News for hackers. Stuff that matters.

NickySlicks

Show HN: Spy Back on Your TV: HDMI Man in the Middle

https://www.youtube.com/watch?v=ktMCGZ_xHi4

I got tired of getting served strange and weird ads due to the fact that our TVs monitor just about everything we do. So I built an HDMI man in the middle to detect ads and replace them.Presented the concept and launched the open source repo this year at HOPE 2026, huge thanks for the conference for giving me a chance to spread this tech.Link to the repo on the video

( Read More... | no comments | 2 points | on HN )
Re:Show HN: Divot.css – a simple skeuomorphic button style on Monday September 28, 2026 @05:02PM (#49884292)
This is super cool! really love the thought placed into emulating hardware buttons
Recently gave a talk about how it all works at HOPE 2026 and a bunch of folks talked to me afterwards inspiring me to share this technology more https://schedule.hope.net/hope26/talk/P9VFEH/

slides are up as well in case folks are interested, and the talk should eventually be placed online by the HOPE organizers https://bit.ly/4hv295g

Show HN: Minus HDMI hardware ad-blocker with local vision model

https://github.com/garagehq/Minus-streaming-stick

Hey HN! Minus is an open source hardware device that sits between your streaming stick and TV and blocks ads that appear on your TV in real time at 4k60fps.This was made out of a labor of love after seeing nonstop "Hims" ads for months, so I created a hardware-in-the-loop test platform to gather over 80k screenshots of ads and train a custom model to detect and block ads in under 300ms.Since we...

( Read More... | 1 comment | on HN )
So far only against four authorized networks. One of them was a corporate network. Left it overnight and it only found one minor week old CVE that I'm sure the IT team already had on their tracker. But showed that the proof of concept worked.
Completely understand, the legal landscape has really shifted around AI/LLM tools. I see tools drop everyday that spit in the face of DMCA/Copyright law but they skirt by mainly because they leverage AI
I used to red team professionally, and it is a lot easier to sneak an unauthorized phone into a facility than a computer.
I built Nightcrawler, an open-source autonomous penetration-testing agent that runs entirely on an Android phone.

The project started with a question: how much of a real pentesting workflow could I run locally on relatively old mobile hardware, without relying on a cloud model or API?

Nightcrawler runs a 1.2B-parameter model locally on the Adreno GPU of a OnePlus 8. The model chooses targets and tools, while a separate scope-enforcement proxy validates every command before execution. The system maintains per-host memory in SQLite, rotates between targets, matches detected versions against a local CVE database, executes multi-step playbooks, and generates a structured report.

A few implementation details that may be interesting:

Local inference runs at roughly 115 prompt tokens/sec and 13 generated tokens/sec. The small model only produces a usable command around 50% of the time, so much of the engineering is recovery logic, duplicate detection, persistent memory, and deterministic playbooks. Every command passes through a separate scope and safety layer rather than trusting the model to remain in scope. The project includes a dry-run mode, so the agent loop can be tested without executing real network commands or owning the phone hardware. I've had it running on my home network for the past 3 months uninterrupted

Re:Ask HN: Share your personal site on Thursday April 07, 2022 @06:30AM (#30942750)
https://nickengmann.com

Hardware and Cybersecurity engineer based out of Brooklyn, NY