标签：#t

An intentionally vulnerable e-commerce platform that teaches you to find, exploit, and understand IDOR vulnerabilities — the way they actually appear in the wild. Let's talk about the most deceptively simple vulnerability in web security: IDOR . On paper, it sounds trivial — change a number in the URL, access someone else's data, collect your bounty. But anyone who's spent real time hunting knows the truth: IDORs in production applications are rarely that obvious. They hide in request bodies, lurk inside multi-step workflows, and disguise themselves behind modern frontend frameworks that abstract away the very IDs you're supposed to manipulate. That gap — between textbook IDOR and real-world IDOR — is exactly where IDOR BugBounty Labs lives. What Is IDOR BugBounty Labs? It's an open-source, Node.js/Express e-commerce application built with one purpose: to give you a realistic playground for practicing IDOR attacks. Not simulated. Not theoretical. Intentionally vulnerable, locally hosted, and designed to mirror the complexity of actual Bug Bounty targets. Built with Express and TailwindCSS, it simulates a functioning online store — complete with user accounts, orders, addresses, support tickets, notification settings, and a checkout flow. Every feature contains at least one authorization flaw waiting to be exploited. Why This Lab Is Different Most IDOR labs give you one obvious URL parameter to change and call it a day. This one doesn't. IDOR BugBounty Labs includes: 5 distinct challenges ranging from easy to hard 3 different IDOR types: URL parameters, request bodies, and hidden body parameters Both read and write IDORs — accessing data and modifying it Multi-step business logic that mimics real e-commerce flows A flag submission system so you can verify your findings The challenges don't just teach you to change an ID. They teach you to think about where IDs live, how they're passed, and what happens when authorization checks are missing. The 5 Challenges 1. Read O

I have been doing URL redirect work for client sites for some time now. It’s one of those jobs that’s never quite urgent enough to automate, but tedious enough to dread, especially after a migration when you have hundreds of them. Recently tried it. Connected my AI agent with MCP to handle it. I told it to build a set of redirects and it did. No dashboard, no wrestling with CSVs, no clicking through settings. Teaching in plain language. In seconds. And what I was surprised by was not the speed, but the amount of mental overhead such a task involves. You’re not just doing the task you’re context switching into a tool, remembering where things are, making sure nothing breaks. Giving it to an agent removes all of it. What really made me trust it for real client work was the dry-run feature. See exactly what is changing, before it changes. No surprises here. Curious if anyone else has been using MCP for infrastructure tasks, redirects, DNS, workspace management. I think we are at the start of something that is going to quietly gobble up a lot of tedious technical work. submitted by /u/Scary_Bag1157 [link] [留言]

Art TVs aren’t exactly known for being affordable, which is why Woot’s latest sale is notable. Now through June 26th, the retailer is discounting Samsung’s 2025 Frame TV and Hisense’s 2025 CanvasTV. The 65-inch CanvasTV is down to $779.99 ($520 off) — its best price of the year — while Samsung’s like-minded Frame TV is […]

"If you're 22 years old in San Francisco and building something in AI, there may be a seed term sheet in your inbox — but if you're 19, oh my God, this means you're really good; you might already have a Series A [offer]," said one, half-kiddingly.

Ive subscribed and operated with the notion of build, fail, grow, and it has always been a humbling process, but recently I have been hearing about a “new” feeling of failure. "I tried my best and it didn't work." -> Move on "I had this super intelligent tool and STILL failed."-> Rinse and repeat Its like AI accelerates idea failure and because it is embedded in a hyper rinse & repeat, the feeling of failure is amplified. Is anyone else feeling or seeing this? submitted by /u/Outrageous-Pop-2853 [link] [留言]

You may have heard that Valve's new Steam Controller can ring like a telephone or do the Wilhelm scream. But did you know it can sing songs, too? Let me show you. Here's the new Steam Controller performing the "Ground Theme" from Super Mario Bros. 2: Here is "Still Alive" from Portal - fitting for […]

I live in a part of Los Angeles where I feel safer bringing pepper spray on walks. The problem is, I don't always remember to bring it with me, and it's not legal to carry it everywhere I go. Pebblebee's $59.99 Halo Bluetooth tracker surprised me by being a suitable replacement because it doubles as […]

As handheld consoles continue to grow and push the limits of what you can actually hold in your hands, the Arduboy FX-C comes in a refreshingly pocketable package. It manages to squeeze the best features of past models and some welcome upgrades into a handheld that’s still no larger or thicker than a few credit […]

has many of you know Their are a growing number of CEOs who are looking too replace human workers. We need too start Boycotting companies who replace Human workers with ai. People start calling your elected officials and demand they support legislation restricting Ai and how companies can use it. submitted by /u/thegreatdouchebag69 [link] [留言]

I want 1-2 AI/ML related pirated course. If anyone has it please comment. submitted by /u/hassan21018 [link] [留言]

Craig Campbell walked away from the river of investor money flowing into AI to create, of all things, a website. Sure, Campbell probably could have started an AI company. He's a former engineer at Meta and an experienced tech founder who in 2022 sold his last venture - an e-commerce tool for businesses that use […]

Aliyah, a light-skinned Black woman dressed in country-western gear, is struggling to sell metal buckles she handmade on TikTok. In a video for the social media platform from March, she cries to the camera and pleads for views: "Even as a black woman, I have more faith that white women will stay 13 seconds [on […]

We’ve compiled an overview of some of the top alternative browsers available today aiming to challenge Chrome and Safari.

The Ninja Artisan Outdoor Pizza Oven is aimed at people who want delicious pizza nights without having to deal with things like propane or wood pellets, unlike many other pizza ovens.

