🆕 Never Post! Doxxing Yourself For Science

Mike talks to security researchers Jan Pennekamp and Johannes Lohmoller about how many academics are allegedly doxxing themselves in the process of publishing their own research, and why it’s so hard to get sensitive, secretive information off the internet after it lands there. 

–

Tell your pals to take our survey here!

–

• Call us at 651 615 5007 to leave a voicemail
• Drop us a voice memo via airtable
• Or email us at theneverpost at gmail dot com

–

News Links

• Hbo Max introduces shorts 
• Streaming platforms try to beat TikTok at their own game
• France bans social media for teens
• Vietnam proposes social media ban for teens
• Doom is a top influential piece of American culture
• Doom as part of Trump's election strategy
• arxiv.org 

–

Doxxing Yourself For Science 

• Read the paper here
• See Jan and Johannes’ other work here

–


Never Post’s producers are Audrey Evans, Georgia Hampton and The Mysterious Dr. Firstname Lastname. Our senior producer is Hans Buetow. Our executive producer is Jason Oberholtzer. The show’s host is Mike Rugnetta.

Never Post is a production of Charts & Leisure and is distributed by Radiotopia

Friends, hello, and welcome to Never Post, a podcast for and about the Internet. I'm your host, Mike Rugnetta. This intro was written on Tuesday, 07/28/2026 at 08:34PM eastern, and we have a dangling show for you this week. In this episode, I chat with security and privacy researchers Jan Penekamp and Johannes Lomola about the legions of academics potentially doxxing themselves in the process of publishing their own research. It is a wild story of unforced errors, unnecessary technological complexity, and platform complacency.

But first, we're gonna take a quick break. You'll listen to some ads unless you're on the member feed. And when we return, we'll talk about a few of the things that have happened since the last time you heard from us. Never Post, the show you're listening to has some news and we're gonna put it right at the top of the show so you don't miss it. First, we have released oodles of new member content over the last couple weeks.

A team chat about party planning platforms with much part of full slander and its own event invite. You heard about that on the mailbag if you listen to it. We've released also a dramatic reading by myself and Georgia of the legendary Tumblr post, Kurt Cobain will have his revenge on the straights. And most recently, we uploaded Paper Report, the first in an ongoing series where we read and discuss published Internet research. It is a blast.

Those uploads and more, including a slow post and a WIGO from back in May, are all waiting for folks in the member feed right now. Second, Member Drive stream week starts on August 17 at 11AM eastern at twitch.tv/ the never post and it will continue through the rest of the week. We have many of your favorite guests from the extended Never Post universe and more. Joining us throughout the week, got games and live segment recordings, giveaways, and hopefully a bunch of new members so we can keep making this show. A schedule and further details will go out in two weeks, but as of right now, the week of August 17, clear your schedule, cancel your plans, call in sick to work, and finally, we have a survey.

But here's the catch, we don't want you to fill it out. No. Not you. Do not click that link. We would love it if your friends, family, coworkers, folks who do not currently listen to the show could fill it out.

We are working with some of the wonderful folks at Radiotopia to do some audience development research and we wanna hear from some folks who do not know what Never Post is except maybe in passing because you won't stop talking to them about it. We wanna know what they're into. What's their favorite color? What's their ideal date? There's a link in the show notes.

Please text it to your mom, your favorite barista, and the captain of your rival bowling league team. Thank you. Okay. Time for the actual news. Jason, start the tunes.

Keep my feet on the ground, keep my head in the clouds, electrified by the sound. It comes from the six stories this week. HBO Max is launching shorts. Max shorts will apparently consist of clipped segments of longer form entertainment available on the streamer as well as trailers and behind the scenes content according to a press release, which also reads quote, the clips for this feature are powered by an AI tool built in house which helps human editors select and verticalize content by using machine learning algorithms that utilize scene level metadata to comb through thousands of hours of titles and suggest the most compelling high impact scenes for discovery, end quote. If there's one thing I love my content to be, it is verticalized.

