack-ng.json — PUBLISHED |
| sqlmap | Automated SQL injection tool | See data/tools/sqlmap.json — PUBLISHED |
| Snort | Open-source intrusion detection, Sourcefire origin | See data/tools/snort.json — PUBLISHED |
| Nessus | Vulnerability scanner, pre-dates and shaped the commercial scanner market | See data/tools/nessus.json — PUBLISHED |
| Cobalt Strike | Red-team/adversary-simulation platform, also widely abused by real attackers — needs careful dual-use framing | See data/tools/cobalt-strike.json — PUBLISHED |
| Volatility | Memory forensics framework | See data/tools/volatility.json — PUBLISHED |
| YARA | Malware pattern-matching/classification tool | See data/tools/yara.json — PUBLISHED |
| Kali Linux / BackTrack | Penetration-testing Linux distribution lineage | See data/tools/kali-linux.json — PUBLISHED |
Publications (beyond the 3 already published: Phrack, 2600, the Hacker Manifesto)
| Candidate | Reason |
|---|---|
| Bugtraq (mailing list) | Foundational full-disclosure vulnerability mailing list — See data/publications/bugtraq.json — PUBLISHED |
| Full Disclosure (mailing list) | Successor-era full-disclosure list after Bugtraq's moderation changes — See data/publications/full-disclosure-mailing-list.json — PUBLISHED |
| Packet Storm | Long-running exploit/advisory archive — See data/publications/packet-storm-security.json — PUBLISHED |
| Uninformed | Early-2000s technical exploitation-research ezine — See data/publications/uninformed.json — PUBLISHED |
| Die Datenschleuder | CCC's long-running print magazine, Germany — See data/publications/die-datenschleuder.json — PUBLISHED |
Events / Discoveries (beyond Morris Worm, DEF CON founding, MIT/TMRC hacker ethic already published)
| Candidate | Reason |
|---|---|
| Heartbleed (2014) | OpenSSL memory-disclosure bug, massive internet-wide patch effort — See data/vulnerabilities/heartbleed.json — PUBLISHED |
| Shellshock (2014) | Bash environment-variable injection vulnerability — See data/vulnerabilities/shellshock.json — PUBLISHED |
| Stagefright (2015) | Android media-parsing remote-exploitation research — See data/vulnerabilities/stagefright.json — PUBLISHED |
| KRACK (2017) | WPA2 Wi-Fi handshake vulnerability — See data/vulnerabilities/krack.json — PUBLISHED |
| Spectre / Meltdown (2018) | CPU speculative-execution vulnerability class — See data/vulnerabilities/spectre-meltdown.json — PUBLISHED |
| EternalBlue / WannaCry (2017) | NSA-linked SMB exploit and the resulting global ransomware outbreak (cross-link to the already-published Marcus Hutchins page) — See data/vulnerabilities/eternalblue.json — PUBLISHED |
| NotPetya (2017) | Destructive wiper disguised as ransomware, major supply-chain/geopolitical incident — See data/attacks/notpetya.json — PUBLISHED |
| Equifax breach (2017) | Large-scale consumer-data breach, Apache Struts vulnerability — See data/attacks/equifax-breach.json — PUBLISHED |
| SolarWinds / Sunburst (2020) | Major software supply-chain compromise — See data/attacks/solarwinds-sunburst.json — PUBLISHED |
| Log4Shell (2021) | Log4j remote-code-execution vulnerability, internet-wide impact — See data/vulnerabilities/log4shell.json — PUBLISHED |
Latin America (excluding Brazil for now, per maintainer note)
Genuinely under-covered region; extra care required per SOURCES.md — do
not add a name just to fill a country slot.
