Hacker News Reader

_k2vpon Chrome removes claim of On-device Al not sending data to Google Servers

> Apple Pay does not, runs the whole thing on-device, and not only is private, but as a result also enables payments entirely offline.

Apple Pay still does send a lot of telemetry about your payments though. https://duti.dev/randoms/wip-location-services/

_k2vpon Wikipedia was in read-only mode following mass admin account compromise

I'm not malicious at least :)

Pretty public with who I am https://duti.dev/

_k2vpon HackEurope 2026: A short rant on AI and hackathons

> The theme of the hackathon was AI

I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunter won. Not too mad, just annoyed at miscommunication about which countries the sponsor was actually in).

> If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd

The thing I've been working on is a much larger encompassing system where this would just be a small component. No code reused because no code was written for this yet. My task now is to take the shit code written during the hackathon and make it actually usable.

> The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results

Yes, the winner also won the Lovable and Claude tracks. Lovable track was specifically about vibe-coding.

I am just slightly annoyed yes.

_k2vpon HackEurope 2026: A short rant on AI and hackathons

I was playing around with it a while back and forgot to remove it...

_k2vpon Microsoft 365 now tracks you in real time?

> Google reportedly used their Android users to sniff APs

Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least.

https://github.com/acheong08/apple-corelocation-experiments

_k2vpon Show HN: App to spoof GPS location on iOS without jailbreaking

It does fall back to the GPS receiver if no internet and no cache but I suppose it's just more power efficient and not on anyone's minds that people would MITM for this purpose.

_k2vpon Show HN: App to spoof GPS location on iOS without jailbreaking

I still can't believe that certain IOS APIs are locked to paid developer accounts only (PacketTunnel, Shortcuts, etc.) such that you can't even sideload your own app onto your own phone with these features. It's not very well documented that it's paid either. Spent forever a couple months ago figuring out why my code wasn't working before giving up and opening my wallet.

_k2vpon Tell HN: Happy New Year

Happy New Years! I can't believe it's already 2026. Posting from a flight back to the UK. Having wifi in the sky, we really are living in the future.

2025 wrapped: https://duti.dev/blog/2025/2025-in-a-nutshell/

Putting this down as my 2026 goal: At least one commit a day. Stop putting things off.

_k2vpon Staying ahead of censors in 2025

Currently in China (as a visitor). Wireguard literally just works (to a VPS). Mullvad works as a commercial provider, just slower. Xray-core (vless, Trojan) if you're paranoid. I have my own proxy over syncthing relays https://github.com/acheong08/syndicate which I use to proxy to my home in the UK (residential IP) without exposing any ports.

I get rate limited to around 10mbps in Chongqing. Was slightly higher in Beijing.

_k2vpon Charles Proxy

I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption.

Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/...

I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.

Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .

_k2vpon Ask HN: Who wants to be hired? (December 2025)

Location: Cardiff, United Kingdom

Remote: Preferred not, but willing

Willing to relocate: Yes (Europe, North America, Singapore, Far east Asia)

Technologies: Golang, Python, Typescript, Java, Postgres, Docker, Kubernetes, Svelte, React, Ghidra

Resume: https://duti.dev/resume.pdf

Email: acheong@duti.dev

Github: https://github.com/acheong08/

Weird generalist with a mix of cybersecurity, reverse engineering, run of the mill full stack development, and devops for self hosting. I do whatever I find interesting & learn the skills required along the way.

Currently working on my own little startup but looking for a backup option in case it doesn't work out before my graduation (~April 2026).

_k2vpon "Many students are simply refusing to do *anything*."

Complained about this yesterday as well: https://duti.dev/blog/2025/rot-of-undergrad/

The incentives are all messed up & universities can't even do anything about it since if they lose students by being more strict, their stats look worse.

Coming from a student, it's disheartening to see seemingly nobody even remotely interested in the subject. Nobody to talk to about interesting research, to work together on projects with, etc. I'd present something quite interesting (e.g. https://duti.dev/randoms/wip-location-services/ on the massive amounts of analytics being sent off by iPhones) and their eyes would just glaze over and say something like "nerd" or "put the fries in the bag".

I'm sure this is not the case for all universities though. I was lucky enough to intern at the University of Cambridge over the summer & it was really cool working with the PHD students there. They were all highly motivated & actively working on research.

_k2vpon Ask HN: Does anyone else notice YouTube causing 100% CPU usage and stattering?

Tried [Invidious](https://github.com/iv-org/invidious)? It's really lightweight. I host my own instance: https://iv.duti.dev and it works wonders (Librewolf with strictest fingerprint resist)

_k2vpon Lost Chapter of Automate the Boring Stuff: Audio, Video, and Webcams in Python

Huh I recognize that library. Ran into the same issues last year and made a fork. https://github.com/acheong08/playsound https://pypi.org/project/playsound2/

_k2vpon Breaking Git with a carriage return and cloning RCE

Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git version. Still not up on Arch yet. Will refrain from pulling anything but I bet it'll take quite a while for most people to upgrade. Putting it in any reasonable popular repo where there are perhaps automated pulls will be interesting.

_k2vpon YouTube might slow down your videos if you block ads

This is why I use invidious. Much more lightweight without all the tracking and Google bullshit.

https://invidious.io

My instance https://iv.duti.dev

_k2vpon Oniux: Kernel-level Tor isolation for any Linux app

You always could by just setting the proxy environment variables (or in settings). The standard port for the tor daemon is 9050.

