Hacker Newsnew | past | comments | ask | show | jobs | submit | runtimepanic's commentslogin

I agree but this one have 1.6m downloads


I didn't know about the 2023 case. Why didn't they remove it back in 2023 then :D


I found verified, live credentials leaking from Microsoft, Google, Red Hat, Grafana, and LlamaIndex in public GitHub repositories.


I found a Content-Type spoofing vulnerability in the image upload functionality of parisneo/lollms (CVE-2026-5728).

https://aydinnyunus.github.io/about/

#security #websecurity #infosec #appsec #cve #python #bugbounty


Correct. I meant assembly that assembles to machine code


True, it's assembly. I wrote it that way to make it more readable :D


Interesting idea. One thing I’m curious about is where we draw the line between improving clarity and actively trying to disguise authorship. Tools like this make sense for reducing awkward phrasing, but they also raise questions about transparency, especially in academic or professional contexts.

It feels like we’re moving from “AI-assisted writing” toward “AI-assisted obfuscation,” which is technically impressive but socially a bit tricky. Would be interesting to hear what use cases you had in mind when building it.


A Cross-Site Scripting (XSS) vulnerability has been identified in the html2pdf.js library. The vulnerability exists due to unsanitized user input being directly assigned to the innerHTML property. This allows attackers to execute arbitrary JavaScript code in the context of the application, potentially leading to session hijacking, data theft, and unauthorized actions.


Nice work. Client-side stripping is especially important for privacy, since you don’t have to trust a server with the original image.

I ran into a similar problem from the opposite angle and ended up building ExifLooter. It focuses on discovering EXIF and geolocation data at scale across image URLs and directories, integrates with OpenStreetMap for visualization, and also includes a metadata-removal feature for cleanup after analysis.

Interesting to see more tools pushing awareness that image metadata is still an underrated privacy leak.

Also it is official on Kali Linux.

- https://github.com/aydinnyunus/exiflooter?tab=readme-ov-file...


Thanks for sharing, runtimepanic! ExifLooter looks really interesting! I like how it tackles EXIF and geolocation at scale and integrates with OpenStreetMap. That kind of tool is definitely complementary to what I built with MetaRefresh.

I completely agree... metadata leaks are still widely underestimated, and it’s great to see tools raising awareness while giving users control.


I’ve tried both and ended up preferring a hybrid. IDEs are great when the AI understands project context, types, and refactors across files, but they can also nudge you into accepting changes too passively.

CLI feels more deliberate. You think first, ask precisely, and apply changes consciously, which helps avoid over-trusting the model. It’s slower, but the feedback loop feels cleaner and safer, especially for security-sensitive work.

Curious if others feel IDEs optimize for flow while CLI optimizes for intent.


The IDE gives me a "human-in-the-loop" experience and conversely, I prefer this for secret sensitive work.

I agree with CLI feeling more deliberate. It could be the lack of "accept" gates (that you get with Cursor, Copilot etc).


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: