mmsc

Why would the company need to figure it out from commit hashes? It's all public, in public GitHub repositories, with the person's personal GitHub account: https://github.com/auth0/nextjs-auth0/pull/2381

(op here)

On the one hand, you're right, it is distasteful, I completely agree. On the other hand, GitHub and Google and the public domain internet isn't everybody's CV that they can pick and choose which of their actions are publicised, tailored towards only their successes.

>First, the typical AI-powered reporter, especially one just pasting GPT output into a submission form, neither knows enough about the actual codebase being examined nor understands the security implications well enough to provide insight that projects need.

How ironic, considering every time I've reported a complicated issue to a program on HackerOne, the triggers have completely rejected them because they do not understand the complicated codebase that they are triaging for.

Also the curl examples given in TFA completely ignore recent developments, where curl's maintainers welcomed and fixed literally hundred of AI-found bugs: https://www.theregister.com/2025/10/02/curl_project_swamped_...

There's a restaurant in Sarajevo which specializes in this stuff, called The Singing Nettle. Recommended.

It's also possible to pack a whole codebase into "before main()" - or with no main() at all. I was recently experimenting doing this, as well as a whole codebase that only uses main() and calls itself over and over. Good fun: https://joshua.hu/packing-codebase-into-single-function-disr...

If you'd like to print the middle of a file, try out `body`: https://github.com/megamansec/body

>after having received a lukewarm and laconic response from the HackerOne triage team.

A slight digression but lol, this is my experience with all of the bug bounty platforms. Reporting issues which are actually complicated or require an in depth understanding of technology are brickwalled, because reports of difficult problems are written for .. people who understand difficult problems and difficult technology. The runarounds are not worth the time for people who try to solve difficult problems because they have better things to do.

At least cloudflare has a competent security team that can step in and say "yeah, we can look into this because we actually understand our whole technology". It's sad that to get through to a human on these platforms you have to effectively write two reports: one for the triagers who don't understand the technology at all, and one for the competent people who actually know what they're doing.

TFA calls it unhinged, I call it creative and exciting. Now all we get is rounded edges, solid colours, and "copies of reality" - boring; if I wanted reality I'd go outside and touch grass.

FYI, it's quite easy to support both Firefox and chrome (both mv2 and mv3, even) in a single extension codebase.

Thank you, it means a lot.

Always fun to wake up (ok; I didn't wake up, I got off a 10 hour flight) to see my work on the front page of hn.

I'll be doing a retrospective in a few weeks when the dust has settled, as well as new tools I've been made aware of.

> rent a server

> infect it with unremovable backdoor

> stop paying server so company rents server to somebody else

> ????

> profit!

Use fbpurity

It'd be nice to have a feature in uBlock origin where you can block certain websites' ip addresses, with a requirement to re-resolve the ip address every few days to ensure the ip hasn't been rotated (blocking unnecessary websites due to the cache).

Currently living through a great litmus test of competency versus luck by company leaders

I think what will happen in the future is that the people that drink, will be drinking way more; while the people that rarely drink, will more rarely drink.

Is there a bug bounty? I found an open redirect.

Is this a bot? Three day creation date and the sentence of TFA is

>Last night at a Hacker News meetup, I shared something

That's more or less how Project Honey Pot [0] worked for forums, blogs, and elsewhere. Cloudflare spawned from this project, as I remember, and Matthew Prince was the founder.

[0]: https://en.wikipedia.org/wiki/Project_Honey_Pot

this requires being signed in (obviously), which doesn't help with the limit tracking part of hating these things

https://github.com/samyk/slipstream is the new one

China watching with open eyes.

This will happen the day that they try to take Taiwan, worldwide, in my opinion.

Most people are already uninteresting. They're not trying to be interesting; that simply isn't their goal (nor need it be). Most people follow trends and shudder at the thought or creating trends themselves.

It's always been like that and always will be.

It's impressive nobody else has registered this domain before:

$ whois npnjs.com

[..]

Creation Date: 2025-07-14T07:00:00Z

Yes! And for macOS, `chflags uappnd .bash_history`

.bash_history

Popped by AB of Ac1dB1tch3z

Indeed, it's not a secret and it's not just extensions and VPNs, but everything you could imagine. Lots of applications that advertise themselves as "ways to make money for your unused internet bandwidth" are available which do this -- openly.

This type of software is bundled into system executables as well - just like the "free antivirus and browser toolbars" of yesterday, these are the new bundled software.

If a company has an "internal network" (lol) that consists of security that can be described as Swiss cheese, then this stuff is a massive gap there.

Even if some people are not ready for the day, it cannot always be night.

Would be nice to have something similar to this for Mixpanel and Amplitude