| Candidate | Reason | Country | Status |
|---|---|---|---|
| Cesar Cerrudo | IOActive Labs CTO, SQL Server/Windows research, smart-city/traffic-control vulnerability research | Argentina | See data/people/cesar-cerrudo.json — PUBLISHED |
| Nicolas Waisman | Immunity/exploit-development research | Argentina | See data/people/nicolas-waisman.json — PUBLISHED |
| Ekoparty (conference) | Long-running Argentina/LatAm security conference — verify as an event/conference entry | Argentina | See data/events/ekoparty.json — PUBLISHED |
| Andres Riancho | w3af web-app scanner creator | Argentina | See data/people/andres-riancho.json — PUBLISHED |
Oceania / Continental Europe / additional research (self-sourced batch, deliberate regional diversification beyond the original candidate list above)
| Candidate | Reason | Country | Status |
|---|---|---|---|
| Silvio Cesare | Phrack ELF/PLT-infection research, Snort IDS-evasion discovery, InfoSect founder | Australia | See data/people/silvio-cesare.json — PUBLISHED |
| Chris Eagle | "The IDA Pro Book" / "The Ghidra Book" author, DARPA Cyber Grand Challenge, DEF CON CTF (DDTEK) organizer | US | See data/people/chris-eagle.json — PUBLISHED |
| Rain Forest Puppy (rfp) | Early public SQL injection documentation (Phrack, 1998), Whisker scanner, RFPolicy disclosure framework — pseudonymous, real identity unconfirmed/disputed | US | See data/people/rain-forest-puppy.json — PUBLISHED |
| David Litchfield | NGSSoftware co-founder, Oracle/SQL Server vulnerability research, SQL Slammer-linked disclosure, "Shellcoder's Handbook" co-author | UK | See data/people/david-litchfield.json — PUBLISHED |
| Marion Marschalek | Malware reverse engineer (Ikarus, Intel STORM, AWS GuardDuty), BlackHoodie contributor | Austria | See data/people/marion-marschalek.json — PUBLISHED |
| Peter Van Eeckhoutte | Corelan Security Team founder, Corelan Exploit Writing Tutorials, mona.py | Belgium | See data/people/peter-van-eeckhoutte.json — PUBLISHED |
| Renaud Deraison | Nessus creator, Tenable co-founder/CTO (standalone person page; tool history remains in the Nessus tool entry) | France | See data/people/renaud-deraison.json — PUBLISHED |
| Roberto Preatoni | Zone-H founder, WabiSabiLabi co-founder, Telecom Italia "Tiger Team" wiretapping case defendant — legal outcome specific to him not documented, treated as unverified | Italy | See data/people/roberto-preatoni.json — PUBLISHED |
Cryptography and computing foundations (self-sourced batch, closing gaps in foundational figures the site's growth had not yet reached)
| Candidate | Reason | Status |
|---|---|---|
| Philip Zimmermann | PGP creator (1991), target of a 1993-1996 US federal criminal investigation over export-control law | See data/people/philip-zimmermann.json — PUBLISHED |
| Steve Wozniak | Blue-box phone phreaking with Steve Jobs (early 1970s) preceding Apple's founding; entry focuses on the phreaking period, not general Apple history | See data/people/steve-wozniak.json — PUBLISHED |
| Whitfield Diffie and Martin Hellman | 1976 "New Directions in Cryptography" paper, Diffie-Hellman key exchange, 2015 Turing Award — joint entry, an intentional exception to the one-person-per-page norm given their single shared landmark contribution | See data/people/diffie-hellman.json — PUBLISHED |
| Ron Rivest, Adi Shamir, and Leonard Adleman | RSA public-key cryptosystem (1977/1978), 2002 Turing Award — joint/trio entry for the same reason as Diffie-Hellman above | See data/people/rsa-rivest-shamir-adleman.json — PUBLISHED |
| Ken Thompson | Unix co-creator, "Reflections on Trusting Trust" (1984 Turing lecture on compiler backdoors), Go co-designer | See data/people/ken-thompson.json — PUBLISHED |
| Chen Zhaojun | Log4Shell discoverer (already covered in data/vulnerabilities/log4shell.json) — researched but explicitly NOT published as a standalone page; no independently verifiable biographical material exists beyond the single discovery/report already documented there | Not published — insufficient independent biographical material |
| Dan Guido | Trail of Bits co-founder/CEO, Empire Hacking co-founder, exploit-intelligence research, blockchain/DeFi security auditing pivot | See data/people/dan-guido.json — PUBLISHED |
| Loïc Duflot | French DCSSI/ANSSI researcher, x86 System Management Mode (SMM) rootkit research (CanSecWest 2006/2009), VT-x virtualization-escape research | See data/people/loic-duflot.json — PUBLISHED |
Fiction / Pop Culture (separate taxonomy — NOT historical entries)
Per maintainer request, /fiction/ is a deliberately separate section for
fictional hackers and hacker-themed media, kept apart from every real,
sourced entry on the site so nobody mistakes a movie character for a
documented historical figure. Facts here are still sourced (to the actual
film/show/reviews), just not treated as history.
| Work | Reason | Status |
|---|---|---|
| Mr. Robot (TV series) | Elliot Alderson / fsociety; widely cited for unusually realistic hacking depiction | See data/fiction/mr-robot.json — PUBLISHED |
| The Matrix (1999 film) | Neo/Trinity/Morpheus as hackers; major cyberpunk cultural touchstone | See data/fiction/the-matrix.json — PUBLISHED |
| Cyberchase (animated series) | PBS Kids villain "the Hacker" (voiced by Christopher Lloyd) — purely fictional/educational, no technical accuracy claim | See data/fiction/cyberchase.json — PUBLISHED |
| Hackers (1995 film) | Zero Cool/Crash Override, Acid Burn, Cereal Killer, and cult hacker-aesthetic origin | See data/fiction/hackers-1995.json — PUBLISHED |