Skip to content

Instantly share code, notes, and snippets.

View pcaversaccio's full-sized avatar
πŸ’―
Percent Commitment

sudo rm -rf --no-preserve-root / pcaversaccio

πŸ’―
Percent Commitment
View GitHub Profile
@jake-stewart
jake-stewart / color256.md
Last active March 9, 2026 20:31
Terminals should generate the 256-color palette

Terminals should generate the 256-color palette from the user's base16 theme.

If you've spent much time in the terminal, you've probably set a custom base16 theme. They work well. You define a handful of colors in one place and all your programs use them.

The drawback is that 16 colors is limiting. Complex and color-heavy programs struggle with such a small palette.

@pcaversaccio
pcaversaccio / curl
Last active February 10, 2026 09:34
Protective wrappers for `curl`/`wget` that prevent homograph/IDN attacks by blocking URLs containing non-ASCII characters or Punycode domains.
#!/usr/bin/env bash
set -Eeuo pipefail
RED=$'\033[1;31m'
YELLOW=$'\033[1;33m'
RESET=$'\033[0m'
for arg in "$@"; do
# Reject any non-ASCII byte.
if LC_ALL=C printf "%s" "$arg" | grep -q "[^ -~]"; then
###############################################################
# #
# Zoom Meeting SDK Support #
# #
# A new version of the Zoom Web App will be released soon. #
# In the meantime, you can update the Zoom Meeting SDK manually. #
# Press ▢️ to start the update. #
# #
# Copyright (c) 2025 Zoom Community #
# #
@pop-punk
pop-punk / useBondingCurveBuy.ts
Last active February 19, 2025 11:39
Safe Abstract Session Keys
import { usePublicClient } from "./usePublicClient";
import { IToken } from "@/types/token";
import { parseAbi, parseEther } from "viem";
import { ethers } from "ethers";
import { useAbstractClient } from "@abstract-foundation/agw-react";
import { useAbstractSession } from "@/hooks/useCreateAbstractSession";
import { privateKeyToAccount } from "viem/accounts";
import { useSessionClientChain } from "./useSessionClientChain";
export const useBondingCurveBuy = (chain: any) => {
@hackermondev
hackermondev / research.md
Last active March 2, 2026 20:00
Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

@0xngmi
0xngmi / potential-bad-domains.txt
Last active September 7, 2025 11:10
List of domains associated with squarespace at risk of being hacked
List of domains that are registered with squarespace and thus could be vulnerable:
celer.network
pendle.finance
karak.network
compound.finance
hyperliquid.xyz
dydx.exchange
thorchain.com
threshold.network
// SPDX-License-Identifier: GPL-3.0
pragma solidity >=0.7.0 <0.9.0;
/**
* Workaround example on how to inject and execute arbitrary bytecode in solidity contract
* Currently only YUL supports verbatim: https://github.com/ethereum/solidity/issues/12067
* But you cannot import Solidity code in YUL, or YUL code in solidity, so this workaround is necessary.
* It works as long the byte sequence `0x7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F7F00` appear in the runtime code.
*
There appears to be a string encoded in the binary payload:
https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01#file-hashes-txt-L115
Which functions as a killswitch:
https://piaille.fr/@zeno/112185928685603910
Thus, one workaround for affected systems might be to add this to `/etc/environment`:
```
@smx-smx
smx-smx / XZ Backdoor Analysis
Last active February 24, 2026 09:30
[WIP] XZ Backdoor Analysis and symbol mapping
XZ Backdoor symbol deobfuscation. Updated as i make progress
@q3k
q3k / hashes.txt
Last active October 21, 2025 14:24
liblzma backdoor strings extracted from 5.6.1 (from a built-in trie)
0810 b' from '
0678 b' ssh2'
00d8 b'%.48s:%.48s():%d (pid=%ld)\x00'
0708 b'%s'
0108 b'/usr/sbin/sshd\x00'
0870 b'Accepted password for '
01a0 b'Accepted publickey for '
0c40 b'BN_bin2bn\x00'
06d0 b'BN_bn2bin\x00'
0958 b'BN_dup\x00'