Viewing profile — kjok

I should have been clearer and specific: state management is done on the backend, but collecting behavioral biometrics and device fingerprint is done using JavaScript, which can be…

Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaScript is visible, ca…

Please also collect responses from people, you'd find a pattern: a new attack is launched, people make noise, and later go back to installing packages the same way. Enterprises alr…

> Compare this to Android where you can run malware and it cannot do anything except for annoying you with notifications. Are you sure it cannot do anything? Looking through variou…

Why should they be open source?

Cooldown sounds like a good idea ONLY IF these so called security companies can catch these malicious dependencies during the cooldown period. Are they doing this bit or individual…

How difficult is it to build a second startup on the side?

Are you a bot?

Building automated analysis tool that help identify the use of GPL-licensed SDKs in mobile apps, promoting license compliance and supporting sustainable open-source development.

In 2022, many founders and investors made strong bets on AI: new companies, pivots, or funding theses. Now that we have had time to see what actually played out, what did you bet o…

How do you know that they were LLM scrapers? The reason I ask is because user agents could easily be spoofed?

For those who have deployed Cloudflare in front, what are pros and cons? How's the user experience? Do they offer free bot protection?

How are you measuring this? Does your solution rely on user agent or device fingerprinting? Curious to know what tools are available today and how accurate they are.

Thanks for sharing your approach! > It is nothing special. We keep X number of machines in a warm pool. I'd love to better understand the unit economics here. Specifically, whether…

> The problem is that those underlying frameworks can very easily be misconfigured. Agreed. I'm sure a number of these sandboxing solutions are vibe-coded, which makes your concern…

> There are dozens of projects like this emerging right now. They all share the same challenge: establishing credibility. Care to elaborate on the kind of "credibility" to be estab…

And this is exactly why we see noise on HN/Reddit when a supply-chain cyberattack breaks out, but no breach is ever reported. Enterprises are protected by internal mirroring.

I mean that agents can scan the code to find anything "suspicious". After all, security vendors that claim to "detect" malware in packages are relying on LLMs for detection.

Curious to know why are coding agents not detecting such risks before importing dependencies?

> I actually just published a paper... This gives me an impression that the paper has already been published and is available publicly for us to read.

Maybe humans can focus on cybersecurity and fraud? That’s not going away with AI

Block based on cookies (i.e., set a cookie on the browser and check on the server whether it exists).

I understand the need, but I don't understand why a VM or Docker is not enough. Why are people creating custom wrappers around VMs/containers?