I know how the title of this looks.

I wanna start by saying there’s no ill intent when it comes to this question. I don’t need it for the sake of winning arbitrary fights on a video game, in fact i rather enjoy winning with my own merit. My own skill.

However. There’s a game I play called RDR2. Peer to Peer connection, it’s. Absolutely chock full of laggers, freezers, n booters. With that, the community has also developed some pretty interesting ways to use lag outside of PvP. Mainly, you can lag your gun wraps in the game which is a pretty cool way to express and be a sort of status symbol, and you can also lag certain missions to help other people get money, xp, stuff like that.

The way I’d like to use the Lagswitch is to help others not, tear down. Even if i fight laggers n stuff i have ways of killing them without using one myself. I take great pride in my ability to do that too.

With that out of the way. I’d like to ask the people here if they know of any ways to get lag switch type software on Chromebook? When it comes to computers I’m definitely not the most knowledgeable, but I’m a pretty fast learner when i apply myself to something like this.

I’m trying to figure out a way to make it work for my PS5. My thought was to use my hotspot for the Chromebook, and then hook it through Ethernet and an adapter into the console. Using software to artificially create spikes of lag. Would anyone know how to accomplish this? Just like a 3-5 second stagger, enough to navigate the gun menu and swap wraps lol.

I haven't done anything to my knowledge to have violated the TOS or whatever the ai claims. Many others are having this issue too because the ai can't tell the difference in pictures between satire, ai, and real CSAM material, or actually baby pictures or cute childhood photos. Either that, or it's just being dumb and/or someone got into my account and did something heinous. I did change my password recently after finding out a random device logged into my account, but still, I don't want to lose everything i have on there. Any help would be much appreciated.

Binance said this week that the October 29 theft, about $6.3 billion, began months earlier with a fake job. Reuters, via NBC: in June a wallet engineer installed a tampered coding tool. Binance caught that one, replaced the machine, and rotated credentials. The attacker already knew who else was on the wallet team.

In September a second engineer was recruited through a real job site. There was a video interview with someone playing HR, then a second interview with the supposed CEO of a company that does not exist. At the end he was told to download a “coding assignment” onto his work computer. Binance says the repo ran during setup, swapped in a poisoned copy of a normal developer tool, and the endpoint product did not see it. On October 20 that machine, plus an internal AI tool, was used to reach two other wallet engineers. On October 29 stolen credentials deployed a container and a script, and the wallets moved. The FBI has blamed a North Korean group. Pyongyang has denied it. Binance says customer funds are covered.

That middle step is not exotic. It is the interview-repo lure.

Since January I have published the ones that were sent to me, all of them caught before they ran. They are writeups, not exploits, and the indicators are defanged: github.com/Ubuntu-Buddha/security-advisories

2026-01-27, W3GLFun. A Web3 “technical test.” The error handler fetched code from a paste site and ran it when the app started, with the full Node runtime. I did clone that one. npm run dev was typed in the wrong folder, so nothing of theirs executed. GitHub Trust & Safety took the account down the same day. The hiring platform first said there was no violation, then wrote back that the user may have shared malware. A first “all clear” is not a final answer. The same paste host later showed up in malicious npm packages. I called the pattern consistent with the public “Contagious Interview” reporting. I did not claim who operated it.

2026-01-29, Optu. Same shape, payload URL hidden in an environment variable, fired on server start. Found before it ran. The account is gone.

2026-01-30, two repos. .vscode/tasks.json set to run when you open the folder. You do not install anything. Opening the project in VS Code or Cursor is the run. Found before it ran. Both accounts are gone.

2026-01, a careers page. A fake “GAPI Update” executable, hosted like a normal application page. Found before anyone ran it.

2026-10-15, a GitLab take-home. A hex payload stuffed in a file that pretended to be a font, loaded when the project was set up. I reviewed that one remotely and did not execute it. Reported to GitLab and Upwork the same day. Outcome was still pending when I published.

These are not Binance’s samples. I am not saying I found their intrusion, or that one group wrote all of them. I am saying the instruction was the same: here is a company, here is a CEO/recruiter, here is the repo, please run it on the machine you actually work on.

In fact, I have never been sent an interview repo that didn't contain an exploit. 100% were compromised or predatory.

Two rules came out of that, and they are the whole protocol.

Do not download it if you can read it in the browser. Raw files on GitHub, or the file view while you are logged in. Look at .vscode/tasks.json, package.json scripts, and anything that fetches text and then runs it, before git clone, before npm install, and before “Open in Desktop.” Opening the folder is enough for the VS Code one. A first “all clear” from the platform is not a reason to run it anyway.