This comes on the heels of similar products announced at other streamers like Netflix, ESPN, Paramount Plus, and Disney Plus, each of whom platforms like Instagram and TikTok as direct competitors. A media consultant told Business Insider in February that quote, premium streaming is plowing into this space because of a need to own more lean back moments in a viewer's day, end quote. This in my opinion represents a fundamental misunderstanding of why audiences turn to short form vertical video feeds, but maybe I'm wrong and all of you do want to watch a hundred one minute clips of CBS's CSI Miami on Paramount plus. France will be the first European country to ban social media for teenagers. Their parliament recently approved a law which will limit access to people under the age of 15 starting at January 2027.

All social media users in the country will have to verify their age when the law goes into effect. A process which we now know from both Australia and The United Kingdom works perfectly and without any hiccups or easy circumvention. A similar law has been proposed though not passed in Vietnam. As currently written, the draft law would apply to those under the age of 16 who would only be able to log on under parental supervision. Vietnam would also require platforms to identify younger users and moderate the content served accordingly.

Let's dive into today's word. A French phrase originating from the expression sacred god used to express surprise or disbelief. Let's say it all together.

Your taxes are paying for Internet no one is using in Alaska, if you're American at least. ProPublica reports that thousands of abandoned homes on the nearly empty Alaskan Adoc Island have an active obsolete Internet connection which the United States government subsidizes at the cost of $300,000 a year. Subsidies continue even after service providers are sent to prison for tax evasion or end up in court for fraud. What few residents remain on the island, which is 1,200 miles off the coast of Anchorage, use Starlink for internet access as it is both cheaper and more reliable. Amongst Starlink's customers, the local internet utility company.

Doom is our Moby Dick, says the Washington Post, which this month named it one of the 25 most influential pieces of American culture. Placed between thriller and the matrix on the list, Wapo writes, Doom was foundational in digital entertainment. A three d world viewed in first person, self published with no gatekeepers and no retail store as it gave rise to user generated content years before anyone had a name for it. Programmer John Carmack handed the audience the tools to build their own corners of hell, end quote. This comes not long after Doom's soundtrack was inducted into the national recording registry.

The shooter was also implicated in a trove of documents dumped by the White House this month. Documents which purport to reveal the dire state of the country's election security. Amongst the examples of how easy it is to rig an election, a tweet from Defcon twenty nineteen showing the screen of a vote tabulating computer running doom. BitChat, the Bluetooth based messaging app developed by former Twitter CEO Jack Dorsey has been targeted by the Indian government for its role in the ongoing Jantar Mantar student protests. The Indian Cybercrime Coordination Center has demanded Microsoft remove the open source publicly licensed software from GitHub as it allows protesters to circumvent local internet blackouts implemented by the government.

Quote, the application enables anonymous communication without mandatory user registration, phone number verification, or centralized logging of communications. The I c four wrote, the technical architecture of the application significantly impedes lawful interception, interception, attribution, and investigation by law enforcement agencies, end quote. The protests began alongside the CJP or cockroach janta party, a satirical student led group formed online in response to comments made by an Indian judge describing the unemployed social media users and activists as quote, parasites of society. There are youngsters like cockroaches, he continued. Student groups have recently demanded transparency and legal consequences around a number of national education controversies, including the mismanagement of India's national examinations.

The CJP began online, but its popularity quickly grew and leaked into meatspace. Its organizers now regularly communicate with the government and police. India's minister of education Darmindra Pradhan recently resigned following CJP's demands. To be eligible for membership, the CJP says one must be unemployed by force, by choice, or by principle, lazy referring only to physical activity, chronically online at least eleven hours daily including bathroom breaks, and have the ability to rant professionally. Content must be sharp, honest, and point at something that matters.

You will find your destiny among the world's greatest warriors. The few are the proud. And finally, social security numbers in my physics research? It's more likely than you think. This May at the forty seventh I triple e symposium on security and privacy, five researchers revealed that a staggering percentage of papers uploaded to the open access research archive arxiv.org include what they call hidden secrets.

