rwestergren

I think VMs with snapshots would negate the need for Vagrant.

With increasingly aggressive usage limits (Claude weekly usage now), "agentic" style of token burning seems much less practical to me. Coming from Aider and trying tools like OpenCode, the "use models to discover the relevant files" etc pattern seems very token heavy and even wasteful - whereas with Aider you include relevant files up front and use your tokens for the real work.

Agreed. Alternatives seem too "agentic" for me, where Aider strikes the right balance of AI pair programming.

One one hand, I can see the captcha is easy to fall for. On the other, nothing says "prove you aren't a machine" like "run this code that a machine could easily run."

If you have any sort of Experian bureau activity, you're at risk by this issue whether you manage your profile with this site or not

Experian allows unfreezing via their site in the article. If someone can easily recreate your account, they can unfreeze it which makes it pretty useless.

defaultdict doesn't seem to easily solve for the main topic of deeply nested values.

+1 for Fiddler, though it doesn't sound like the author was in a position to forward traffic to an HTTP proxy at the time in prod

I was scratching my head on how he was capturing requests without mentioning a proxy cert, but then I saw the security note at the bottom.

  You'll see that the data for these products is sent in plaintext to and from their servers

The API seems to have a valid cert and is listening over HTTPS - strange that the app client uses plaintext.

  curl https://api.petkt.com/
  {"error":{"code":97,"msg":"App is out of date, please upgrade"}}

I find CORS is generally a good interview question for frontend or full stack engineers.

The battery level isn't actually close to dying, in my case it just rapidly depletes from up to 40% when it's very cold. But that 40% remains intact seemingly with the screen off. Could be my phone also, but it has happened often enough that I wanted to solve it and thought this was an interesting approach.

For me, this was just a matter of convenience and not optimizing for most resilient or reliable solution. I do have backup plans for home entry.

I shared this elsewhere but I could have expressed the initial problem a little clearer, which actually was "enter my home without unlocking my phone which causes my phone to die in the cold."

Unlocking the screen caused the battery to drop immediately - it still had network connectivity prior to that.

Back from 2015, bypassing an APK signature check: https://randywestergren.com/reverse-engineering-the-yik-yak-...

Marlette Funding | Multiple Engineering Roles | Full-time | Wilmington, DE / REMOTE

Marlette Funding is a consumer financial technology (fintech) business on a mission to inspire financial confidence by helping people manage their day-to-day finances. We offer a digital financial platform with simple, accessible and personalized financial solutions including personal loans, credit cards, and a financial health product.

The company is a fast-growing fintech that has been recognized numerous times as a best workplace. If you are energized by working in a fun organization where communication is open, everyone feels included, creativity is embraced, personal growth is encouraged, and you can make positive impact on the business, Marlette is the place for you.

Senior frontend engineer: https://jobs.lever.co/marlettefunding/54bfe4d1-1fa6-4172-a40...

All open engineering positions: https://jobs.lever.co/marlettefunding?department=Technology&...

The author may have added this in after publishing:

> Many people have asked, could viruses also use the Ψ technique to beat our immune systems? In short, this is extremely unlikely. Life simply does not have the machinery to build 1-methyl-3’-pseudouridylyl nucleotides. Viruses rely on the machinery of life to reproduce themselves, and this facility is simply not there. The mRNA vaccines quickly degrade in the human body, and there is no possibility of the Ψ-modified RNA replicating with the Ψ still in there.

Good point, along with the blocking on many corporate networks. Fixed!

Context and purpose of the bash script in question is important here. In the example, the author is writing a simple bootstrap script for a dev machine. A number of the critiques here, while valid, are aimed at different use-cases.

Do you disclose every vulnerability or bug internally-discovered at your org?

I think there is a difference between a vulnerability in an internal system, and blatantly exposing data to the public requiring little technical acumen to obtain.

How is this different than any other internal/private bug found every day at orgs?

Apparently unpopular opinion: an internally-discovered vulnerability with no evidence of abuse is not a breach and does not require public disclosure.

Appreciate the feedback! My point on the price concern was that the app was not developed solely for my county, it was resold to multiple customers - at least 2,000 according to the link I posted in another comment.

I'm not sure what other customers were charged for the app, but if they were all $70K (as my County was), then that's a hefty rake.

They have at least 2K customers according to this: http://www.king5.com/tech/schools-businesses-emergency-respo...

Not sure what each customer was charged, but it sounds like the app/system was resold to individual customers at a pretty hefty price.

Interesting to note that a number of these sites were recently also serving ads vulnerable to XSS: http://randywestergren.com/widespread-xss-vulnerabilities-ad...

I understand what you mean, but an attacker wouldn't be able to decrypt during a MiTM attack since SSL is being used -- regardless of cert pinning. An effect of pinning is losing the ability to perform a self MiTM to decrypt traffic; this post simply demonstrates bypassing that.

I was pretty sure of the 3rd party integration, but still am not sure why they're checking if the user's device is rooted. I suppose for payment processing, they consider it a security risk?

Perhaps someone wasn't following the bug bounty rules?

You were spamming and rightly banned for it. https://www.reddit.com/wiki/reddiquette

I think the best solution is to not trust the client in assigning the perfectFitId. The login POST should be able to determine the perfectFitId for the user after login and maintain a session through oauth or other session management process.