For fun (and $30) I had DeepSeekFlash try to dismantle as many hardened JavaScript sdks as I could find (TikTok, Fingerprint, etc). I did like 20 in all - and ranked them half heartedly. Twilio was the nastiest at $5 and 1.5 hrs of work.
979 karma · joined October 7, 2014
That should give some hint about how difficult it is to do in real life, at scale.
Dialects and syntax are weirdly fascinating .
Obviously, this would be a SAAS -I wouldn't want webmaster at jocokfuel.com or whatever having to roll their own rust stun server and make TCP RTT measurements :-)
Spun up a quick and dirty demo at https://proxy.kyc.red
More detailed description is in there.
I just ran some proxied sessions through your demo - really impressive! FWIW, make the "BLOCKED" text bright red and bold - success/accepted green.
Would love to chat more about what you're doing and how you're doing it.
I'm justin at wolcott dot io
:salute
Remote: preferred
Willing to relocate: No
Technologies: TypeScript/JavaScript, Node.js, AWS, Cloudflare Workers, distributed systems, high-scale data pipelines, fraud/security
Senior technical lead specializing in ambiguous, high-scale systems. I turn messy security, infrastructure, and data problems into pragmatic production systems—recently cutting cloud costs by $200K+/year. Seeking senior/staff engineering or technical leadership roles with real ownership.
LinkedIn: https://www.linkedin.com/in/justinwwolcott
Email: justin@wolcott.io
If you're needing to give the model direct and broad access to your SqlServer instance...I don't get it.
Dedicated customer facing API is like whitelisting approved actions; MCP feels like getting an LLM to enforce a complex blacklist.
Sam Neil - Gone. Sean Connery - Gone. Tim Curry - (now)Gone.
All the big names from my childhood are starting to die... Damn.
Plus, I can verify for employers that I am a real human with a real employment history snd I can prove it...by giving them my SSN and Mother's Maiden name? What stops a bad guy from speed rushing the dark web, registering these things en masse and selling access to DPRK?
IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.
You take IP down, you kill the cancer but you also end up killing the patient.
Phillip K. Dick meets Idiocracy.
The analogy du jour for me is describing AI as the iron man suit. If you are tony stark it makes you a god. If you are my grandma, it makes you meet God.
If it were a box of drugs and he triggers an incendiary device - he's in trouble . If agents trip a protective boobie trap and destroy the box- he is fine.
Don't know why but this feels correct to me.
Realistically though, whats worse - this thing going rogue or OpenClaud breaking out of its container and shredding a nation's infrastructure like a platoon of gremlins? Genuine question...
Dedicated Infrastructure > automation > ad hoc scripts > non deterministic llms from a dependability perspective alone. Using an LLM to do something that prettier could have done is analogous to using a 3d printer to nail up a fence.
I created a json like schema/struct/whatever to describe the problem. Maybe adopt something like this and more people will be able to see how they could use your tool:
https://github.com/JWally/jsLPSolver/blob/master/API.md
I need to re go through the docs, but you get the gist.
Here is the Berlin Airlift problem for example:
const model = { optimize: "capacity", opType: "max", constraints: { plane: { max: 44 }, person: { max: 512 }, cost: { max: 300000 }, }, variables: { brit: { capacity: 20000, plane: 1, person: 8, cost: 5000 }, yank: { capacity: 30000, plane: 1, person: 16, cost: 9000 }, }, };
China gets sanctions and stale chips - fine, they just DIY the algorithms through CPU instead of GPU and open source it.
American warships have the latest, coolest, highest-tech tactical weaponry imaginable - which is great until you have to fend off 10,000 consumer/wal-mart/IED grade drones at $2mm/clip.
Money is amazing, but if you lean on it too heavily in lieu of _practical_ innovation, it'll bite you in the ass. The apocryphal story of the Soviet Rocket scientist who suggested using a pencil instead of investing 100k in a space pen that worked in 0g's.
DeepSeek and Qwen would have been neat parlor tricks, never developed further because the US subsidized mega models would have been too cheap and reliable to make them necessary.
Nope! USA played its hand and forced the world to have to account for its USA exposure risk and deversify. A serious one time use strategic advantage pissed away.
Doesnt really bother me personally per se; but armchair quarterbacking the USA's decisions seem Suboptimal...
TBH, its never anything super exotic (though it helps) but simple stupid basic things like cookies that does 70% of the work here. Also, your IP address at home is _really_stable_.
If I can give you a sticky cookie (cookies, indexdb, localstorage), a half-assed fingerprint, and tie it to your IP-address, and know you're not on a cell-tower; this is probably good enough for most purposes.
Use safari on private relay in private mode.
At the same time they don't want their data turned over and sold to the kind of people who scrape LinkedIn.
Plus - Your data is LinkedIn's cash cow. They're not going to leave it out for every Tom, Dick, and Harry to export en masse whenever they want.
They start with a supercookie approach (first-party cookies, third party cookies, indexdb, localstorage, session storage, favicon timing, etc) which is a direct look up, and unique. This is tier-1.
Next they slam as many signals as they can get your browser and network to cough up into an ML db and find your nearest neighbor. If its greater than threshold ${x} - they return its ID with a confidenc of say 85%
If that misses, they slide down to tier 3 which is your IP address plus some browser signals on a TTL so they don't just call everyone with your IP address "you". This is maybe say 50% confident.
Below that, they create a new record.
If you want to beat it - tbh - Safari, especially on IOS is a monster. Most people with an iPhone default to it, and they remove their biggest entropy signals (offlineAudio, canvas profiling), so they're left with almost nothing to work with that is really unique.
Fingerprint _really_ pushes merchants to reverse proxy their services so that they can serve cookies as first party and Apple doesn't nuke them after 1 week. Its complicated and most merchants don't want to diddle with it - but it circumvents adblockers (ps - use an adblocker and call out fingerprint specifically if you want to hit them. LLM to see who else you need to include).
After that, if you're on Apple, use their Apple-VPN service (forget what its called) - which exists _literally_ for this.
That's really cool - thanks for sharing!