Hacker News Reader

denysvitalion Hardcoded credentials and other issues in Tata Motors App

Seems like the usual poor JA3 filtering. I use a fork of Chromium on Android and it still doesn't load

denysvitalion Firecracker VM Escape: PwnEscape Part 2

I seem to remember there's a system in place to prevent duplicates (where the submission of a duplicate link results in the upvote of the original story), but maybe that's limited to the first 24h? Idk, HN works in mysterious ways

denysvitalion Firecracker VM Escape: PwnEscape Part 2

Dupe: https://news.ycombinator.com/item?id=50381397

(Doesn't HN usually deduplicate links? I'm confused)

denysvitalion Hardcoded credentials and other issues in Tata Motors App

Times out after the TLS handshake.

https://pastebin.com/raw/mncT5drA

denysvitalion Mac at any scale

Thanks for the good laugh. Rofl

denysvitalion Preparing for the Flipper One Kickstarter and opening pre-orders

Really feature complete: https://x.com/flipper_net/status/2117746400754876911

denysvitalion Japan's trains are great. Why is booking one so hard?

I don't have a better way to validate my claim, so please feel free to correct me, but it seems like Switzerland and Japan have a similar concentration of transportation companies per 1000km² [1], yet with the SBB Mobile App [2] you're able to book any journey within Switzerland (and even cross-country) by just selecting origin and destination.

I think there's no excuse to just have a better transportation system, and I think every country should aim at excellence in this field (along with having public transport arriving on time).

[1]: https://www.perplexity.ai/search/08b4e2d1-f249-4827-8b69-2f3...

[2]: https://www.sbb.ch/en/travel-information/apps/sbb-mobile.htm...

denysvitalion Japan's trains are great. Why is booking one so hard?

Seriously? I shouldn't have to use a tourist agency to buy a train ticket...

> Can you give an example?

In the Kanazawa area, almost all buses operating there were missing. I also don't know how, but they seem to have like 4+ different bus operators for such a small town. I also tried building a solution for myself using the available GTFS feeds, but unsurprisingly almost none were available (thus it's not really Google Maps' fault).

denysvitalion Japan's trains are great. Why is booking one so hard?

Yes but... https://e5489.jr-odekake.net/ returns 404.

denysvitalion Japan's trains are great. Why is booking one so hard?

I already ranted a bit about this in my conclusion of this blog post [1], but I'm happy to rant again here: it's beyond my comprehension why planning a train journey in Japan has to be this messed up. You first have to figure out the route (and Google Maps doesn't have all the operators there, so good luck), then you have to figure out how to buy the ticket for said route - which is an entire different system for each operator (e.g: JR East and JR West are completely different in their booking system) - even if you do it in person, each operator has its own machine and some tickets cannot be bought by credit card.

Then you have to deal with the consequences of Japan never modernizing (trying to use a credit card for the online reservation is painful, although things are improving a bit on this side). A few years back, less than 5, it was also impossible to reserve a train ticket using a foreign credit card (non Japan-issued Mastercard, with 3d-secure). I also had a very negative experience using a virtual credit card as you need a physical one to pick up your tickets...

I always want to laugh and cry at the same time when I read their domain name for booking the ticket (because of course their app is only available in the Japanese Play Store / App Store): https://e5489.jr-odekake.net/e5489/ibpc/CBTopMenuPC?LANG=en

Try any other variation of the above URL and you get... a 404.

Anyways, beside this, it's such a beautiful country. Can't wait to go back again.

[1]: https://blog.denv.it/posts/goodbye-travel-agents-hello-ai-ag...

denysvitalion PHP2Shell: Exploitation attempts and remediation trends

> but these scanners did successfully exploit Adel Karimi's honeypot, which was a likely contributing factor to CISA’s decision to include PHP2Shell in their KEV list.

Adel is doing an amazing job. Both in open source (https://github.com/perplexityai/bumblebee, https://github.com/perplexityai/numbat, https://github.com/0x4D31/galah) and with his reports.

