Hacker News: j027

New comment by j027 in "mitmproxy adds --emudhra option"

j027 — Thu, 22 Oct 2026 02:11:22 +0000

You can, but since android 7 IIRC apps don’t trust the user store by default (unless you have root and add it to the system store or patch the app to trust the user store)

New comment by j027 in "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"

j027 — Tue, 20 Oct 2026 02:19:18 +0000

There’s a limit of free hours per month that comes out to 2 cores and 12GB RAM. If you go over it then you get charged with the pay-as-you-go option.

It used to be 4 cores and 24GB RAM in the past for at least 4 or 5 years but it recently changed.

New comment by j027 in "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"

j027 — Tue, 20 Oct 2026 02:16:49 +0000

If you are on the pay-as-you-go tier, I would check if you are being billed. Always free for the ARM instances works by giving you a certain number of hours free, so if you go past that you may get billed

New comment by j027 in "Zuckerberg's Meta Takes Down No Kings Instagram During Protest Day"

j027 — Sun, 18 Oct 2026 02:46:33 +0000

The suspension that was public facing lasted 90 minutes, but they couldn’t log into the account for hours

See https://bsky.app/profile/ezralevin.bsky.social/post/3my43atj...

New comment by j027 in "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"

j027 — Fri, 09 Oct 2026 17:58:28 +0000

The always free was recently cut to 12 GB RAM and 2 cores per month.

https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...

New comment by j027 in "Why is Google still serving dodgy ads?"

j027 — Mon, 14 Sep 2026 03:16:44 +0000

Another major issue is google safe browsing whitelists many of these subdomains that the attackers like to host their scam pages on.

As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire. https://blog.google/security/using-ai-to-stop-tech-support-s...

I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.

New comment by j027 in "Why is Google still serving dodgy ads?"

j027 — Mon, 14 Sep 2026 02:32:06 +0000

Wow I am surprised to see this.

I created a tool that automatically follows ads to try to find scams.

But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too.

I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.

These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.

Unauthenticated Root Access to the Enphase IQ Gateway

j027 — Tue, 11 Aug 2026 22:50:29 +0000

Article URL: https://j027.net/enphase-rce/

Comments URL: https://news.ycombinator.com/item?id=49265567

Points: 2

# Comments: 0

New comment by j027 in "Residential Proxies Are a National Security Threat"

j027 — Tue, 28 Jul 2026 06:09:14 +0000

I don’t understand this being a “national security” threat.

Besides, mobile proxies exist which work differently. All you need is a mobile data plan that you run a proxy server on. It allows for easy IP rotation and since it’s a pool shared with other customers you cannot easily block it. This is because of things like CGNAT.

IP rotation is easy because reconnecting to the network gives you a new IP address.

Static residential proxies also are a thing, even if they are less effective sometimes.

New comment by j027 in "An update on residential proxies and the scraper situation"

j027 — Sat, 11 Jul 2026 14:47:30 +0000

Depending on the IP reputation as well as the kind of IP address you have, this can happen.

Google also prefers if you have a Google account logged in.

New comment by j027 in "Anthropic says Alibaba illicitly extracted Claude AI model capabilities"

j027 — Fri, 26 Jun 2026 04:00:50 +0000

Phone verification services exist to give you a real number for the purpose of passing this kind of verification.

They even have APIs for these services. They make money since they can use the same number to verify different things.

New comment by j027 in "Exit IP VPN servers mitigation rollout"

j027 — Mon, 25 May 2026 20:17:30 +0000

This sounds like some LLM to me

New comment by j027 in "Google broke reCAPTCHA for de-googled Android users"

j027 — Sat, 09 May 2026 02:06:17 +0000

To add onto this, cloudflare switched away from recaptcha a while ago. https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

I think they now use their own Cloudflare turnstile if I remember correctly, but back then they switched to hcaptcha.

New comment by j027 in "Google broke reCAPTCHA for de-googled Android users"

j027 — Sat, 09 May 2026 01:20:53 +0000

You can still use the audio captcha, but I’m not sure how long that’ll be around.

New comment by j027 in "Canvas is down as ShinyHunters threatens to leak schools’ data"

j027 — Thu, 07 May 2026 23:51:52 +0000

Canvas seems like it’s not that great. But if you then use Blackboard Ultra it makes canvas look amazing.

New comment by j027 in "Hunting AitM Phishing Infrastructure Using Certificate Transparency"

j027 — Thu, 29 Jan 2026 14:52:24 +0000

OP here. My university was targeted by a recent phishing attack, and these are my findings. I hope this helps others, but this was my first experience with an Adversary in the Middle (AitM) attack.

Hunting AitM Phishing Infrastructure Using Certificate Transparency

j027 — Thu, 29 Jan 2026 13:58:11 +0000

Article URL: https://j027.net/hunting-evilginx/

Comments URL: https://news.ycombinator.com/item?id=46810268

Points: 1

# Comments: 1