AMURLABS
Small, specific tools, pulled out of things we run every day. Each one is
published with the finding that produced it, because the write-up is usually
worth more than the code.
Most privacy policies are long because the data practices are complicated.
Invert it: decide the privacy page first, then make the code keep it.
First-party analytics that never stores an IP address. Identity is a random
number in a first-party cookie — a coat-check ticket, no name on it — so a
full theft of the analytics directory yields ticket numbers and reading
times, nothing a breach statute recognizes as personal information. Includes
the trick nobody documents: excluding your own visits without storing IPs to
match against — compare the client against the server's own egress address
in memory, and treat a missing proxy header as proof the request is you.
github.com/ytomasch/coatcheck
· JavaScript · MIT
Open a second connection to this 3D printer and the firmware wedges — for
good. The only way out is walking over and unplugging it.
A client for the protocol FlashForge-style printers speak on port 8899. The
file-upload half is documented nowhere, so it was recovered by proxying the
vendor's own slicer and reading the bytes: fixed 4112-byte frames whose
length and checksum deliberately disagree with the payload they carry. Ships
a mock printer that wedges exactly like the real thing, so you can get it
wrong somewhere cheap.
github.com/ytomasch/gantry
· JavaScript · MIT
In the macOS File Provider framework, the error you return is not a message.
It is an instruction, and the system carries it out.
Hand back noSuchItem for what was really a server hiccup and macOS
deletes the user's local copy of a file that is sitting safely on the server.
Nine more like it, including item identifiers that leak filenames into the
system log in plaintext, and a cached capability store that makes a drive
refuse every write with no error and no network traffic at all.
github.com/ytomasch/plinth
· Swift · MIT
Twelve services, each with its own bad opinion about authentication. Put one
small thing in front of them instead — and modify none of them.
A forward-auth reverse proxy that verifies an HMAC-signed session cookie
before a request reaches a backend. Deliberately the enforcement half only:
it issues nothing and stores no users. One dependency, ~450 lines, 53 tests.
github.com/ytomasch/portcullis
· JavaScript · MIT
Your MacBook has been measuring its own power draw to the milliwatt this
whole time. Nothing surfaces it.
powermetrics needs sudo, does not report input power at all, and on
M4 reads a flat 0 mW for CPU power. Meanwhile the SMC publishes
calibrated telemetry through IOKit that any user can read with plain
ioreg. The numbers are instrumented rather than estimated, and the
budget closes: SystemPowerIn = BatteryPower + SystemLoad.
github.com/ytomasch/macwatt
· Python · MIT