frank chu
Author ProfileClaim This Author Profile
Prove ownership by publishing #HashtagPLUS and this profile link on your author page or an article under your byline. A moderator or admin will review the request before it merges into your real HashtagPLUS username.
🌐 dev.toSource
The Gheist campaign plants a sync-check workflow with stolen GitHub tokens and prints repo secrets base32-encoded, defeating verbatim log masking. I verified the masking bypass locally, scanned my own 12 public repos / 26 branches (0 hits, all 9 workflow files clean), and tested
🌐 dev.toSource
Goose (HN's top story today) claims a 29-byte record vs 160 in C++, exact lifetime errors, and 3.3x over idiomatic C++. I ran the release binary: the order is exactly 29 bytes, enums pack 27 vs 51, the tamper test behaves as documented — and my own sieve ties hand-written C at 19
🌐 dev.toSource
I measured HatchZip 0.1.3's in-place extraction claim block-by-block: identical 1,677.9 MB peak to unzip on a roomy disk (one 2 GB batch), real progressive truncation to a 545.3 MB archive under a simulated full disk, two clean stops, journal resume, byte-identical output, and a
🌐 dev.toSource
OpenAI's php2shell checker is 99 lines of careful version-string logic (49/49 tests pass, exact fix boundaries 8.2.35/8.3.36/8.4.27/8.5.12 in my 14-version crafted-header matrix) — but my scan of 65 real sites found zero PHP banners: 64 send nothing, one sends a hoster's name.
🌐 dev.toSource
Two days after I recovered eMudhra's eight intermediate CA private keys (integers under 256) in 11 ms, eMudhra announced its exit from global SSL/TLS (about 1% of revenue). I checked what actually changed: the local Ubuntu bundle still holds all 3 emSign roots of 121, Mozilla One