hktonylee

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

At the beginning of 2030, I found this essay in my archives. From what I know today, I think it was very insightful at the moment of writing. And I feel it should be published because it can teach us, Rust developers, how to prevent that sad story from happening again.

What killed Haskell, could kill Rust, too

What killed Haskell, could kill Rust, too. Why would I even mention Haskell in this context? Well, Haskell and Rust are deeply related. Not because Rust is Haskell without HKTs. (Some of you know what that means, and the rest of you will wonder for a very long time). Much of the style of Rust is similar in many ways to the style of Haskell. In some sense Rust is a reincarnation of Haskell, with a little bit of C-ish like syntax, a very small amount.

Is Haskell dead?

Programming as Theory Building

Peter Naur

Peter Naur's classic 1985 essay "Programming as Theory Building" argues that a program is not its source code. A program is a shared mental construct (he uses the word theory) that lives in the minds of the people who work on it. If you lose the people, you lose the program. The code is merely a written representation of the program, and it's lossy, so you can't reconstruct

	#!/usr/bin/env -S bash -c "docker run -p 8080:8080 -it --rm \$(docker build --progress plain -f \$0 . 2>&1 \| tee /dev/stderr \| grep -oP 'sha256:[0-9a-f]*')"

	# syntax = docker/dockerfile:1.4.0

	FROM node:20

	WORKDIR /root

	RUN npm install sqlite3

	#!/usr/bin/env bash

	set -e

	cd ~

	sudo -v

	# Make sure system is in a good, updated, clean, state.
	sudo apt-get -y update

	"""
	Built on top of this gist by @karpathy:
	https://gist.github.com/karpathy/00103b0037c5aaea32fe1da1af553355

	stable diffusion dreaming over text prompts
	creates hypnotic moving videos by smoothly walking randomly through the sample space

	example way to run this script:
	$ python stable_diffusion_walk.py --prompts "['blueberry spaghetti', 'strawberry spaghetti']" --seeds 243,523 --name berry_good_spaghetti

	# WSL2 network port forwarding script v1
	# for enable script, 'Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser' in Powershell,
	# for delete exist rules and ports use 'delete' as parameter, for show ports use 'list' as parameter.
	# written by Daehyuk Ahn, Aug-1-2020

	# Display all portproxy information
	If ($Args[0] -eq "list") {
	netsh interface portproxy show v4tov4;
	exit;
	}

	# Put this function to your .bashrc file.
	# Usage: mv oldfilename
	# If you call mv without the second parameter it will prompt you to edit the filename on command line.
	# Original mv is called when it's called with more than one argument.
	# It's useful when you want to change just a few letters in a long name.
	#
	# Also see:
	# - imv from renameutils
	# - Ctrl-W Ctrl-Y Ctrl-Y (cut last word, paste, paste)

	// Tracking cursor position in real-time without JavaScript
	// Demo: https://twitter.com/davywtf/status/1124146339259002881

	package main

	import (
	"fmt"
	"net/http"
	"strings"
	)