Loading video...

Video Failed to Load

Go Home

I did it. JavaScript vacuum is alive Wrote the code to control it in the browser via Web Serial API, or on the server with serialport

103,719 views • 1 year ago •via X (Twitter)

11 Comments

Ben Holmes's profile picture
Ben Holmes1 year ago

Ohh so THATS what they meant by “clean code”

glueckkanja's profile picture
glueckkanja4 years ago

Are you searching for a simple way to deploy device certificates with #Intune? Check out SCEPman at

defyus's profile picture
defyus1 year ago

damn, i'm going to build a irobot army. so sick.

Wes Bos's profile picture
Wes Bos1 year ago

we should fight them

monika 🐢's profile picture
monika 🐢1 year ago

you can attach the blutooth module in vaccum then move using bluetooth from browser

Wes Bos's profile picture
Wes Bos1 year ago

thats what I'm looking at right now - I have an ESP32 which I think I can load some sort of serial bridge onto. Wifi would be even better

Sahazel's profile picture
Sahazel1 year ago

bro will do ANYTHING but touch C😭 impressive tho

Jared Folkins 🇺🇸's profile picture
Jared Folkins 🇺🇸1 year ago

JavaScript literally sucks

psk's profile picture
psk1 year ago

This is very cool Bos. Looking forward for learn more about this.

Al Mac's profile picture
Al Mac1 year ago

This seems to be the most epic side project I’ve seen so far in 2025. Consider: If you add a flamethrower on it you can add “built killer robot” to your CV.

Chris Smith's profile picture
Chris Smith1 year ago

Sweet. Has me thinking 🤔

Related Videos

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

216,817 views • 5 months ago