#https

well guess this is a good time to reshare some of my fave fics that aren’t on ao3 in case y’all are already slowly suffering withdrawals and need that fic fix

We made a website to check if your http client is vulnerable to CVE-2026-111497 (Node2Shell/HTTP2Shell) Also open-source: Some examples:

Research: we reproduced CVE-2026-109618/109619 on php:8.4.26-apache (aarch64). Pure HTTP - no gdb, no /proc on target. 4 requests: arm -> 819,200-byte disclosure -> addresses -> system() as www-data. 6/6 runs, ASLR different every time. Tonight: every step

Introducing IP Shield on PARANOID. Your IP address can give away your city, your home and, through your internet provider, your name. Until now it traveled with every question you asked. Turn on IP Shield and the server that reads your questions never sees your IP address, so what you ask can no longer be traced back to where you are. How is that possible? Your browser does the work before anything leaves your computer. When you ask a question, your browser takes PARANOID’s public key and seals the entire request with HPKE, the modern encryption standard that pairs an X25519 key exchange with AES-GCM. Every question gets a brand new one-time key, so even two questions from the same person look like strangers to each other. The sealed request goes to a relay first. The relay sees your IP address next to a block of bytes it cannot read, and it passes those bytes on under its own address. Only PARANOID’s private key can open them, and inside it finds your question with the relay’s address on it instead of yours. The answer travels back the same way, sealed with a key that only your browser holds, so the relay never reads that either. This is Oblivious HTTP, the IETF standard published as RFC 9458. It is the same design that sits in front of Apple’s Private Cloud Compute and Chrome’s Safe Browsing checks, and now it sits in front of your AI chats. It is one switch above the chat, with nothing to install. Live today at

Anthropic Engineering Lead Felix Rieseberg revealed how they monitor Claude Code in production before Fable drops, multi-agent runs on Sonnet 5.5 and Opus 5.5 hide a lethal loop that burns entire token budgets in silence the fix is not more logs, it is this single flag: export CLAUDE_CODE_ENABLE_TELEMETRY=1 why naive agent clusters crash and burn budget: - 40,000-line flat terminal logs hide which subagent hallucinated invalid state - recursive retry loops burn hundreds of dollars on unmonitored failures - zero cache visibility hides whether prompts hit prefix cache or re-tokenize Anthropic solved this with their official telemetry guide: anthropics/claude-code-monitoring-guide the architecture replaces blind console dumps with distributed OpenTelemetry trace DAGs: 1. W3C Distributed Trace Context every agent session generates a root trace ID with typed child spans planning spans, tool execution spans, and subagent forks track exact causal parentage isolate root failures in milliseconds instead of grepping flat stdout 2. Prefix-Cache Telemetry Prometheus tracks claude_code_token_usage by cacheRead and cacheCreation monitor 90%+ prompt cache hit ratios in real time across Sonnet 5.5 and Opus 5.5 stop paying frontier token prices on static system instructions 3. Automated Circuit Breakers detect unmonitored retry spirals before token budgets explode OTel collector halts execution the second an agent triggers an identical error loop zero recursive token burn, deterministic spend caps, and instant alert routing 4. Real-Time Prometheus Cost Meters claude_code_cost_usage streams cost per session, per model, and per tool track exact ROI per bug fix and feature commit directly inside Prometheus and Grafana run this prompt inside Claude Code to configure production observability: "Configure my Claude Code workspace for OpenTelemetry and Prometheus observability using anthropics/claude-code-monitoring-guide: 1. Activate native telemetry in ~/.claude/settings.json: - export CLAUDE_CODE_ENABLE_TELEMETRY=1 - configure OTEL_METRICS_EXPORTER=otlp with endpoint http://localhost:4317 - enable W3C trace context propagation across all tool calls 2. Spin up the monitoring stack from docker-compose.yml: - set up Prometheus scraper for claude_code_cost_usage and token usage - configure Grafana dashboard tracking cache hit ratio and session durations - alert on recursive retry loops exceeding 3 identical tool errors 3. Set up dual-model span routing: - Builder agent on Sonnet 5.5: trace code generation and test execution spans - Evaluator agent on Opus 5.5: trace independent review and rubric validation Show me the configuration diff first. Await confirmation before applying" ↳

1/ HTTP has a status code for payments that was never really used: 402 Payment Required x402 is an open standard that puts it to work A server asks for payment inside a normal request, and a client, like an AI agent, pays without a checkout page or an account... kinda genius