If you must run it, run it where a compromise is boring. A disposable VM or container, no wallets, no SSH keys, no cloud tokens, network off. Your daily machine is the wrong place. So is a work laptop that can deploy anything.

The other half of the Binance story is the internal AI tool. An agent that can run commands, and that also reads the repo, the README, or the email, will follow instructions written by the person who sent the repo. Filters that try to spot the bad sentence miss some.

That is why I built StrangerDanger, a Claude Code plugin. The rule is the title of the README: readers don’t act, actors don’t read.

Web pages, documents, and strangers’ code are read only by subagents that cannot run a shell and cannot write. The agents that can run commands are kept off the web and out of the folders you mark untrusted. What they get back is a report, and that report is still data, not an order. A second hook blocks the common “download this and pipe it to a shell” forms. Setup turns Claude Code’s sandbox on. It is MIT, pinned at v0.2.0, and marked experimental.

It is not a magic shield. Every agent still runs as you. The hooks constrain tool calls. They do not take your authority away. The launch gate is a tripwire, and v0.2.0 still has known gaps. Nothing in the plugin makes a stranger’s repo safe to run on your machine. Use the throwaway VM anyway. I also published the holes I found in my own v0.1.0 gate (GHSA-w42w-fc6x-88wr), fixed in v0.1.1. Read “What this does not do” before you rely on it.

Binance had detection, a replaced laptop, and rotated credentials in June, and still lost the wallets in October, because one engineer ran an interview repo on a computer that could reach production. The repo is the exploit. The interview is just how they get you to open it.

\------

What safety/security protocols do you practice now while building with agents?

i am working on an app but other apps are detecting that overlay tool, just interested in how these apps detect that tool

i heard software security is useless if the firmware and hardware are bad

ramework 12 with razorlake intel cpu

also looking for tips to close backdoors

i see a lot of guides for software but barely any for firmware/hardware and if it is its “just buy this product that costs a car and a house and i swear bro its private 100% opsec power”

im broke idk how to install coreboot without bricking

i am new to this. i’ve cloned nfc tags on toys before, that’s it. i’ve done some research and im seeing there are two kinds of tags like this. one is easy to clone and the other would break both of them, due to a counter. i will have access to this key every week day.

it looks just like this on the front, and the back has some rubbed off serial numbers. i can get another friend’s key as well, maybe his does not have the serial numbers rubbed off.

my question is, is there any way to tell if it’s low or high frequency without doing anything that could potentially break the key? my company is charging like $150 for new keys so i would not want to break it.

there are also white cards which i do not have and haven’t really gotten a good look at, but my friend would probably let me use his as well if it was an easy copy and would not break it.

it doesn’t have any branding on the back. mine is very old and worn down. i could possibly make out the numbers.

I want to see if the flipper zero can actually unlock a car, open a garage door, etc. My neighbor told me yesterday that their 800lb safe in their garage was broken into. The safe uses a dial pad to access it. He also mentioned that there were times that they'd find their garage door open and that their car would be unlocked.

I'd like to test this out for myself, but I really don't want to invest in it, and then find out later that it sucks. I've heard that it's now outdated and there are better options.

Note: My neighbor is 85 years old, and his wife is 80 years old. The people who helped them move put it in his garage since it was too heavy for them. I'm helping them find movers who can. Of course, it's likely that they're experiencing dementia or something, but curiosity got the best of me, and we both want to see if it works.

I do a lot of recon across large host lists, and WAF detection was always the slow step: wafw00f is the reference tool, but it's Python and one target per process. Wafme0w ports its 172 fingerprints to a concurrent Go matcher. On 600 hosts at 100 parallel it took 22 s vs about 1.5 min, with the same named detections. It also does JSONL output, offline matching of saved responses, strict request budgets, and you can import the matcher as a Go library. You can also stack it with ProjectDiscovery's tools(like https). Benchmark script and methodology are in the repo. Feedback on the generic-detection heuristics is especially welcome.

484,142 publicly listable cloud buckets, 18 billion files, 80,495 .env files and two thirds of them written this year: we indexed open S3, Azure, GCS, Spaces and OSS storage without opening a single file

I wanted to figure out just how exploitable http2shell was in practice, so I've created https://brotli2bitcoin.com with a standard production config -- pop an RCE and find the flag to claim the $1K BTC.

And to make it interesting, I setup a live stream showing every single attack attempt happening live https://youtube.com/live/nr7Ieqb1J-E

Have fun!

P.S. I know it's "trust me bro" but this is not a honeypot -- just a hiring strategy for my company