_k2vp

6 ms·

1. 1.▲
   by _k2vp 4mo ago

   > Apple Pay does not, runs the whole thing on-device, and not only is private, but as a result also enables payments entirely offline. Apple Pay still does send a lot of telemetry about your payments though. https://duti.dev&#
2. 2.▲
   Ask HN: Why are people buying GitHub repositories?

   3 points by _k2vp 5mo ago|2 comments
3. 3.▲
   by _k2vp 7mo ago

   I'm not malicious at least :) Pretty public with who I am https://duti.dev/
4. 4.▲
   by _k2vp 7mo ago

   > The theme of the hackathon was AI I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunter won. Not too mad, just annoyed at miscommunicatio
5. 5.▲
   by _k2vp 7mo ago

   I was playing around with it a while back and forgot to remove it...
6. 6.▲
   by _k2vp 8mo ago

   > Google reportedly used their Android users to sniff APs Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least. https://github.com/acheong08&#
7. 7.▲
   by _k2vp 8mo ago

   It does fall back to the GPS receiver if no internet and no cache but I suppose it's just more power efficient and not on anyone's minds that people would MITM for this purpose.
8. 8.▲
   by _k2vp 8mo ago

   I still can't believe that certain IOS APIs are locked to paid developer accounts only (PacketTunnel, Shortcuts, etc.) such that you can't even sideload your own app onto your own phone with these features. It's not very well
9. 9.▲
   by _k2vp 9mo ago

   Happy New Years! I can't believe it's already 2026. Posting from a flight back to the UK. Having wifi in the sky, we really are living in the future. 2025 wrapped: https://duti.dev/blog/2025/2025-in-a-nut
10. 10.▲
    by _k2vp 9mo ago

    Currently in China (as a visitor). Wireguard literally just works (to a VPS). Mullvad works as a commercial provider, just slower. Xray-core (vless, Trojan) if you're paranoid. I have my own proxy over syncthing relays https:/&#x
11. 11.▲
    by _k2vp 9mo ago

    I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a ch
12. 12.▲
    by _k2vp 10mo ago

    Location: Cardiff, United Kingdom Remote: Preferred not, but willing Willing to relocate: Yes (Europe, North America, Singapore, Far east Asia) Technologies: Golang, Python, Typescript, Java, Postgres, Docker, Kubernetes, Svelte, React, Ghi
13. 13.▲
    by _k2vp 10mo ago

    Complained about this yesterday as well: https://duti.dev/blog/2025/rot-of-undergrad/ The incentives are all messed up & universities can't even do anything about it since if they lose students by be
14. 14.▲
    by _k2vp 1y ago

    Tried [Invidious]( https://github.com/iv-org/invidious )? It's really lightweight. I host my own instance: https://iv.duti.dev and it works wonders (Librewolf with strictest fingerprint resist)
15. 15.▲
    by _k2vp 1y ago

    Huh I recognize that library. Ran into the same issues last year and made a fork. https://github.com/acheong08/playsound https://pypi.org/project/playsound2/
16. 16.▲
    by _k2vp 1y ago

    Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git version. Still not up on Arch yet. Will refrain from pulling anything but I bet it'll take quite
17. 17.▲
    by _k2vp 1y ago

    This is why I use invidious. Much more lightweight without all the tracking and Google bullshit. https://invidious.io My instance https://iv.duti.dev
18. 18.▲
    by _k2vp 1y ago

    You always could by just setting the proxy environment variables (or in settings). The standard port for the tor daemon is 9050. In fact, it's relatively easy to write a socks proxy that lets you route traffic through a arbitrary proto
19. 19.▲
    by _k2vp 1y ago

    I write a lot of random code that have very little economic value so there's really no point in keeping it private. Sometimes they end up being helpful for other people. E.g. https://github.com/CopilotC-Nvim/Copilo
20. 20.▲
    by _k2vp 1y ago

    I'm in the UK so it would be surprising for it to be a language proficiency problem. You might be right about outsourcing and machine translation. > "Will the application has a local repository of songs, will you use database t
21. 21.▲
    by _k2vp 2y ago

    https://github.com/acheong08/apple-corelocation-experiments I worked on this a while back in parallel. You can dump Apple's entire database in ~2 weeks. Around 3 billion records including China. You can compress i
22. 22.▲
    by _k2vp 2y ago

    Apple also maintains a similar database (though with only BSSID and not SSID). You can find all the BSSIDs in one area via the tile API or straight up dump the whole thing. https://github.com/acheong08/apple-corelocatio
23. 23.▲
    by _k2vp 2y ago

    I actually did that with a firefox extension + containers to scrape ChatGPT a long while back (before the APIs) https://github.com/acheong08/ChatGPT-API-agent Worked pretty well but browsers took up too much memory per
24. 24.▲
    by _k2vp 2y ago

    This has been happening for a long time. I once wrote a bypass for scraping: https://github.com/acheong08/funcaptcha A still working fork: https://github.com/xqdoo00o/funcaptcha I do apologize for
25. 25.▲
    by _k2vp 2y ago

    Apple probably has one of the largest databases. Their API is unauthenticated and not rate limited either. Can be used for both APs and cell towers: https://github.com/acheong08/apple-corelocation-experiments
26. 26.▲
    by _k2vp 2y ago

    I've been working on this over the past week after reading about it in https://news.ycombinator.com/item?id=40492234 . I found an interesting API that returns the largest network in a given tile but have failed to find
27. 27.▲
    by _k2vp 2y ago

    I’ve been experimenting with this over the past few days: https://github.com/acheong08/apple-corelocation-experiments Found some interesting things and still working on recording more MITM from my iPhone to see what el
28. 28.▲
    by _k2vp 2y ago

    I’m still in the process of experimentation. An example of the flushing thing is that you can’t simply pass the DataStream/connection directly into crates like fast-socks5 which depend on implicit behavior by the TCPStream struct which
29. 29.▲
    by _k2vp 3y ago

    Hey there! Lots of experience with this having lived in China for 2 years. I recommend you look into xray-core or v2ray. https://github.com/v2fly/v2ray-core https://github.com/XTLS/Xray-core Here
30. 30.▲
    by _k2vp 3y ago

    I recently wrote my own DNS server ( https://github.com/acheong08/CaddyNS-Manager ) - (rate limiting incomplete) It’s interesting how many people query random subdomains (e.g. admin/manage/etc)