Skip to content

Instantly share code, notes, and snippets.

@hackermondev
hackermondev / writeup.md
Last active December 26, 2025 10:15
How we pwned X (Twitter), Vercel, Cursor, Discord, and hundreds of companies through a supply-chain attack

hi, i'm daniel. i'm a 16-year-old high school senior. in my free time, i hack billion dollar companies and build cool stuff.

about a month ago, a couple of friends and I found serious critical vulnerabilities on Mintlify, an AI documentation platform used by some of the top companies in the world.

i found a critical cross-site scripting vulnerability that, if abused, would let an attacker to inject malicious scripts into the documentation of numerous companies and steal credentials from users with a single link open.

(go read my friends' writeups (after this one))
how to hack discord, vercel, and more with one easy trick (eva)
Redacted by Counsel: A supply chain postmortem (MDL)

@DavidBurkett
DavidBurkett / OneSidedMWTxs.md
Last active December 17, 2020 01:38
Offline Transactions in Mimblewimble

Offline Transactions in Mimblewimble

Mimblewimble is a blockchain protocol that improves on bitcoin's privacy and scalability by using pedersen commitments, schnorr signatures, and a novel technique called 'cut-through'. These benefits have come at a steep cost. Building transactions have thus far required interaction between the sender and receiver to create the outputs and collectively sign the transaction. We present here a method of achieving one-sided transactions while minimizing the impact on the scalability and privacy of mimblewimble.

Current Protocol

Like bitcoin, Grin uses a UTXO model. Transactions are created by including inputs to spend, creating new outputs of equal or lesser value, and signing and building rangeproofs to verify ownership of the inputs.

Unlike bitcoin, Grin uses confidential transactions, so the inputs and outputs are pedersen commitments (r*G + v*H). Instead of the signatures being added to the inputs, there is only one signature per transaction, which is part of the

@fjahr
fjahr / bitcoin_debugging.md
Last active August 7, 2025 14:40
Debugging Bitcoin Core

Moved to https://github.com/fjahr/debugging_bitcoin to allow for better collaboration.

This document is currently optimized for MacOS. If you would like to help me add Linux equivalent commands, please let me know.

Debugging Bitcoin Core

This guide is designed to give beginners of C++ development and/or people new to the bitcoin core code base an overview of the tools available for debugging issues as well as giving hints where issues may trip you up.

@System-Glitch
System-Glitch / generate_blocks.sh
Last active December 2, 2025 14:00
Tutorial for bitcoin regtest
# Script to generate a new block every minute
# Put this script at the root of your unpacked folder
#!/bin/bash
echo "Generating a block every minute. Press [CTRL+C] to stop.."
address=`./bin/bitcoin-cli getnewaddress`
while :
do
@dominictarr
dominictarr / readme.md
Created November 26, 2018 22:39
statement on event-stream compromise

Hey everyone - this is not just a one off thing, there are likely to be many other modules in your dependency trees that are now a burden to their authors. I didn't create this code for altruistic motivations, I created it for fun. I was learning, and learning is fun. I gave it away because it was easy to do so, and because sharing helps learning too. I think most of the small modules on npm were created for reasons like this. However, that was a long time ago. I've since moved on from this module and moved on from that thing too and in the process of moving on from that as well. I've written way better modules than this, the internet just hasn't fully caught up.

@broros

otherwise why would he hand over a popular package to a stranger?

If it's not fun anymore, you get literally nothing from maintaining a popular package.

One time, I was working as a dishwasher in a restu

@uilianries
uilianries / cert-check.py
Created January 4, 2018 21:25
Validate x509 certificate using pyOpenSSL
import sys
import os
from OpenSSL import crypto
def verify_certificate_chain(cert_path, trusted_certs):
# Download the certificate from the url and load the certificate
cert_file = open(cert_path, 'r')
cert_data = cert_file.read()
certificate = crypto.load_certificate(crypto.FILETYPE_PEM, cert_data)
@ZackKanter
ZackKanter / marc-andreessen-library.md
Last active July 11, 2024 00:44
Marc Andreessen's Library
Book ID Title Author Links
1-A-1 Red Blood and Black Ink: Journalism in the Old West David Dary Amazon |
1-A-2 Media and the American Mind: From Morse to McLuhan Daniel J. Czitrom Amazon | Goodreads
1-A-3 A Social History of the Media: From Gutenberg to the Internet Peter Burke Amazon | Goodreads
1-A-4 Media Technology and Society: A History From the Telegraph to the Internet Brian Winston Amazon | Goodreads
1-A-5 The Television Will be Revolutionized Amanda D. Lotz Amazon | Goodreads
1-A-
@mjdietzx
mjdietzx / waya-dl-setup.sh
Last active September 20, 2025 11:52
Install CUDA Toolkit v8.0 and cuDNN v6.0 on Ubuntu 16.04
#!/bin/bash
# install CUDA Toolkit v8.0
# instructions from https://developer.nvidia.com/cuda-downloads (linux -> x86_64 -> Ubuntu -> 16.04 -> deb (network))
CUDA_REPO_PKG="cuda-repo-ubuntu1604_8.0.61-1_amd64.deb"
wget http://developer.download.nvidia.com/compute/cuda/repos/ubuntu1604/x86_64/${CUDA_REPO_PKG}
sudo dpkg -i ${CUDA_REPO_PKG}
sudo apt-get update
sudo apt-get -y install cuda
@vlucas
vlucas / encryption.ts
Last active June 3, 2025 10:38
Stronger Encryption and Decryption in Node.js
import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
const ENCRYPTION_KEY: string = process.env.ENCRYPTION_KEY || ""; // Must be 256 bits (32 characters)
const IV_LENGTH: number = 16; // For AES, this is always 16
/**
* Will generate valid encryption keys for use
* Not used in the code below, but generate one and store it in ENV for your own purposes
*/
export function keyGen() {
@yossorion
yossorion / what-i-wish-id-known-about-equity-before-joining-a-unicorn.md
Last active September 4, 2025 01:33
What I Wish I'd Known About Equity Before Joining A Unicorn

What I Wish I'd Known About Equity Before Joining A Unicorn

Disclaimer: This piece is written anonymously. The names of a few particular companies are mentioned, but as common examples only.

This is a short write-up on things that I wish I'd known and considered before joining a private company (aka startup, aka unicorn in some cases). I'm not trying to make the case that you should never join a private company, but the power imbalance between founder and employee is extreme, and that potential candidates would