Загрузка видео...

Не удалось загрузить видео

На главную

I did it. JavaScript vacuum is alive Wrote the code to control it in the browser via Web Serial API, or on the server with serialport

103,719 просмотров • 1 год назад •via X (Twitter)

Комментарии: 11

Фото профиля Ben Holmes
Ben Holmes1 год назад

Ohh so THATS what they meant by “clean code”

Фото профиля glueckkanja
glueckkanja4 лет назад

Are you searching for a simple way to deploy device certificates with #Intune? Check out SCEPman at

Фото профиля defyus
defyus1 год назад

damn, i'm going to build a irobot army. so sick.

Фото профиля Wes Bos
Wes Bos1 год назад

we should fight them

Фото профиля monika 🐢
monika 🐢1 год назад

you can attach the blutooth module in vaccum then move using bluetooth from browser

Фото профиля Wes Bos
Wes Bos1 год назад

thats what I'm looking at right now - I have an ESP32 which I think I can load some sort of serial bridge onto. Wifi would be even better

Фото профиля Sahazel
Sahazel1 год назад

bro will do ANYTHING but touch C😭 impressive tho

Фото профиля Jared Folkins 🇺🇸
Jared Folkins 🇺🇸1 год назад

JavaScript literally sucks

Фото профиля psk
psk1 год назад

This is very cool Bos. Looking forward for learn more about this.

Фото профиля Al Mac
Al Mac1 год назад

This seems to be the most epic side project I’ve seen so far in 2025. Consider: If you add a flamethrower on it you can add “built killer robot” to your CV.

Фото профиля Chris Smith
Chris Smith1 год назад

Sweet. Has me thinking 🤔

Похожие видео

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

216,817 просмотров • 5 месяцев назад