81–90 of 109 posts
Earlier quoted context omitted.
"This wasn't some dev environment. This wasn't test data." It's not X, it's Y. And repetitions of three.
Thats a literary style called anaphora. Some people learned this in school, so they can use it to emphasize something. IMHO this is not a strong sign of AI, in fact I think this text has no strong AI indicators.
Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV w…
There is always some fun showing teams how easy it is to bypass with a plain browser and developer tools window open.
encrypted cookies still work & they're stateless. & yeah you can pass cookies between servers & also server - S.P.A.
to BoBDaHacker - great research but slow down on the a.i writing.
Clearly a big f-up by FIFA on what looks like quite a tidy platform otherwise. One question though, how do you know your feed would kick off the 'real' feed if you pushed to RTMP, does it just take the most recent connection as live? Does the protocol have a mechanism for dealing with multiple people pushing to the same endpoint? There maybe more checking on that endpoint and if course I'm sure most live broadcasters…
Good question! So RTMP doesn't really have a clean way to handle two publishers on the same stream key. What would actually happen is the two streams fighting for the ingest endpoint, so the output would glitch between the two sources. Like if I pushed Subway Surfers gameplay it'd be flickering between the actual match and Subway Surfers with the audio cutting back and forth. You're right that a live director would c…
JWTs strike again. encrypted cookies still work & they're stateless. & yeah you can pass cookies between servers & also server - S.P.A. to BoBDaHacker - great research but slow down on the a.i writing.
Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it. If you used AI to generate the blog post, did you use AI to generate the screenshots and story?
Yeah I used Claude as a writing assistant for the initial draft. I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me. But I do edit it pretty heavily after, the voice and the jokes and the structure are mine, the AI just helps me get a baseline down so I'm not staring at a blank page. The research, the screenshots, the disclosure, that's all me.…
Earlier quoted context omitted.
Good question! So RTMP doesn't really have a clean way to handle two publishers on the same stream key. What would actually happen is the two streams fighting for the ingest endpoint, so the output would glitch between the two sources. Like if I pushed Subway Surfers gameplay it'd be flickering between the actual match and Subway Surfers with the audio cutting back and forth. You're right that a live director would c…
How do you know that you can even write to any of those fields? You didn't try it, so maybe there is a JWT role check in the backend on POST and PUT.
Please stop using AI to write for you, it ruins what is otherwise a fascinating story, and on reflection I struggle to trust it. If you used AI to generate the blog post, did you use AI to generate the screenshots and story?
Yeah I used Claude as a writing assistant for the initial draft. I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me. But I do edit it pretty heavily after, the voice and the jokes and the structure are mine, the AI just helps me get a baseline down so I'm not staring at a blank page. The research, the screenshots, the disclosure, that's all me.…
Earlier quoted context omitted.
"This wasn't some dev environment. This wasn't test data." It's not X, it's Y. And repetitions of three.
Also, “ What I didn't expect was what happened next.” The Unicode arrows is also something Claude is using really often: “Camera -> RTMP ingest -> MediaKind -> broadcast partners -> your TV.” And the table at the end is such a Claude thing. The general style, a series of short sentences that feel like they are building up a punchline is what tells me it’s Claude, but the whole thing does stink of LLM generation