In fact, it's relatively easy to write a socks proxy that lets you route traffic through a arbitrary protocols. For example, I can serve/visit websites on syncthing with a socks5 proxy as a translation layer: https://github.com/acheong08/syndicate

_k2vpon What motivates you to contribute to open source projects?

I write a lot of random code that have very little economic value so there's really no point in keeping it private. Sometimes they end up being helpful for other people.

E.g. https://github.com/CopilotC-Nvim/CopilotChat.nvim was written in a single afternoon while sitting at a social event I didn't enjoy and now there's 60 contributors and I've completely handed over ownership/maintenance to the community

I still use an ancient version of obsidian on my phone because it works with my hacks to self host the native sync server https://github.com/acheong08/obi-sync

For other open source contributions, I generally just add features I want or fix random bugs. I use exclusively open source software for everything, no big tech accounts at all. So contributing only helps myself

_k2vpon My uni is using AI for assessment feedback

I'm in the UK so it would be surprising for it to be a language proficiency problem. You might be right about outsourcing and machine translation.

> "Will the application has a local repository of songs, will you use database to store songs?"

That question really doesn't make sense since it's specifically an Android development module and the MediaStore API dictates how files such as music are stored. It's definitely not the professor giving the feedback, that much is clear.

_k2vpon GrapheneOS Adds Custom Private Network Location Feature

https://github.com/acheong08/apple-corelocation-experiments

I worked on this a while back in parallel. You can dump Apple's entire database in ~2 weeks. Around 3 billion records including China.

You can compress it down to only a few gigs and have everything offline. I also got a ichnaea proxy though not as well tested. Been using it myself and it's alright,

_k2vpon Wigle.net: All the networks, found by everyone

Apple also maintains a similar database (though with only BSSID and not SSID). You can find all the BSSIDs in one area via the tile API or straight up dump the whole thing.

https://github.com/acheong08/apple-corelocation-experiments https://codeberg.org/joelkoen/wtfps/

With this you can build your own MLS using stolen data.

_k2vpon Web scraping with your web browser: Why not?

I actually did that with a firefox extension + containers to scrape ChatGPT a long while back (before the APIs)

https://github.com/acheong08/ChatGPT-API-agent

Worked pretty well but browsers took up too much memory per tab so automating thousands of accounts (what i wanted) was infeasible

_k2vpon Ask HN: ChatGPT Plus now showing captchas constantly?

This has been happening for a long time. I once wrote a bypass for scraping: https://github.com/acheong08/funcaptcha

A still working fork: https://github.com/xqdoo00o/funcaptcha

I do apologize for possibly playing a part in causing OpenAI to put up such annoying captchas even after using Cloudflare due to large scale automation of account creation & usage before an API was released…

_k2vpon Show HN: BeaconDB – An Alternative to Mozilla Location Services

Apple probably has one of the largest databases. Their API is unauthenticated and not rate limited either. Can be used for both APs and cell towers: https://github.com/acheong08/apple-corelocation-experiments

_k2vpon Show HN: A deeper dive into Apple's WI-FI geolocation service

I've been working on this over the past week after reading about it in https://news.ycombinator.com/item?id=40492234.

I found an interesting API that returns the largest network in a given tile but have failed to find the algorithm used to encode the `X-tilekey` field used for positioning. I got close with morton encoding and linear regression which works for most of the UK but deviates as you go North/South.

I'm posting this both to show what I've done and ask for help. If anyone knows how tile keys might work, please let me know (either here or in an issue). A small data sample: https://github.com/acheong08/apple-corelocation-experiments/...

Thank you.

Edit: I was initially planning on showing this way later but I can’t figure out around this problem. Thought HN would be the best place to ask since I’m probably the dumbest user here

_k2vpon Surveilling the masses with wi-fi-based positioning systems

I’ve been experimenting with this over the past few days: https://github.com/acheong08/apple-corelocation-experiments

Found some interesting things and still working on recording more MITM from my iPhone to see what else is sent.

_k2vpon Arti: A Tor Implementation in Rust

I’m still in the process of experimentation. An example of the flushing thing is that you can’t simply pass the DataStream/connection directly into crates like fast-socks5 which depend on implicit behavior by the TCPStream struct which implements the AsyncReader/Writer traits which don’t require it. I had to manually add a bunch of flushes after each write chunk.

Another thing is that some features have been partially implemented but not configurable (basically dead code for now) such as ephemeral hidden services. I spent a good few days forking and implementing that myself and am in contact with the devs to see how it could be implemented/merged in a cleaner way. Some of my code: https://gitlab.torproject.org/acheong08/arti/-/compare/main....

I wanted a socks5 proxy over a hidden service to securely expose my machine in a firewall without owning any servers in between or having to mess with port forwarding.

Now working on a new pluggable transport to tunnel tor connections over syncthing relays.

Mostly just for fun, nothing actually too useful yet

_k2vpon Tell HN: Russia has started blocking OpenVPN/WireGuard connections

Hey there! Lots of experience with this having lived in China for 2 years. I recommend you look into xray-core or v2ray.

https://github.com/v2fly/v2ray-core

https://github.com/XTLS/Xray-core

Here are my configs: https://github.com/acheong08/notes/tree/main/xray

Why this over WireGuard or OpenVPN or commercial solutions? Because it’s obfuscated and you’re much less likely to get caught. Try hosting a small game server on the same machine as well so the traffic doesn’t look too out of place.

_k2vpon Show HN: I built a guided Build your own DNS Server challenge

I recently wrote my own DNS server (https://github.com/acheong08/CaddyNS-Manager) - (rate limiting incomplete)

It’s interesting how many people query random subdomains (e.g. admin/manage/etc)