News for hackers. Stuff that matters.

vhsdev

Re:Show HN: Birdcage – Secure remote access for personal AI on Wednesday March 18, 2026 @11:37AM (#47427105)
I built Birdcage because I wanted to access my claw from anywhere without handing auth to a third party or punching holes in my home network.

Birdcage sits on a VPS and handles auth + reverse proxying. The connection back home runs over WireGuard — the VPS only sees opaque packets. The agent manages its own WireGuard interface, discovers endpoints via STUN, and falls back to relay when direct UDP fails.

Auth uses PBKDF2 with adaptive proof-of-work on brute force, JWT dual-token pattern with sliding session expiry, and WireGuard key rotation on a configurable interval. Single binary, pure Go, no CGO.

Pretty sure all those are covered, upon more careful review. PRs open!

Edit: The create account I hadn't thought of for the email enum. Thanks!

Edit 2: Fixed up two schema issues identified and the last mitigated already via call: await passwords.rejectPasswordWithConstantTime(validatedData.password)

Hi, amichal. Nice finds. I will dig into more of the particulars where sensible. Please feel free to send up a pull request! Thanks for taking a peek.
Everything you or your agent need to see is in the commit history.
Appreciate it, TheTaytay!

Show HN: Minimal NIST/OWASP-compliant auth implementation for Cloudflare Workers

https://github.com/vhscom/private-landing

This is an educational reference implementation showing how to build reasonably secure, standards-compliant authentication from first principles on Cloudflare Workers.Stack: Hono, Turso (libSQL), PBKDF2-SHA384 + normalization + common-password checks, JWT access + refresh tokens with revocation support, HTTP-only SameSite cookies, device tracking.It's deliberately minimal — no OAuth, no...

( Read More... | 10 comments | 9 points | on HN )
May I live a thousand years and never hunt again.
Re:Degoogled phones running privacy oriented OS on Tuesday March 01, 2022 @07:26AM (#30513268)
Did anyone look at the business address? It's placeholder text...
Re:German publicly funded open source projects on Tuesday March 01, 2022 @07:11AM (#30513167)
Briar is a fantastic tool. A little rough around the edges but the idea of being able to use Bluetooth to communicate with someone in range versus sending data into a router has appeal beyond offline communication. I'd love to see Codeberg on here in the future. They're doing a bang up job.
Re:Injecting fairness into machine-learning models on Tuesday March 01, 2022 @07:03AM (#30513109)
I thought it was garbage in, garbage out. Here they seem to be suggesting garbage in, fairness out.
Re:F-Droid – alternative to Google Play store on Tuesday March 01, 2022 @06:47AM (#30512975)
Some of my favorite apps on F-Droid and the apps they help replace:

Floris Keyboard - Gboard

Bromite - Chrome

OsmAnd+ - Google Maps

Editor - Google Keep

My Expenses - Mint

NewPipe - YouTube

LibreSpeed - Ookla Speed Test

Currencies - xCurrency

Diary - DayOne

Password Store - 1Password

Aegis - Authy

WireGuard - All VPNs

Book Reader - Acrobat

Pluvia Weather - Weather

I commonly rely on Goodreads for book reviews before deciding if it's worth spending the time to read. Any chance of integrating functionality like this with z-lib.org?
Re:I'm getting spammed via Google Photos sharing on Wednesday February 23, 2022 @03:09AM (#30438812)
You signed a legal agreement with Google and gave them permission to update it anytime without notifying you. That's the root of your problem, not spam.

Older »