cookiengineer
Joined 10 years ago
Karma
7,948
Submissions
2,703
Member since
Aug 15
Recent submissions
Comment · 1 day ago
It's dangerous to go alone, take this [1]
[1] https://github.com/cookiengineer/check-claude-code-exfil
Comment · 1 day ago
LGTM [1] sing
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
edit: downvoting me doesn't make it untrue, by the way. Check the leaked codebases, I dare you to provide evidence to the contrary.
Comment · 1 day ago
Had to check the nickname before I realized.
Hello, blast from the past! Feels like a lifetime ago.
I'm so grateful for WHATWG listening to the jquery community though, sizzle.js and the CSS query selector API made building dynamic websites so much easier.
Comment · 2 days ago
One of the three co-founders also founded NSO Group, and was developing the Pegasus malware.
Just for context, that is the type of evil we're talking about here.
A German comedian made an episode about it [1]
Comment · 4 days ago
Yep, can confirm.
The tutorials and hands on coding examples made me understand how to program with GPUs. I loved them because at the time, khronos was still in its infancy and just started out with GLES extensions and the whole WebGL ecosystem.
Meanwhile I kind of believe that learning where it came from (fixed function pipeline, buffer/texture and uniform problems etc) makes a lot of sense to learn first so you start thinking in shader computation pipelines much easier, as you understand the whys and whens much better.
Comment · 5 days ago
As the author pointed out, most soft routers are easily blockable because their protocol can be observed even from an opaque perspective.
Tricks for obfuscation I learned over the years:
- use exfil protocols (e.g. http smuggling via chunked encoding, DNS TXT)
- rotate exit nodes while sessions not only between (ronin behavior)
- encryption is useless with no padding or zero based padding, use one based padding instead
- scatter traffic through peers
- use manual caching everywhere, DNS TTL, HTTP entity based tracking, etc will be automatically unfeasible
- always think about the god's eye perspective of ISPs
One of my working soft router concepts, I've open sourced as Tholian Warps [1]
Comment · 6 days ago
Remember yesterday, when all the top comments here claimed that "no real software is affected by this"? The same folks who wrote that the PHP RCE isn't real and downvoted everyone claiming otherwise?
Where are all those folks now?
For reference (the thread I am talking about): https://news.ycombinator.com/item?id=50219177
Comment · 8 days ago
Did your parents have an outdoor cat before you were born?
If yes, check for [1]
Comment · 8 days ago
I'm amazed that you didn't write "come on, not with muslc???"
Read up on what ASLR does, then read the heap feng shui document (or at least towards the fourth headline in the README), then come back here. Because it does not work the way you think it does.
I even let the agent create two separate demos for this, one for ASLR and one without, but people are still to stupid to understand it.
Versions are pinned, replace it, check the fatal.php to get the initial memory distances, then retry it again. It'll work, that is the freakin point of the demo.
For the last years I've been building a (co-evolutionary) AI-driven startup in the form of the https://tholian.network
The open source projects I've built in the past can be found on Github or my personal website:
- https://github.com/cookiengineer (same account on gitlab)
- https://cookie.engineer
Fun fact: All my comments have been written on the toilet. I don't use social media anywhere else.
I only use reddit, HN, and LinkedIn. All other accounts are probably fake, because I don't like the toxicity that social media embraces as you might've guessed already.
Have a great day, stranger!