REST vs GraphQL vs gRPC vs WebSockets. 𝗥𝗘𝗦𝗧 exposes resources through HTTP endpoints, making it practical for public APIs and standard CRUD operations. With 𝗚𝗿𝗮𝗽𝗵𝗤𝗟, clients can request specific fields and related data, making it useful when different clients need different data shapes. 𝗴𝗥𝗣𝗖 uses strongly typed contracts and efficient serialization, making it well suited for backend service communication. For real-time communication, 𝗪𝗲𝗯𝗦𝗼𝗰𝗸𝗲𝘁𝘀 enable persistent, two-way connections, allowing applications to exchange data as events happen. But exchanging data in real time doesn't necessarily mean an application can respond naturally. Take AI voice agents used in customer support. They need to do more than stream audio. They also need to handle interruptions, understand conversational context, and adapt how they respond, while meeting enterprise security and deployment requirements. Deepgram Flux TTS addresses the speech generation side of this by using conversational context to adjust tone, pacing, and emotion in real time. For example, a support agent can respond empathetically to a frustrated customer, then switch to clearly reading out a tracking number. Combined with streaming and interruption handling, this helps developers build more natural voice experiences without scripting every interaction. 𝗛𝗲𝗮𝗿 𝗙𝗹𝘂𝘅 𝗧𝗧𝗦 𝗶𝗻 𝗮𝗰𝘁𝗶𝗼𝗻 → What else would you add? —— ♻️ Repost to help others learn and grow. 🙏 Thanks to @DeepgramAI for sponsoring this post. ➕ Follow me ( Nikki Siapno ) to improve at system design and AI.

Cybersecurity essentials

‼️ PHP patches Windows builds AGAIN, just 5 days after the PHP2Shell fixes. This time, a Brotli flaw could allow code execution when cURL automatically decompresses crafted HTTP responses. Updated builds cover PHP 8.2–8.5. Full details:

How long does it take to become an Ethical Hacker? Foundation = 1–3 Months (Networking, Linux, Windows, TCP/IP, Cybersecurity Basics) Programming = 2–4 Months (Python, Bash, PowerShell, Git, Automation Scripts) Web Hacking = 4–8 Months (HTTP/HTTPS, HTML, JavaScript, OWASP Top 10, Burp Suite) Network Penetration Testing = 6–12 Months (Nmap, Wireshark, Metasploit, SMB, Active Directory, Privilege Escalation) Bug Bounty Hunting = 6–18 Months (Recon, Subdomain Enumeration, XSS, SQLi, SSRF, API Security, Reporting) Red Teaming = 1–2 Years (Phishing, Initial Access, C2 Frameworks, Lateral Movement, Evasion Techniques) Wireless Hacking = 3–6 Months (Wi-Fi Security, WPA/WPA2, Evil Twin, Aircrack-ng, Bluetooth Attacks) Cloud Pentesting = 6–12 Months (AWS, Azure, IAM, Kubernetes, Docker, Cloud Misconfigurations) Mobile Application Hacking = 6–12 Months (Android, iOS, Frida, MobSF, Reverse Engineering, API Testing) Expert Ethical Hacker = 2–5+ Years (Advanced Exploit Development, Reverse Engineering, Malware Analysis, Active Directory Attacks, Custom Tools, Real-World Engagements)

#おはようVTuber #おはV みてみてみて‼️ 初動くおはVなの~♡ ⟡.· ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ ⟡.· YouTube♡ Twitch♡ ⟡.· ⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯ ⟡.· #新人VTuber #VTuber準備中 #IRIAMライバーさんと仲良くなりたい #VTuber ╭━━━━━━━━━━━━━━╮ 　可愛い？かわいい？カワイイ？ ╰━━━━━━━━v━━━━━╯

THIS IS A PURE F*CKING GOLDMINE you can now connect Claude Opus 5.5, GPT-Terra 6.1, or Sonnet 5.5 directly into an isolated cloud Ubuntu microVM over hosted MCP Sandboxer gives your agent full root access and its own kernel, so you can close your laptop while long tests run: how the architecture works: 1. Dedicated Cloud Kernel • runs in a Cloud Hypervisor microVM off your machine • full Ubuntu 24.04 with systemd as PID 1 and root access • Docker daemon pre-loaded and /dev/kvm enabled for nested jobs 2. Hosted MCP (Zero Install) • connect to sandboxer .com/mcp via Streamable HTTP • 18 sandbox tools ready instantly in Cursor, Claude, Codex, or ChatGPT • headless runs authenticate with an API key 3. The Autonomous Tool Loop • create_sandbox spins up the machine in 38ms • detached exec returns a processId so long builds never time out • command_status streams logs in real time • host_port exposes any internal port to a public HTTPS URL • stop_sandbox snapshots RAM to NVMe and stops billing immediately 4. Close Your Laptop Safe • run handoff_session in sbx mcp • checkpoints your repo on a temp branch and moves the session to the cloud • your .env stays on your local disk with zero cloud leaks the numbers: → $0.00/hr while paused (memory preserved in snapshot) → $0.036/hr only while actively running → versioned snapshots ensure two agents never overwrite state the prompt to paste into your agent once you add the MCP server: "Add sandboxer .com/mcp. Create a sandbox, clone this repo into it, run the tests detached, and publish the port. When the work is done, stop it so the memory stays and the bill stops. Show me the tool calls before you delete anything" try it here: ↳

Sandboxer is live:

