正在加载视频...

视频加载失败

I did it. JavaScript vacuum is alive Wrote the code to control it in the browser via Web Serial API, or on the server with serialport

103,719 次观看 • 1 年前 •via X (Twitter)

11 条评论

Ben Holmes 的头像
Ben Holmes1 年前

Ohh so THATS what they meant by “clean code”

glueckkanja 的头像
glueckkanja4 年前

Are you searching for a simple way to deploy device certificates with #Intune? Check out SCEPman at

defyus 的头像
defyus1 年前

damn, i'm going to build a irobot army. so sick.

Wes Bos 的头像
Wes Bos1 年前

we should fight them

monika 🐢 的头像
monika 🐢1 年前

you can attach the blutooth module in vaccum then move using bluetooth from browser

Wes Bos 的头像
Wes Bos1 年前

thats what I'm looking at right now - I have an ESP32 which I think I can load some sort of serial bridge onto. Wifi would be even better

Sahazel 的头像
Sahazel1 年前

bro will do ANYTHING but touch C😭 impressive tho

Jared Folkins 🇺🇸 的头像
Jared Folkins 🇺🇸1 年前

JavaScript literally sucks

psk 的头像
psk1 年前

This is very cool Bos. Looking forward for learn more about this.

Al Mac 的头像
Al Mac1 年前

This seems to be the most epic side project I’ve seen so far in 2025. Consider: If you add a flamethrower on it you can add “built killer robot” to your CV.

Chris Smith 的头像
Chris Smith1 年前

Sweet. Has me thinking 🤔

相关视频

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

216,817 次观看 • 5 个月前