jwally

I'm feeling pretty depressed right now, and hopefully sharing this little anomaly I discovered in January might help someone make the world a better place, and figure out how to put a dent in online crime. Fuck…

Why not just publish your API docs and let the client's bot chain together what calls need to be made. You could even repurpose the MCP so you only ever produce the API documentation as EVERY response. No LLM necessary.

My humble attempt to detect residential proxies while limiting false positives on things like CGNAT. So far, its pretty successful detecting SOAX, BrightData, and a custom proxy app I built for my phone - but I have a…

tldr; I wanted to see if I could make a QR Captcha (like reCaptcha did) that didn't rely on Google PLAY (like reCaptcha does). Inspiration here: [https://news.ycombinator.com/item?id=48039362]

I wanted to play an FPS with my kids. Every option required creating accounts, installing launchers, granting permissions, downloading companion apps — a 20-minute ordeal before anyone fires a shot. Per person. I just…

======================== What is this? ======================== A short demo showing how a merchant can outsource age verification to a trusted institution (bank/KYC provider) with minimal cost and minimal data leakage.…

So I'm not an expert in this area, but here's an attempt at cost effective, anonymous, age verification flow that probably covers ~70% of use cases in the United States. The basic premise is to leverage your bank (who…

I wanted a way to limit what channels on youtube my kids could watch, so I built this over the weekend with Claude. Whats nice is it still works even though we're blocking youtube and youtube-kids through PiHole. No…

Neat little nodejs/cli tool for putting all of your project's files into 1. I built it for LLM assistance with small-ish projects.

So the main purpose here is to show _a_ way that session-token theft can be mitigated. Clearly, this isn't NSA proof or something you'd use to secure a BL5 containment facility, but to prevent session-jacking; if feels…

I saw an article this morning that Google is planning on exposing an API in Chrome to tie cookies to a user's machine via public key cryptography and the TPM. I humbly submit what I think as a much simpler approach that…

At my previous job, the bank used GoPhishMe to conduct internal phishing tests on employees. Clicking a dubious link or downloading a shady file led to an informative email about the dangers and tricks used by real…

I wanted to make a QR for a local fund-raiser, and couldn't find one online that I loved - so I made this. Add a picture, change colors, customize the CSS (the QR Code is an SVG made of "rect" elements), download the QR…

I got an e-mail today buy someone using github as a CDN to phish passwords, pretending to be AMEX. He sent it to my "Batteries Plus" e-mail account. Is there someone I can reach out to to shut this account down?…

For example, say I own "bank.com". A phisher purchases "bank.evil". They make the login page at "bank.evil" look like the one at "bank.com" Whenever a victim goes to "bank.evil" it connects to a server, that connects to…

I just found out that I’m losing my job at the end of the year - but the current employer owes $108k in severance if I stay through the end. I’m a self taught developer with no experience in a real dev shop. Recruiters…

I'm probably missing something obvious, but based on the instructions in this article it seems like making all comments anonymous (and all profiles private) would go a long way to reducing the problem of…