Some of these secrets may be mundane, things like comments, template information, to do lists, and so on, but they also found social security numbers, credit card info, home and work addresses, gossip, and more. Archive is a massively popular platform for serving academic preprints, papers which have not yet been peer reviewed, and also industry white papers by companies like Microsoft, Nvidia, Meta, and OpenAI. For this paper, researchers focused on academic preprints specifically and found a particular vulnerability in LaTeX, a type setting system used to render among other things math equations. 93% of submissions to archive use LaTeX for which you are also required to upload the source files. These source files often contain comments and other metadata that authors never intended to publish.

Now there are programmatic methods to sanitize the files, including methods recommended by archive itself, but many don't work well or well enough. And once your paper is uploaded, it's not so easy to take it down. We're gonna take a quick break, and then I'm gonna talk to security researchers Jan Penekamp and Johannes Lomola about the 2,700,000 research papers that they analyzed, the thousands of hidden secrets that they found amongst them, and why it's not so easy to get those hidden secrets off of the archive once they're there. Joining me are Jan Penekamp and Johannes Lomola. Jan Penekamp is a postdoctoral researcher in computer science at the chair of communication and distributed systems at RWTH Aachen University.

Since 2023, he's been the head of Comsys' security and privacy group, which analyzes and evaluates the security of communication systems across the Internet of Things, healthcare, and more. Jan, thank you for joining us.

Thanks for having me.

Johannes Lohmoller is a researcher at the chair of communication and distributed systems at RWTH Aachen University. He's a member of Comsys' security and privacy group, where he researches privacy preserving methods, particularly in the domain of health care. Johannes, thanks for being here.

Thanks for inviting me.

So, the two of you, along with three other coauthors, submitted a paper in April that you then presented at the twenty twenty six IEEE symposium on security and privacy, in May. The paper is titled Hidden Secrets in the Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific Preprints. The paper details some, really interesting and slightly shocking, security lapses, I guess you could say, in the world of scientific publishing, and we're gonna get into, some of the dramatic details in a moment. But I wanna start at sort of first principles, if you don't mind. So for our audience who might not be entirely familiar, could you just explain what archive is?

And this is spelled a r x I v.

So archive is basically a way to circumvent the traditional publishing processes. So in traditional publishing, you have peer reviews and copy editing and so forth and so forth. And this is often a costly time consuming process while in contrast, archive which is a preprint repository basically is something where you can submit papers before peer review. So it also requires you to upload your latest sources which are then translated in PDFs. Have and not only do they require the latest sources for during submission, but they also make them publicly accessible for each and everybody basically to download without any registration, without any checking whatsoever.

Yeah. So everybody can not only check out the PDF, but also the search files of submitted papers.

And LaTeX is a big part of your findings in this paper. Johannes, can you tell us a little bit about what LaTeX is?

It's basically the typesetting system most of academia actually uses. So you don't just go to Word or just to write down your paper manuscript, but you typeset it in LaTeX, which enables, like, more fancy math. You can integrate other sources as PDFs, so you get vector graphics and all that kind of stuff. It's typically used for publishing those papers.

And so what you found is not just that a majority of papers, but most papers that had submitted preprints to archive had unintentionally included what you call secret information in various portions of the the document?

I would prefer calling it hidden information in the first place, not necessarily secret because how we defined is is that it's information that's somehow contained in those source files that didn't end up in the produced PDF.

What constitutes hidden information? What sorts of things are you finding that someone should not want publicly available?

I think what I, for instance, wouldn't like to see on the Internet on my papers is I mean, we often do these to do items and things that we still have to address in the papers and comments whether this is actually true or this and that is missing a citation or this would need further evaluation and analysis, conversations between authors in the documents. I think for me, it feels like it's personal information.

Sure.

And then on the other end, we also found, like, clear personal information, like names of study participants that are not among the authors, but, well, like, of the research. We also found credentials in their credit card numbers, which was quite a surprise Wow. And things like that.

And, obviously, this does not affect all of the 2,700,000 papers that we analyzed. But still, if you also like 100 papers on there and you make, like, one mean remark about a colleague or, I don't know, basically reveal, for example, that you conduct scientific misconduct, those kind of things. This can also be very damaging to your career, reputation, and so forth. So, you know, it's just sufficient to have this one bit of information there. Yeah.

