Michal Landsman landsman

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

Compiling a standalone executable using modern JavaScript/TypeScript runtimes

We have the same code working using node, deno, and bun.

E.g.,

bun run index.js

Because cross-compiling binaries for Windows is easier than building natively

I want Microsoft to do better, want Windows to be a decent development platform-and yet, I constantly see Microsoft playing the open source game: advertising how open-source and developer friendly they are - only to crush developers under the heel of the corporate behemoth's boot.

The people who work at Microsoft are amazing, kind, talented individuals. This is aimed at the company's leadership, who I feel has on many occassions crushed myself and other developers under. It's a plea for help.

The source of truth for the 'open source' C#, C++, Rust, and other Windows SDKs is proprietary

You probably haven't heard of it before, but if you've ever used win32 API bindings in C#, C++, Rust, or other languages, odds are they were generated from a repository called microsoft/win32metadata.

Google Calendar - Public Holiday Calendars

calendarID from cal.csv can be used at path param in https://developers.google.com/calendar/v3/reference/calendars/get https://developers.google.com/calendar/v3/reference/events/list

import project into idea command

$ curl -L "https://gist.githubusercontent.com/chrisdarroch/7018927/raw/9a6d663fd7a52aa76a943fe8a9bc6091ad06b18d/idea" -o /usr/local/bin/idea
$ chmod +x /usr/local/bin/idea

unzip and open project command

$ curl -L "https://gist.githubusercontent.com/sgyyz/adfa4f05af3d81cf0e17e19cf7044c85/raw/b6b9e871d5a4f5435a09d00b0a52e3db0b90699a/uao.sh" -o /usr/local/bin/uao.sh
$ chmod +x /usr/local/bin/uao.sh
$ ln -sf /usr/local/bin/uao.sh /usr/local/bin/uao

	# more stages...

	# When using a Node image, make sure to use the amd64 version, or it will take forever
	# GH Actions is running arm64 in a emulator (QEMU). This way, it will use the native amd64 and be much faster.
	FROM --platform=linux/amd64 node:19 as static-assets
	WORKDIR /app
	COPY . .
	RUN npm install ; npm run build

	# more stages...

	on:
	push:
	branches:
	- master
	pull_request:
	types:
	- opened
	- reopened
	- synchronize
	- ready_for_review

	#! /bin/bash

	n=32
	arg=setaf
	text='Hello World! This is %s %d'

	_help()
	{
	printf 'usage: %s [--help\|-H] [--16] [--256] [-t\|--tiny] [--background\|-b]\n' "$(basename $0)"
	exit 0

	#!/usr/bin/expect

	set username "mstiborsky\r"
	set config "/etc/openvpn/client/zonky.conf"
	set vpn_oauth_token [exec ykman oath code -s vpn]

	spawn openvpn --config $config --auth-user-pass
	expect "Enter Auth Username:"
	send $username
	expect "Enter Auth Password:"