News for hackers. Stuff that matters.

jwally

Re:Reverse Engineering JavaScript SDKs on Tuesday November 03, 2026 @07:27AM (#50351181)
For fun (and $30) I had DeepSeekFlash try to dismantle as many hardened JavaScript sdks as I could find (TikTok, Fingerprint, etc). I did like 20 in all - and ranked them half heartedly. Twilio was the nastiest at $5 and 1.5 hrs of work.
Re:Fingerprints Are the New Cookies on Monday October 12, 2026 @04:31AM (#50053222)
Fingerprint.com charges around $0.004 per investigation, and really encourages you to set up a first party proxy - so iOS doesn't nuke storage after 7 days. And even there, unless its a cookie match; your ID usually carries a confidence number.

That should give some hint about how difficult it is to do in real life, at scale.

Show HN: Cross Origin Tracking Safari

https://poc.oicu.info

So this is a proof of concept to demonstrate how cross origin tracking could work in Safari. Turn consent into a captcha once and silently track the user going forward. Upsides: this could let you complete a captcha on one site, and have its grant carry over to another site seamlessly.Downsides: Cross origin tracking.

( Read More... | no comments | 2 points | on HN )
I was thinking about this with flock cameras the other day...what's our actual ROI? Was the world horrible before and these initiatives are going to close a monster crime gap or is this just a giant fishing expedition ... just because?

Ask HN: Honey Pots in 'who wants to be hired'?

So I put my info into the hackernews 'who wants to be hired' this month, and I've had 5(?) fake recruiters reach out (all rando8374*@gmail.com). It would be awesome to recruit security researchers or law enforcement or whatever to snipe people like this.I think even the _threat_ that the 'job applicant' is a cop seems like it would deter this behavior in a non negligible way. /shrugPutting it...

( Read More... | 1 comment | 2 points | on HN )
Re:English: A vs. An on Sunday September 20, 2026 @09:44AM (#49775830)
What about "An honorable man" spoken with an American accent? British accent?

Dialects and syntax are weirdly fascinating .

Re:Humble Proxy Detection on Sunday September 20, 2026 @09:22AM (#49775615)
Not claiming this is bullet proof, but the limited testing I've done its pretty impressive. Would love to flush some traffic through it and get some feed back. Pretty detailed description how it works inside. Probably going to open source the code because crime sucks, and if this can help at all - I want to share it with people who can use it.
Re:How to Detect Residential Proxies on Sunday September 20, 2026 @09:17AM (#49775562)
Super cool! Thanks for replying / sharing.

Obviously, this would be a SAAS -I wouldn't want webmaster at jocokfuel.com or whatever having to roll their own rust stun server and make TCP RTT measurements :-)

Spun up a quick and dirty demo at https://proxy.kyc.red

More detailed description is in there.

I just ran some proxied sessions through your demo - really impressive! FWIW, make the "BLOCKED" text bright red and bold - success/accepted green.

Would love to chat more about what you're doing and how you're doing it.

I'm justin at wolcott dot io

:salute

How to Detect Residential Proxies

I'm feeling pretty depressed right now, and hopefully sharing this little anomaly I discovered in January might help someone make the world a better place, and figure out how to put a dent in online crime. Fuck criminals.Most residential proxy providers that I've seen don't support UDP. UDP is what WebRTC uses and has been part of the browser's "core" since 2021. If someone says they're on...

( Read More... | 2 comments | 2 points | on HN )
Re:Ask HN: Who wants to be hired? (September 2026) on Tuesday September 01, 2026 @10:29PM (#49531035)
Location: Dallas, TX

Remote: preferred

Willing to relocate: No

Technologies: TypeScript/JavaScript, Node.js, AWS, Cloudflare Workers, distributed systems, high-scale data pipelines, fraud/security

Senior technical lead specializing in ambiguous, high-scale systems. I turn messy security, infrastructure, and data problems into pragmatic production systems—recently cutting cloud costs by $200K+/year. Seeking senior/staff engineering or technical leadership roles with real ownership.

LinkedIn: https://www.linkedin.com/in/justinwwolcott

Email: [email protected]

Re:Ask HN: Why do we need MCP? on Saturday August 29, 2026 @07:29AM (#49489017)
I'm thinking more as a provider. Why put a model on my side to handle permissions/scope/auth/actions when thats already handled (or easy enough to spin up)by a rest-inspired http api?

If you're needing to give the model direct and broad access to your SqlServer instance...I don't get it.

Dedicated customer facing API is like whitelisting approved actions; MCP feels like getting an LLM to enforce a complex blacklist.

Re:Ask HN: Why do we need MCP? on Saturday August 29, 2026 @07:02AM (#49488869)
It's why I asked the question. Maybe I missed something.
Re:Ask HN: Why do we need MCP? on Saturday August 29, 2026 @06:28AM (#49488663)
Probably covers most use cases and is a lot cheaper and safer.

Ask HN: Why do we need MCP?

Why not just publish your API docs and let the client's bot chain together what calls need to be made.You could even repurpose the MCP so you only ever produce the API documentation as EVERY response. No LLM necessary.