Or alternatively, if you think about cyberstalking. Right? If you leave leave your address in one of the papers, it doesn't matter that it's that you have multiple papers on this website, for example. Yeah. We also found sort of some remarks on the Internet that indicate that also, like, these large LLM providers may be scraping the source files files this way.

So they're not constraining themselves to the PDFs, but actually also in the training data, those all this information ends up there. And and and part of doing that, also the hidden information that Johannes was just talking about is also basically revealed or used by these companies.

So there is there is evidence that say, a bot which is scouring the Internet for information related to an LLM, like, say, potentially an OpenAI or an Anthropic is gathering some of this hidden information. It whether or not it makes its way into a model that then people have access to, big question mark, but they've at least there's evidence that they've accessed it.

Yes. To the best of our understanding. Yes. Interesting.

I mean, does that mean that archive has to change the way that it works?

I guess it's it's a matter of perspective again. Right? If you consider disinformation to not be that bad Sure. Then archive doesn't have to change anything because, I mean, it's it's just conversational content on there. Right?

We also reached out to them and basically they told us, like, they do not consider this sort of information that we discovered to be sensitive so that they need to act upon it. So, basically, as they refrain from doing something, they told us, alright. The authors are being made aware that this information ends up there and we have clear reasons why we want to include this information in the dataset or the repository, basically. It's like if you go to Google and you don't like how they display the search results,

well Sure.

Tough luck. You don't have to use the service, but in the end, it's how they want to operate. Right?

And do they feel this way even knowing that, say like, I'm looking at the list of some of the the things that you found, things like Slack tokens, API keys, Facebook OAuths, and they're like, yeah. That's fine. Like, if someone wanted to put that up there, sure.

I mean, for those things, you can still revocate the credentials in

a way.

True. Yeah.

But, yeah, they they think it's the educator's author's responsibility. Yeah. Mo multiple people, after presenting the work or having it published multiple also reached out to us and they asked like, why does archive even surface content like these sources publicly? Like, they can just, you know, keep them internally, and not share them. So this is like the most common response that we're getting, I would say.

They don't have to serve the metadata that reveals hold on. I'm looking at it here. Almost 4,000 United States Social Security numbers.

I mean, they argue it's for reproducibility, and I think they had some point several years ago where authors actually could upload ancillary data right into the submission. So that's an actually intended way of, like, providing further context or data and things like that next to the submission. Uh-huh. But I think there are other large research data repositories nowadays, like, say, Nodo, for instance, that kind of fulfill the service. So I don't think it's, like, necessary anymore to provide Lartic sources.

You also mentioned that there is a way that this is a concern for the peer review process. Can you just briefly describe why that might be?

In several disciplines, you do double blind review, which basically means that the reviewer does not know the author and the author does not know the reviewer. Now the reviewer does not get disclosed because you submit sources, but the author may get dis disclosed this way because you may not only have anonymous authors in there but other things as well. Similarly, if later on publishers collect the Lattice sources, they basically have also the same amount of access to the hidden information. Right? So while it is not publicly accessible, it certainly is for those publishing companies where you could say, right.

I'm trusting them, but, you know, security cyber incidents happen across the board and depending on where where and how much they store, yeah, malicious actors could still get access to that after the fact. So it's it's also still crucial to consider that angle in a way.

Right? Got it. And how is it that those things that aren't needed for the final rendering end up being left in? Is this just people don't know that they should remove them? Is this a problem with the the software itself when you submit the paper?

I think it's a little mix of all all things you couldn't can think of. Yeah. So probably people are lazy. They don't really care. Sometimes they don't even know that the files end up being publicly accessible and they just upload that.

Then archive actually lets you nowadays select whether files are required or not, but only on on root level basically. So they know about the issue. They sort of try to address it but I'm I'm not sure how many people would actually select or deselect stuff there.

Sure.

Yeah. And then for like if you have a big project with hundreds of files, you can also just get lost and not noticing that maybe you have 102 files in there. So it's sometimes also just a matter of scale why why things are popping up there.