TikTok may be working to become the app that people use for most of their digital activities.

Backrooms is a wild ride, and it's yet another example of how many great directors are coming from the internet

Meta's mouse tracking tool for employees could capture non-US data and could violate the EU's privacy rules, according to Reuters.

> TL;DR — I run four different domains off one Next.js codebase: a marketing site at pagestrike.com , an authenticated app at app.pagestrike.com, a public publishing domain at pagestrike.app, and customer-owned domains. The trick isn't deploying four apps — it's a single proxy.ts that reads the host and rewrites/redirects/passes-through per-request. This post walks through why I chose this shape, the parts I got wrong, and the cookie-domain trick that makes it all stick. Stack: Next.js 16 App Router , Supabase , Vercel , one proxy.ts file (~370 lines). This is the second post in my build-in-public series on PageStrike . Last week I wrote about the 6-CTA architecture — modeling conversion intent as a discriminated union so one launch could be a checkout, a COD form, or a calendar booking. This post is about a different primitive: modeling host as routing context so one codebase can serve four very different audiences. Why four domains, not one Most SaaS apps live at one domain — say myapp.com with /dashboard under it. That works until you grow into edge cases that don't fit: Marketing pages get spammed by your own dashboard headers. Your marketing nav says "Sign in / Pricing / Blog". Your dashboard nav says "Launches / Contacts / Settings". You either A/B them with conditional logic everywhere or you live with the noise. Public user-generated pages share your domain reputation. When a customer publishes a landing page at myapp.com/p/[slug] , every spammy LP from a free-tier user drags down myapp.com 's sender reputation, search trust, and ad-account standing. Google and Meta penalize the host, not the path. Custom domains don't route cleanly. A customer who buys acmewidgets.com and points it at your app expects their LP at acmewidgets.com/ — not myapp.com/p/acme-widgets . You need a rewrite that's transparent to the visitor, doesn't 404 on _next/static/* , and survives RSC prefetches. I split PageStrike — a free AI landing page builder — across four hosts to solve al

I have been thinking a lot about coding agents lately. Not really about whether they can write good code, because usually they can, sometimes they can't. That part is obvious. But the risk is shifting from wrong answers to wrong outcomes. The part that feels more important to me is this: should the agent actually own the write authority? We already don't trust humans without roles, limits, reviews, and accountability. Developers use PRs, pilots use checklists, bank clerks have transfer limits. Capable agents need the same structure, but machine-readable. Right now a lot of setups still look roughly like this: agent reads the repo agent decides what to change agent has a GitHub token agent creates commits, branches, or PRs I don't think this is the right default. The agent can reason. The agent can inspect files. The agent can propose changes. But the moment it can directly create external impact, the problem changes. It is no longer just: did the agent say something wrong? It becomes: did the agent create the wrong outcome? That is a much more expensive failure mode. Intent is not authority The pattern I like more is simple: agent reads directly agent proposes intent a boundary decides an adapter materializes only admitted work So the agent does not get the write credentials. It submits a structured intent instead, which could look like: { "operation" : "write" , "target" : { "repo" : "example/app" , "branch" : "main" , "path" : "docs/config/agent-policy.md" }, "source_state" : { "blob_sha" : "8f31c2..." }, "requested_effect_hash" : "sha256:..." } This is then not a command anymore, it is a suggestion, or an intent. The system still has to decide whether this proposed outcome should exist. That decision layer can check things like: is this actor allowed? is this repo allowed? is this path in scope? does the source state still match? is this operation allowed? was the same effect already created? should this become a reviewable PR? Only after that should there be an

Pulling together this week's major AI releases for anyone who didn't have time to track every blog post. Sticking to substantive changes, not hype. Anthropic — Claude Opus 4.8 Released this week. Headline pricing unchanged, but Fast Mode dropped from $30 input / $150 output per million tokens to $10 / $50 — a 3x reduction on the premium tier. Reported improvements in "judgment" and longer autonomous runs. Also shipped 20+ legal MCP connectors and Microsoft 365 add-ins (Excel, PowerPoint, Word) in GA. Alibaba — Qwen 3.7 Max Launched May 20 at Alibaba Cloud Summit. 1M-token context. Reported to top Claude Opus 4.6 Max on Terminal-Bench 2.0, SWE-Bench Pro, and MCP-Atlas. Pricing $2.50 / $7.50 per million tokens — roughly half of Opus 4.7. Alibaba claims autonomous operation up to 35 hours without performance degradation. Alibaba is now ranked #6 lab globally on Arena text leaderboard. OpenAI — GPT-5.5 Instant Now default in ChatGPT. Reports 52.5% fewer hallucinated claims than GPT-5.3 Instant on high-stakes prompts (medicine, law, finance). OpenAI also shipped a ChatGPT sidebar inside Excel and Google Sheets, plus a personal finance dashboard for Pro users (US only). Google — Gemini 3.5 Flash Reported to beat Gemini 3.1 Pro on coding and agentic benchmarks at ~4x faster output token rate. Ultra subscription cut from $250 to $200/month; new $100/month Developer tier introduced. xAI — Grok Build 0.1 Coding agent moved to public API beta May 28. Custom Skills feature added for reusable user-defined tasks. Connectors for SharePoint, OneDrive, Notion, GitHub, Linear, plus bring-your-own MCP support. Mistral Launched Vibe (unified work + code agent, replaces Le Chat). Acquired Emmi AI for physics-based simulation. Targeting €1B revenue in 2026; new 10MW inference DC announced. Hugging Face Launched an app store for the Reachy Mini robot. ~10,000 units shipped. Also reported a malicious repo masquerading as an OpenAI release that accumulated 244K downloads before takedown — r