( Read More... | 18 comments | 4 points | on HN )
Was thinking about this a couple of days ago...

Sam Neil - Gone. Sean Connery - Gone. Tim Curry - (now)Gone.

All the big names from my childhood are starting to die... Damn.

I get the concept and use case - but equifax has a reputation on par with klan members and pedos...at least be self aware enough to know to conceal your true form! Phillip Morris became Altria or whatever.

Plus, I can verify for employers that I am a real human with a real employment history snd I can prove it...by giving them my SSN and Mother's Maiden name? What stops a bad guy from speed rushing the dark web, registering these things en masse and selling access to DPRK?

thats the hard part, right - my 76 year old dad is on his banking app while his samsung TV is allowing a bot to try and take over other accounts at the same bank on the same IP.

IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.

https://darknetdiaries.com/episode/172/

What if I have a slimy TV box or nasty on my phone, living on my network?

You take IP down, you kill the cancer but you also end up killing the patient.

Re:Show HN: Proxy-or-Not, Proxy Detector on Sunday August 09, 2026 @12:42AM (#49228509)
Thanks for trying it. The vpn stuff is shaky right now, but the proxy stuff has been great - on a really small sample size.

Show HN: Proxy-or-Not, Proxy Detector

https://arcades.click/proxy-or-not

My humble attempt to detect residential proxies while limiting false positives on things like CGNAT.So far, its pretty successful detecting SOAX, BrightData, and a custom proxy app I built for my phone - but I have a pretty limited sample size.Give it a spin!* https://github.com/JWally/sofa-king-bad-box* https://github.com/JWally/sofa-king-bad-box-android

( Read More... | 2 comments | on HN )
Re:Iowa-led states ask OpenAI to keep their bots on a leash on Wednesday August 05, 2026 @08:58AM (#49182219)
Prediction: AI ends humanity not via some super cool/scary/robopocalypse - but as a marketing stunt gone wrong when a Frontier LLM accidentally knocks out water/electric/gas by hacking in and trying to patch them.

Phillip K. Dick meets Idiocracy.

This is fun, but what does it prove other than a good tool used poorly produces bad results?

The analogy du jour for me is describing AI as the iron man suit. If you are tony stark it makes you a god. If you are my grandma, it makes you meet God.

It feels like if he triggered a wipe - that is destruction of evidence; but if it auto-wiped he's fine.

If it were a box of drugs and he triggers an incendiary device - he's in trouble . If agents trip a protective boobie trap and destroy the box- he is fine.

Don't know why but this feels correct to me.

Re:DARPA, U.S. Air Force fly AI-controlled F-16 on Thursday July 23, 2026 @10:09PM (#49030502)
I take out your electric grid and blow up water treated facilities and natural gas terminals. Food rots, no water for hospitals, no heat in the dead of winter - arguably the virus does what the Falcon does; but with much higher precision - crippling an enemy.
Re:DARPA, U.S. Air Force fly AI-controlled F-16 on Thursday July 23, 2026 @08:48PM (#49030015)
1st place my head went.

Realistically though, whats worse - this thing going rogue or OpenClaud breaking out of its container and shredding a nation's infrastructure like a platoon of gremlins? Genuine question...

Re:Code mode yields a 99.2% cost reduction in our systems on Thursday July 23, 2026 @07:59AM (#49020182)
Preach!

Dedicated Infrastructure > automation > ad hoc scripts > non deterministic llms from a dependability perspective alone. Using an LLM to do something that prettier could have done is analogous to using a 3d printer to nail up a fence.

Re:Optimization Solver as a Service on Sunday July 12, 2026 @06:26AM (#48879961)
For whatever its worth I built this about a decade ago because I am a non academic who can't think in tableaus, but still wanted to solve optimization problems.

I created a json like schema/struct/whatever to describe the problem. Maybe adopt something like this and more people will be able to see how they could use your tool:

https://github.com/JWally/jsLPSolver/blob/master/API.md

I need to re go through the docs, but you get the gist.

Here is the Berlin Airlift problem for example:

const model = { optimize: "capacity", opType: "max", constraints: { plane: { max: 44 }, person: { max: 512 }, cost: { max: 300000 }, }, variables: { brit: { capacity: 20000, plane: 1, person: 8, cost: 5000 }, yank: { capacity: 30000, plane: 1, person: 16, cost: 9000 }, }, };

Maybe I'm not paying close enough attention (probably) - but I feel that China is providing a glimmer of hope that this (only the uber elite can get good AI assistance) isn't true, and we're maybe at a weird inflection point of sorts wrt the leverage that tech can now provide.

China gets sanctions and stale chips - fine, they just DIY the algorithms through CPU instead of GPU and open source it.

American warships have the latest, coolest, highest-tech tactical weaponry imaginable - which is great until you have to fend off 10,000 consumer/wal-mart/IED grade drones at $2mm/clip.

Money is amazing, but if you lean on it too heavily in lieu of _practical_ innovation, it'll bite you in the ass. The apocryphal story of the Soviet Rocket scientist who suggested using a pencil instead of investing 100k in a space pen that worked in 0g's.

Older »