_k2vp
Joined 5 months ago
Karma
1
Submissions
33
Member since
May 7
Recent submissions
Comment · 6 months ago
Comment · 8 months ago
I'm not malicious at least :)
Pretty public with who I am https://duti.dev/
Comment · 8 months ago
> The theme of the hackathon was AI
I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunter won. Not too mad, just annoyed at miscommunication about which countries the sponsor was actually in).
> If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd
The thing I've been working on is a much larger encompassing system where this would just be a small component. No code reused because no code was written for this yet. My task now is to take the shit code written during the hackathon and make it actually usable.
> The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results
Yes, the winner also won the Lovable and Claude tracks. Lovable track was specifically about vibe-coding.
I am just slightly annoyed yes.
Comment · 8 months ago
I was playing around with it a while back and forgot to remove it...
Comment · 9 months ago
> Google reportedly used their Android users to sniff APs
Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least.
Comment · 9 months ago
It does fall back to the GPS receiver if no internet and no cache but I suppose it's just more power efficient and not on anyone's minds that people would MITM for this purpose.
Comment · 9 months ago
I still can't believe that certain IOS APIs are locked to paid developer accounts only (PacketTunnel, Shortcuts, etc.) such that you can't even sideload your own app onto your own phone with these features. It's not very well documented that it's paid either. Spent forever a couple months ago figuring out why my code wasn't working before giving up and opening my wallet.
Comment · 10 months ago
Happy New Years! I can't believe it's already 2026. Posting from a flight back to the UK. Having wifi in the sky, we really are living in the future.
2025 wrapped: https://duti.dev/blog/2025/2025-in-a-nutshell/
Putting this down as my 2026 goal: At least one commit a day. Stop putting things off.
Comment · 10 months ago
Currently in China (as a visitor). Wireguard literally just works (to a VPS). Mullvad works as a commercial provider, just slower. Xray-core (vless, Trojan) if you're paranoid. I have my own proxy over syncthing relays https://github.com/acheong08/syndicate which I use to proxy to my home in the UK (residential IP) without exposing any ports.
I get rate limited to around 10mbps in Chongqing. Was slightly higher in Beijing.
Comment · 10 months ago
I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically goes App -> Packet tunnel -> SOCKS -> a child process (I used https://github.com/AdguardTeam/gomitmproxy) to handle the sniffing and reencryption.
Did post the source somewhere at some point but my git server got corrupted and I haven't gone and fixed it. https://github.com/acheong08/apple-corelocation-experiments/...
I wonder if AI is good enough to vibe code my horrible hacks into a full clone of Charles Proxy these days.
Annoying fact: Apple requires you to have a paid developer account to access the Packet Tunnel APIs. You can't even test it in XCode simulator because of how networking works in there. It's insane that I can't even develop for my own phone without paying an extra fee to Apple. The error message when you sideload without a paid account doesn't make it obvious at all and it took me a good day or two before realizing .
Comment · 11 months ago
Location: Cardiff, United Kingdom
Remote: Preferred not, but willing
Willing to relocate: Yes (Europe, North America, Singapore, Far east Asia)
Technologies: Golang, Python, Typescript, Java, Postgres, Docker, Kubernetes, Svelte, React, Ghidra
Resume: https://duti.dev/resume.pdf
Email: [email protected]
Github: https://github.com/acheong08/
Weird generalist with a mix of cybersecurity, reverse engineering, run of the mill full stack development, and devops for self hosting. I do whatever I find interesting & learn the skills required along the way.
Currently working on my own little startup but looking for a backup option in case it doesn't work out before my graduation (~April 2026).
Comment · 11 months ago
Complained about this yesterday as well: https://duti.dev/blog/2025/rot-of-undergrad/
The incentives are all messed up & universities can't even do anything about it since if they lose students by being more strict, their stats look worse.
Coming from a student, it's disheartening to see seemingly nobody even remotely interested in the subject. Nobody to talk to about interesting research, to work together on projects with, etc. I'd present something quite interesting (e.g. https://duti.dev/randoms/wip-location-services/ on the massive amounts of analytics being sent off by iPhones) and their eyes would just glaze over and say something like "nerd" or "put the fries in the bag".
I'm sure this is not the case for all universities though. I was lucky enough to intern at the University of Cambridge over the summer & it was really cool working with the PHD students there. They were all highly motivated & actively working on research.
Comment · 1 year ago
Tried [Invidious](https://github.com/iv-org/invidious)? It's really lightweight. I host my own instance: https://iv.duti.dev and it works wonders (Librewolf with strictest fingerprint resist)
Comment · 1 year ago
Huh I recognize that library. Ran into the same issues last year and made a fork.
https://github.com/acheong08/playsound
https://pypi.org/project/playsound2/
Apple Pay still does send a lot of telemetry about your payments though. https://duti.dev/randoms/wip-location-services/