News for hackers. Stuff that matters.

simonmorley

I’m on their CSP and can’t even get it to update my website. It’s totally unusable rn.
Built this because I couldn't find one single place to watch validator downtime events across chains in real-time. Tracks slashing, delinquency, missed votes across SOL, ETH, SUI, and ATOM - 819 events and counting.

You can filter by chain or search for a specific validator. The 'in scan DB' links show what we found running on the validator's host from our scanning infrastructure. Feedback welcome, especially on which chains to add next.

Was mostly entertained by the weird names for the SOL validators!

Re:Cloudflare Can't Save You from a DoS (I Checked) on Tuesday January 27, 2026 @04:07PM (#46786759)
I actually appreciate the feedback here. I find it personally really challenging to take feedback on and this is part of the journey.

The “I’m under attack” mode you mention is a JavaScript challenge which is Layer 7. It doesn’t help when SYN floods hit your kernel before any HTTP connection is established.

You are probably the first person outside my network to watch the video. Thanks.

The vids are real. I’ve been trying to work out how to better demonstrate this.

Re:I hacked Casio F-91W digital watch on Friday January 09, 2026 @07:10AM (#46553059)
I enjoyed reading this, a lot. Really not really sure why everyone’s more bothered by the use of ai to help write it. But you can’t please everyone.
I built a deterministic, offline audio analysis system that models long-horizon musical structure:

tension, novelty, fatigue, and impact.

It analyses full tracks and produces interpretable curves and events (drops, stagnation, transitions). No ML or training data.

This repo is the Python reference implementation used to prototype the kernel behind a real-time C++ DAW plugin. The Python outputs are the "golden" results used to validate the C++ port.

Motivation was simple: I heard Beyoncé’s "Haunted" and wanted to understand why it worked so well structurally.

I was not expecting to LIKE Beyoncé!

That turned into a research artefact I thought others might find interesting.

The c++ repo is defo hard work, will share soon.

The behaviour later turned out to align closely with David Huron’s ITPRA framework, though this project doesn’t attempt to prove it.

PS. I didn't ANY time looking for alternatives.

Yeah, exactly. It isn't. At one point, someone in their team sent me a internal DDOS audit for the sui application. And basically said "no problems". Erm.

What’s ironic is that Aptos (their supposed arch nemesis) came back clean as a whistle on our first pass. Yet it’s Sui always "out there winning" because of their massive marketing spend.

That said, I started publishing the node scores to the blockchain and someone did ask me if they should move their staked funds from one that was sub-standard.... Yes, you should.

Quite... Also, simpler than that, don’t even need 51%! At ~33% you hit the Byzantine limit and consensus dies. And I doubt anyone running one of these validators knows what a backup is.

Sui fobbed off my disclosure that nearly 40% of their validators are exposed

I built a tool called PGDN.ai that analyses DeFi/L1 networks for misconfigurations, CVEs, exposed services, etc. I started with Sui because I had a contact there. I didn’t expect much from one of the largest chains. What I found was wild.- Nearly 40% of validators are running with serious misconfigurations: open SSH, CVEs, default services, no firewalls. - The majority expose the exact Ubuntu...

( Read More... | 4 comments | 2 points | on HN )
Re:OpenWrt: A Linux OS targeting embedded devices on Monday September 08, 2025 @05:12PM (#45174062)
RIP Cucumber Tony.

Apps still leaking data in 2023

It’s 2023 people and I’m staggered how many apps / sites I use that leak personal data.Yesterday, someone asked my to try an AI coaching platform. It felt buggy so I started looking at the requests.Mins later I was able to view customer emails, DoBs, photos and location. Thousands of them.Fortunately I used the apple private email feature.As someone legitimately into privacy, I’d like to know...

( Read More... | no comments | on HN )
Re:Payments on the Solid Framework on Sunday September 30, 2018 @05:16AM (#18105337)
Oh and ‘add your producst’. I’m out.
Re:Payments on the Solid Framework on Sunday September 30, 2018 @05:13AM (#18105315)
No https redirect on signup or login. That worries me.
Re:Show HN: How we built our interactive demo walk-through on Tuesday February 13, 2018 @09:59AM (#16367559)
Love this. Totes getting bored using a gazillion tools to help onboard my users. Before you've even started a new venture, you'll find yourself hunting for the right tool for a job you didn't even expect would exist.

Which support tool. Which analytics tool. Which AB testing tool. Which wizard tool. bla bla bla.

Back to basics. I'll get my coding hat on and actually make an effort. Nice work. Will try this one myself next time I need a wizard.

As unfortunate lesson to learn, I hope others can benefit from our mistake.

I know a few other companies who've had trademark issues recently. Seemingly, it's quite simple (and affordable) to avoid.

Anyone else had problems with this? Advice about changing name, github repos etc?

Revive your unlicensed eol Meraki bricks

You can now flash your Meraki paperweights with OpenWrt and bring them back to life. Woop. Huzza.Us lot at Cucumber WiFi, have put together a precompiled version so you can carry on cloud-managing it.Currently we support the MR12 and MR16. MR18 coming soon.Here's the guide:http://docs.cucumberwifi.io/article/213-installing-cucumber-on-cisco-merakiLet me know how you get on!

( Read More... | no comments | 3 points | on HN )
Re:Why doesn’t OpenWrt autoupdate? on Saturday January 09, 2016 @05:43AM (#10870794)
I am an OpenWrt developer but not part of the core team by far. We've been developing a platform to manage OpenWrt devices from the cloud for the last 18 months.

We struggled with this since day zero. As a startup, we didn't have the luxury money to build our own boxes with loads of memory. Plus we we wanted to support all OpenWrt devices. Ultimately, we took the logic of auto upgrades (and everything else for that matter, separate story) off the aps directly and now do everything in our platform.

Currently we only support a minimal set of devices - about 15 in total. However building / maintaining the firmwares for all of these, making sure they're up to date etc. is a huge burden.

Upgrading a box for a user poses so many challenges, I can't see why this is actually OpenWrt's responsibility?

What to do about testing? New releases can (do) have bugs. Again, since we're bootstrapped, we don't have a lab so we have separate development modes and test these on customers willing to have the bleeding edge.

The Netflix Syndrome as we call it. What if someone/thing is connected - do we still upgrade? I work late, and before sleep, I usually watch some Netflix. However, our nightly upgrades pushed from our platform were ruining my enjoyment! Shock. We had to introduce a feature to disable auto upgrades if there is a device detected.

What about stragglers? Customers with very outdated firmwares were not only vulnerable but also holding our development back. In the end we upgrade all boxes that are 2 months old between 4am and 5am local time every day. Some people refused to upgrade, they like the status quo, they're used to the gotchas in a particular release.

Ok, OpenWrt is becoming hugely popular but there's still a huge knowledge gap. If people struggle to understand the difference between WiFi and broadband, how can we expect them to understand firmware let alone, why it needs to be updated.

Re:Next generation of Google Cloud SQL on Friday December 11, 2015 @11:23AM (#10717962)
The proxy solution looks OK, shame it wasn't mentioned in the blog unless I'm blind.

Lack of private IPs has been the single reason why we've not moved our current dbs over. I'm sure it's hard but you're Google after all o_0

Re:Next generation of Google Cloud SQL on Friday December 11, 2015 @08:44AM (#10717025)
And still no private IPs?
Re:Ask HN: How do you automate logging bugs in your product? on Wednesday September 30, 2015 @04:17AM (#10302484)
We use Airbrake. It also allows us to create errors manually- generally used for logging exceptions from within rescue blocks atm.