What happens when an AI agent needs to pay for an API or service? A look back at a @hedera Technical Community Call with @ed__marquez and Narbeh Shahnazarian, exploring how x402 enables pay-per-request agent payments on Hedera. Catch the recap 👇

i pointed Claude Code at my own router. my internet provider sees every site i open before the page even loads no hacking, nothing changed, one prompt: "audit my home network. what can my provider see?" here's what it found: → my router sends every DNS lookup straight to a Telecom Italia server, plain udp/53, zero encryption → the router admin panel runs on http://, so the login crosses my network unencrypted → 4 devices online, 2 of them hiding behind random MACs (that part's good) → upnp off, telnet and ssh closed, nothing inside is punching holes to the internet quick translation if you're not into networking. every time you open a site, your device first asks "where is that question is DNS, and on most provider routers it goes to the provider in plain text. https hides what you do on the page, it doesn't hide which site you opened so your provider can keep a timestamped list of every site from every device in your house the fix took me 2 minutes: 1. Windows → network → DNS → 1.1.1.1 or 9.9.9.9, DNS over HTTPS on 2. Android → settings → private DNS → 3. iPhone → the free 1.1.1.1 app 4. if the router password is still the one on the sticker, change it, over a cable save this, the prompt to run it on yours is below

Only serious people should say Hi to me ♥️👎 Telegram zangi: 8250062651 signal: 4105567072

That padlock in your browser doesn't mean a website is safe. It never did. It only means your connection is encrypted. Scam sites can get the same padlock for free. Did you think it meant safe? Reply YES. #cybersecurity #https #barelyworking

一键反编译 Android 应用并逆向提取全套 HTTP API 的 AI 技能扩展：Android Reverse Engineering Skill 📱🔓 告别繁琐的静态分析，让 Claude 帮你秒级分析 APK/XAPK、恢复混淆类名并提取完整 API 接口与鉴权逻辑 👥 【适用人群】 适合需要快速逆向分析 Android 应用、提取第三方服务 API 接口、分析应用安全漏洞或重构代码逻辑的移动端开发者与安全研究人员 🎯 【核心 3 大杀手级功能与架构亮点】 1️⃣ 快速指纹识别与智能反编译：秒级检测 Flutter/RN 框架与混淆层，内置 jadx 及 Fernflower 引擎双向比对 2️⃣ Kotlin 混淆恢复与 API 提取：利用 Kotlin 元数据还原被 R8 混淆的 ViewModel/Repository 类名，自动提取 Retrofit/Ktor 接口与 HMAC 签名逻辑 3️⃣ 端到端调用流链路追踪：从 Manifest 页面交互层追踪至 ViewModel 并下钻到底层 HTTP 网络请求，透视完整架构 💡 架构亮点：采用跨平台 Shell 与 PowerShell 脚本封装底层 JADX 工具链，作为 Claude Code 插件无缝嵌入 AI 驱动的命令行逆向工作流 ⚡️【极速安装与挂载指令】 在 Claude Code 中直接执行命令即可添加该 Skill： /plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill ⭐ Star 数：约 8.2k 🔗 开源仓库： #Android #ReverseEngineering #ClaudeCode #JADX #APK #API #开源项目 #开发者工具 #安全工具

If you started using AI agents this year, make them reverse engineer these 32 things first Here are all 32, free and open source, with REA. Save the list, then start with the one closest to your work: APPS & WEB desktop installations → Find what an app is made of. JavaScript apps → Modules, routes and source maps. Electron apps → Trace renderer to main process. websites → DOM, scripts and requests. HAR / SAZ captures → Rebuild requests and responses. .NET assemblies → Read metadata and CIL. PyInstaller executables → Extract scripts and bytecode. running processes → Compare behavior across runs. ANDROID, GAMES & APPLE APKs → Manifest, classes and methods. APK signatures → Check v1, v2 and v3 signers. Android devices → Packages, logs and screenshots. Android resources → Manifest, strings and locales. Flutter apps → Engine build and libraries. Unity IL2CPP → Type names and methods. Godot PCK → Open game archives. Apple crash reports → Threads, registers and crash types. NATIVE BINARIES native executables → Pseudocode, calls and strings. ELF files → Sections, symbols and mitigations. Go binaries → Compiler version and modules. Rust binaries → Crates and dependency graph. PE imports → DLLs, IAT and import hash. PE certificates → Authenticode signers. Linux kernel modules → Metadata and signatures. Erlang BEAM → Atoms, imports and exports. FIRMWARE, PROTOCOLS & DATA firmware images → Extract the filesystem. WebAssembly → Imports, exports and readable WAT. EVM bytecode → Selectors and mutability. SQLite databases → Tables, indexes and rows. Linux crash dumps → Signals, registers and threads. PCAP / PCAPNG → Endpoints, DNS and HTTP. logic-analyzer recordings → Decode hardware signals. AI model files → GGUF and safetensors metadata. Don’t try all 32 tonight. Pick the group closest to your daily work and run one target from it. Give it a week of real tasks. If it saves you time, keep it and add the next. 3 targets you use daily beat 32 on a list. Full list and what each one needs:

REA hit #1 on GitHub trending, and most people still run it inside a single chat Split it into 4 subagents and one command takes a program you own from sealed binary to a tested rebuild with a match rate Set it up once, aim it at the next one:

Say hi to me if you see this post❤️ Telegram zangi: 8250062651 signal: 4105567072