So proud of him!

denysvitalion Reverse engineering a Beyblade launch tracker

> Beyblade

I’d completely forgotten about them, but just seeing that word brought back so many memories. Thanks for the post!

denysvitalion eMudhra to exit global SSL/TLS certificate business

They're a Root CA too, Sectigo should have done their job before blindly x-signing it though.

denysvitalion eMudhra to exit global SSL/TLS certificate business

Worse yet, why is that CA even part of the Root CAs shipped on all the modern devices?

My trust in those vetting the CAs is completely broken now.

denysvitalion Mistral Large 4

I was confused and thought it's a new model... but no, it's the same. What's the purpose of reposting this as a new story? Am I missing something?

denysvitalion LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials

I'd add "AGAIN" to the title

denysvitalion eMudhra intermediate CA compromise

If you see a certificate error, you're good. There's a checker on the website, but this is the easiest way to curl on your system and check

denysvitalion eMudhra intermediate CA compromise

If you can see this, you're affected. Update your system trust store immediately.

https://dv-g3b-emudhra.we-have-a-problem.com/

denysvitalion OpenCode 2.0

They might have fixed it in the meantime though

Edit: indeed https://github.com/anomalyco/opencode/commit/d099d2cb2a0869d... / https://github.com/anomalyco/opencode/pull/55586

denysvitalion OpenCode 2.0

Their installer (curl | sh) was taking so long yesterday for me.

It turns out it's incredibly slow... because of the progress bar rendering. This is insane. The installer took 6 minutes to reach 10%:

curl -fsSL https://opencode.ai/v2/install | bash

Managed to fix it by running this instead:

curl -fsSL https://opencode.ai/v2/install | bash 2>&1 | cat

denysvitalion Show HN: Carrier-Explode: iPhone, Pixel and Galaxy carrier settings decoded

What's more useful, or at least was a while ago, is the CA combos list - basically showing which bands can be aggregated and how.

A while ago I built a decoder for that (Qualcomm only!), it was fun and helped me improve the support of my device for my carrier.

https://github.com/denysvitali/ca-combos-editor

denysvitalion Germany’s RobCo hits $1B valuation

First thing that came to mind. I have to admit, I was a bit disappointed.

https://fallout.fandom.com/wiki/RobCo_Industries

denysvitalion Gemini 4 Argon

> After the introductory period expires, the price of $4 per 1M input tokens and $20 per 1M output tokens will apply.

denysvitalion GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price

They're pacing the frontier

denysvitalion PostmarketOS is rebranding as Nura

Can I see your contributions to the project?

denysvitalion PostmarketOS is rebranding as Nura

https://gitlab.postmarketos.org/denysvitali

https://gitlab.com/sm8250-mainline/linux/-/merge_requests/8

https://wiki.nura.eco/wiki/Special:Contributions/Denvit

https://blog.denv.it/posts/pmos-k3s-cluster/

denysvitalion PostmarketOS is rebranding as Nura

FYI: they don't accept AI contributions.

From experience, AI is a 10x (or more) booster for getting a new device up and running - or porting mainline Linux to those super old (3.x) kernel forks.

I'll not contribute back anymore - this is a real bummer, but I guess they made their choice.

Context: https://news.ycombinator.com/item?id=49704503#49745309

https://docs.nura.eco/policies-and-processes/development/ai-...

denysvitalion Claude Opus 5.5 – Pelican Game

Source: https://x.com/criscxuan/status/2102587659562721734

denysvitalion Show HN: Drop – A rootless Linux sandbox with gVisor support

I've built something similar, but used landlock instead: https://github.com/denysvitali/boxy

denysvitalion Noodle Gallery – Self-hosted photo and video manager forked from Immich

A better link: https://github.com/open-noodle/gallery

Seems to be a fork of Immich. They claim performance is a goal but it's still written in Node.JS? Curious.

I tried to do something very similar a while back (https://github.com/denysvitali/immich-go-backend) but didn't fully follow through. Immich sucks, sadly, performance wise and in terms of storage (they don't support S3, WTF).

I'll eventually get back go it and complete my port.

For more context: https://news.ycombinator.com/item?id=46171726