Hacker News: arwt

New comment by arwt in "Tell HN: Litellm 1.82.7 and 1.82.8 on PyPI are compromised"

arwt — Tue, 24 Mar 2026 23:45:35 +0000

You can. See: https://docs.astral.sh/uv/reference/cli/#uv-run--exclude-new...

How you use it depends on your workflow. An entry like this in your pyproject.toml could suffice:

  [tool.uv]
  exclude-newer = "5 days"

New comment by arwt in "100M-Row Challenge with PHP"

arwt — Thu, 26 Feb 2026 02:20:43 +0000

You can check the benchmarks here: https://github.com/tempestphp/100-million-row-challenge/blob...

A "good" run seems to be around 20-40s mark.

Use digests, not tags, in your Dockerfiles

arwt — Fri, 20 Feb 2026 00:26:42 +0000

Article URL: https://interrupt.sh/blog/dockerfile-tags/

Comments URL: https://news.ycombinator.com/item?id=47081940

Points: 2

# Comments: 0

Discovering Domains via NS Correlation

arwt — Mon, 16 Feb 2026 20:33:11 +0000

Article URL: https://interrupt.sh/blog/discovering-domains-via-ns-correlation/

Comments URL: https://news.ycombinator.com/item?id=47039950

Points: 2

# Comments: 0

Show HN: Killer Crossword

arwt — Sat, 14 Feb 2026 00:39:51 +0000

I used to play this daily with friends, but the original (killercrossword.com - I found this via a Show HN years ago!) appears to be down nowadays, so I have recreated it with the help of my mate Claude.

It's a crossword with no clues, just a grid with a few pre-filled letters to get you started. You deduce the words from the letter intersections alone. Like Wordle, there's one set of puzzles per day (resets at midnight local time).

The goal is simple: complete the grid in as little time as possible, using as few hints as you can. Then share your score with friends. If the first puzzle is too easy, you can attempt a harder "master" version of it.

The entire thing is self-contained, so feel free to save the page and host it elsewhere if you want to guarantee long-term playability.

Comments URL: https://news.ycombinator.com/item?id=47009974

Points: 4

# Comments: 1

1-Click RCE to steal your Moltbot data and keys

arwt — Sun, 01 Feb 2026 19:47:47 +0000

Article URL: https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys

Comments URL: https://news.ycombinator.com/item?id=46848769

Points: 178

# Comments: 72

New comment by arwt in "SEC obtains final consent judgments against former FTX and Alameda executives"

arwt — Sat, 24 Jan 2026 04:04:44 +0000

There are hundreds of shady crypto projects in the world right now, each one shadier than the last.

World order is out of the door, and has been for a while -- they are all probably fighting amongst themselves to get her onto their board ASAP.

New comment by arwt in "Laracasts: I'm Done [video]"

arwt — Sat, 24 Jan 2026 03:49:58 +0000

Reminds me of the Tailwind situation.

I feel bad for Jeff and more importantly all of the staff members who are now out of a job. Laracasts was the first ever sort of online course I paid for, and I got immense value out of it at that time.

But times change. This is more true now than ever.

It is a brutal world. Good luck to them.

New comment by arwt in "Certificate Transparency Log Explorer"

arwt — Sat, 24 Jan 2026 02:56:03 +0000

I implemented something similar a while back (exists just as a portfolio demo now: subpinger (dot) interrupt (dot) sh).

If you want go for that sort of "live" feeling, you should consider implementing websocket streaming instead of HTTP polling, it will feel a lot nicer for users.

Are you actually ingesting certificates or are you just showing a stream of entries from different logs? I figure the former as nothing seems to be searchable -- and ingesting this data can get very expensive very quickly.

Nevertheless, cool project! I am constantly thinking about ways to turn CT log data into meaningful, actionable streams for others. If you'd be up for working on something together, give me a shout!

Show HN: PopTogether – A calm game where strangers work together to pop bubbles

arwt — Fri, 23 Jan 2026 16:29:55 +0000

Article URL: https://poptogether.club/

Comments URL: https://news.ycombinator.com/item?id=46734417

Points: 1

# Comments: 0

New comment by arwt in "Ask HN: Purchasing a "Premium" Domain"

arwt — Sat, 17 Jan 2026 18:00:20 +0000

Is there anything stopping you from transferring it to a different registrar before renewal, who might not charge you as much?

Or is the renewal price for "premium" domains controlled by the registry (e.g. Verisign)?

Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE

arwt — Wed, 17 Dec 2025 20:50:13 +0000

Article URL: https://mdisec.com/inside-posthog-how-ssrf-a-clickhouse-sql-escaping-0day-and-default-postgresql-credentials-formed-an-rce-chain-zdi-25-099-zdi-25-097-zdi-25-096/

Comments URL: https://news.ycombinator.com/item?id=46305321

Points: 110

# Comments: 35

New comment by arwt in "Ask HN: Hetzner asking for passport for new account? just me, or everyone?"

arwt — Tue, 25 Nov 2025 21:33:49 +0000

You raised some red flags with the information you provided. This doesn't happen to everyone. A support rep from Hetzner has spoke a bit more about this process on WebHostingTalk before[1], although they don't get into which specific heuristics may result in flagged accounts for obvious reasons. I'd imagine it's a combination of things like unpaid balances on previous accounts, IP address reputation, uncommon e-mail domains and so on.

[1] https://www.webhostingtalk.com/showthread.php?t=1810197&p=10...

New comment by arwt in "Show HN: SadServers – Test your Linux troubleshooting skills"

arwt — Thu, 27 Oct 2022 00:38:41 +0000

Interesting idea! Looking forward to trying this once some VMs are available. :-)

New comment by arwt in "Zooko's Triangle"

arwt — Thu, 18 Aug 2022 02:33:32 +0000

Very interesting read. Thank you!

New comment by arwt in "Zooko's Triangle"

arwt — Thu, 18 Aug 2022 02:01:25 +0000

I'd love to see some insight as to how they were able to generate that domain name. Surely if they can do that (years ago, even), then a well-funded adversary would be able to generate the same now, given enough time.

Maybe it took x thousands of compute years to generate the secret key for `facebokcorewww` - and they didn't care about the last character. But still, let's say you're a government agency with endless resources - how hard would it be to recreate that private key? If a private corp can do it once with finite resources - why can't you?

Was it is just a stroke of luck for those working on it? What are the chances?

New comment by arwt in "The new USB Rubber Ducky is more dangerous than ever"

arwt — Thu, 18 Aug 2022 01:45:14 +0000

The risk has always been there with this kind of attack. The severity, as always, depends on the attackers' modus operandi. Nothing has changed. Only the tools which are dropped onto the machine have changed - which really isn't specifically relevant to this kind of attack. (Spy|Mal)ware adapts, as it always will. Harvesting saved browser passwords is nothing new. In this case, it's a marketing gimmick.

It's fun that it is customisable via a programming language. But really - this doesn't add anything new to the table at all. I bet you could do all of this with the previous generation of rubber duckies with a little bit of know-how. Drop a basic reverse shell (providing no firewall restrictions or whatever), and you can do what you want.

The same prevention guidelines apply as always. Don't plug random USB devices into your computer.