Yeah. It's such a particularly and I think uniquely specific example of all the ways that we leave data trails behind us when we use the Internet and various platforms on the Internet. And like, you know, not just the Internet, guess, also just work you do with computers, you know, you you end up leaving little bits of yourself and identifying pieces of information about your life all around. And I think like, there's all of these scenarios where we conceive of information as private, or we think of files as being clean, or not vectors for people learning sensitive things about us. For maybe a bunch of, like, arbitrary reasons, we think that things are safe, or maybe for no reason.

We just have haven't had a reason to consider otherwise. But actually, like, those things are really public.

Yeah. I believe it's like if you think about electric vehicles and kind of what information they record and sometimes depending on which third party apps you're using, maybe they also reveal stuff on the Internet. I mean, there are these these apps for fitness tracking, right, where basically your history is publicly available. So I think, you know, it it comes up every year and now. And so this was basically one of the occurrences where we as academia, people from academia basically spot, something sensitive in a way.

Yeah. You talk about some of the ways that exist for dealing with this issue because this isn't a new problem. And in fact, archive basically recommends the use of a a Google tool, I think it is, to sanitize the things that are submitted. Could you talk a little bit about that tool and others like it and why they're they aren't sufficient for solving this problem?

So Lattice is a very powerful language. So you have quite some diverse ways of inserting comments in there or basically adding stuff that you do not need, in the final PDF. And basically what we did is survey how prior solutions basically work and what they did and most of them use regular expressions to detect a comment and then act upon that. I would say like the Google tool is actually ArchiveLatigleena that is actually a quite mature tool but if you use some ways that are not supported by this tool then, well, you're all of luck and this information basically remains in there. And we argue that it's not sufficient to rely on any of those.

And what's what strike us as interesting, none of them actually consider this metadata level, even though, you know, it's quite well known that metadata actually leaks or can leak sensitive information.

Now we were sitting on these 2,700,000 submissions and had this archive Latest Kiena tool floating around. So we just, like, sew it on all of those submissions and kind of figured out what happens. And then we found out that, like, I don't know, nine above 90% have modified sources after applying the tool. So we're not quite sure whether the tool is more major nowadays or whether it was never applied to the sources, But we kind of had an empirical way of figuring out, like, how much additional content those tools would I could remove from the submission.

It would not probably remove all the data that we discovered, but it would already remove quite a lot by margin.

And did you you developed your own tool in order to sanitize submissions. Is that true?

Yes. So we were fortunate enough that one of our co authors, a student that we supervised, that he came across a different way of basically working with these LATHE files. So instead of using regular expressions, he discovered TreeSitter which basically is an abstract grammar that sort of better reads or processes the LATH files. We're not saying that our tool is perfect in any way. It's just, let's say, the next step forward and showing, like, where there's potential and how to to make the best out of an unfortunate situation, I would say.

Yeah. Also, sort of looking in the future to enable many many different authors and researchers, not only in computer science, but basically, yeah, across all the disciplines to apply that. And that's also why we sort of focused on really reliability. So we wanted to make sure if you apply our tool that then the information gets reliably removed and that it can be sure that sort of the content is retained as it was so that we're not over removing stuff. So, basically, altering the PDF because we found, several cases where the Google tool over removes content.

So in a way, you use your tool and then your the content that you have in the paper is not identical anymore. And unfortunately, you may not notice unless you check really character basically in your paper. Now this is something that can be quite damaging. Right? If you have a proof on there and then for some reason there are like a couple of characters missing in there or a mass formula and you you don't know why that that doesn't work.

It doesn't make sense. It's just not equal anymore. So, you know, it it also has an impact on sort of the scientific discourse and it's, yeah, in general.

Yeah. Do you think the archive is gonna switch their recommendation from the Google tool to yours?

I mean, we're not Google, so I I mean, I I don't know. Let's see. If it gains sufficient traction, maybe.

