Viewing profile — _k2vp

> Apple Pay does not, runs the whole thing on-device, and not only is private, but as a result also enables payments entirely offline. Apple Pay still does send a lot of telemetry …

I got an email today morning: > I came across acheong08/ChatGPT on GitHub (27,954) and noticed it's archived and no longer receiving updates. Really well-built project. I run a sma…

I'm not malicious at least :) Pretty public with who I am https://duti.dev/

> The theme of the hackathon was AI I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunt…

I was playing around with it a while back and forgot to remove it...

> Google reportedly used their Android users to sniff APs Pretty sure that's how it works across all phones. I know that's how Apple gets their location services database at least.…

It does fall back to the GPS receiver if no internet and no cache but I suppose it's just more power efficient and not on anyone's minds that people would MITM for this purpose.

I still can't believe that certain IOS APIs are locked to paid developer accounts only (PacketTunnel, Shortcuts, etc.) such that you can't even sideload your own app onto your own …

Happy New Years! I can't believe it's already 2026. Posting from a flight back to the UK. Having wifi in the sky, we really are living in the future. 2025 wrapped: https://duti.dev…

Currently in China (as a visitor). Wireguard literally just works (to a VPS). Mullvad works as a commercial provider, just slower. Xray-core (vless, Trojan) if you're paranoid. I h…

I built a bad clone of Charles Proxy over the summer as part of another project (iOS VPN -> mitm with custom root certificate -> logging). It's surprisingly simple. It basically go…

Location: Cardiff, United Kingdom Remote: Preferred not, but willing Willing to relocate: Yes (Europe, North America, Singapore, Far east Asia) Technologies: Golang, Python, Typesc…

Complained about this yesterday as well: https://duti.dev/blog/2025/rot-of-undergrad/ The incentives are all messed up & universities can't even do anything about it since if they …

Tried [Invidious]( https://github.com/iv-org/invidious )? It's really lightweight. I host my own instance: https://iv.duti.dev and it works wonders (Librewolf with strictest finger…

Huh I recognize that library. Ran into the same issues last year and made a fork. https://github.com/acheong08/playsound https://pypi.org/project/playsound2/

Reproduced the issue after a bit: https://github.com/acheong08/CVE-2025-48384 Then immediately went to update my git version. Still not up on Arch yet. Will refrain from pulling an…

This is why I use invidious. Much more lightweight without all the tracking and Google bullshit. https://invidious.io My instance https://iv.duti.dev

You always could by just setting the proxy environment variables (or in settings). The standard port for the tor daemon is 9050. In fact, it's relatively easy to write a socks prox…

I write a lot of random code that have very little economic value so there's really no point in keeping it private. Sometimes they end up being helpful for other people. E.g. https…

I'm in the UK so it would be surprising for it to be a language proficiency problem. You might be right about outsourcing and machine translation. > "Will the application has a loc…

https://github.com/acheong08/apple-corelocation-experiments I worked on this a while back in parallel. You can dump Apple's entire database in ~2 weeks. Around 3 billion records in…

Apple also maintains a similar database (though with only BSSID and not SSID). You can find all the BSSIDs in one area via the tile API or straight up dump the whole thing. https:/…

I actually did that with a firefox extension + containers to scrape ChatGPT a long while back (before the APIs) https://github.com/acheong08/ChatGPT-API-agent Worked pretty well bu…

This has been happening for a long time. I once wrote a bypass for scraping: https://github.com/acheong08/funcaptcha A still working fork: https://github.com/xqdoo00o/funcaptcha I …

Apple probably has one of the largest databases. Their API is unauthenticated and not rate limited either. Can be used for both APs and cell towers: https://github.com/acheong08/ap…