So I'm curious what what do you think should happen next and what in theory actually happens next? You mentioned that, you know, archive has been pretty clear that, like, they they think this is the system working, except in extenuating circumstances where the information is very personal or, you know, very important that it not be made publicly. So it sounds like, you know, them changing the way that their service works is remote. Is there now, like, an education campaign that has to be undertaken in order to let authors know that when they're submitting things, this is something that they have to be thinking about?

Yes. Certainly. So I think, like, policy wise or institutional guidelines on on how to work with archive is something that's essential. So nobody ever, like, really told me, like, how to work with archive. Right?

So at some point, it just came up and you're like, alright. I'm just submitting my, first paper to archive. What can go wrong? Right? But now that we know, like, a lot of things can go wrong and, actually, you can't undo all of the things that can go wrong.

So I I could imagine that funding agencies who basically mandate that papers are getting open access publishing also have sort of guidelines on on what they want to see up on archive and whatnot. Yeah. And similarly, the institutions themselves maybe want to be sure that authors do not basically reveal damaging information. Right? They also have a reputational desire to basically improve that situation.

If if they were were to come up with that, I mean, most of the major universities have some kind of library service that handle all those things. So I think, certainly, the the staff and the way to implement those is there. It just hasn't been done yet. Right? So getting that on track, I think this is very crucial.

And it is also something that would not only help, like, educated computer science or computer security researchers, but, basically, help people across all the disciplines because then you have guidelines, something to follow-up on. And even if it just says, you know, be careful. You like, use caution, maybe reach out to an expert, somebody who supports you on basically submitting that, that would be something to to really go a long way with this.

I think we should make this a shared responsibility between authors and publishers because even if we get the tooling and the awareness right, at least the time issues, so deadline, pressure, and so remains. And since we have seen at least some of those aspects could be easy easily fixable on archive sites, I wouldn't just, like, redeem or exempt the authors from their responsibility, but something could also be done at the publisher's side.

In the end, it's a community effort to basically improve everything.

Yeah. Jan, Johannes, thank you so much for joining us. I really appreciate you taking the time out of your important and busy schedules to chat with me.

Thanks for having us.

It was a pleasure being here.

What is the best place for folks to go to be able to keep tabs on what you're up to?

This paper is already up on archive naturally, including sources. K. So you can also look around what we did in there.

Including including, I assume, your credit card number and home address.

Sure. You you can take a look if you find it and then let me know. I I will look at my bank statement to see. And we do also host a website, which is archive.com. It's .rwth-ahn.de, quite a long name, which basically gives you an executive summary and so any updates that probably would follow after this work, we would also host there.

So this really gives you a high level overview about the key findings that we have.

Thanks again to Jan and Johannes. If you would like to read their paper or see more work from them or their department, you can check the links in the show notes. That is the news we have for you this week. We are gonna be back here in the main feed on or around Thursday, August 6. In a couple short weeks, the Never Post Member Drive stream week will begin during which we will endeavor to add to the ranks of wonderful people who support this show, help keep it running, and maybe most importantly, it get better and weirder and more interesting.

Do you wanna be one of those weird wonderful people and help us get off to a smashing start? Can you help us log on Twitch on Monday, 08/17/2026 at 11AM eastern and say with massive giggle stifling grins on our faces that we are already well on our way to our membership goals for the year. Would you do that for the low low price of $4? If so, please head to neverpo.st to become a member. You can get access to an ad free feed of the show, monthly at least members only uploads and more.

Neverpo.st, but you knew that already. Never Post's producers are Audrey Evans, Georgia Hampton, and The Mysterious. Doctor first name, last name. Our senior producer is Hans Buto. Our executive producer is Jason Oberholzer, and the show's host, that's me, is Mike Rugnetta.

If a shaft of light is broken into a thousand pieces and each piece into a thousand more, might not a stranger mistake any of the fragments for the original light? Am I not such a stranger? And if so, how can I speak of light or its origins? What I have taken for light may be something entirely different. Blood or mire or darkness itself.

Excerpt of the interior prisoner, translation of an unsigned manuscript written at Salamanca around nineteen o two by Jeffrey O'Brien. Never Post is a production of Charts and Leisure and it's distributed by Radiotopia.