• 16 Posts
  • 359 Comments
Joined 3 years ago
cake
Cake day: July 13th, 2023

help-circle





  • Banks love to reinvent the wheel and definitely can’t trust Google to be part of their workflow, as Google will 100% change UI or steps or rename the app or discontinue the app while replacing it with an identical one but with a different name but less features with no advance notice. Relying on Google for banking workflow means that one day the bank user support will be overwhelmed by requests like “the button disappeared, where is it now”

    For the rest of stuff, this system IMHO has too much friction, the bounce rate will be too high. Businesses won’t like to pay for a bot detection system (it costs $1 per 1000 verifications) that will push humans away while bots pass it without problems (either by using the accessibility workaround or by using those smartphone farms in southeast Asia)


  • Did they vibe coded the backend?

    An hacker can get:

    • GPS position
    • Email address
    • Video feed
    • WiFi password
    • Root access to a Linux client in the same WiFi network of the victim which means can change the DNS servers in the router for a mitm Attack if the default password hasn’t been changed (and nobody changes that)

    And they demonstrated to the journalist…

    1. Get a list of every “smart” lawnmower nearby a nuclear plant
    2. Check the emails of the owner in LinkedIn or something like that to see who could work at that nuclear plant
    3. Have access to his home network and a video feed on a robot that can be remotely moved to other position to check the perimeter

    Scary


  • This is awesome news for scammers:

    1. Fake page will say “you need to scan this qr code to verify you’re human”
    2. Users normally dismisses this shit, but it has become normal nowadays, take out the phone to scan it
    3. Qr code opens a page on totallynotascam.com that say “you need to install this totally safe APK on your device for verification 😉”
    4. APK passes the new useless developer “verification” as the scammer either used a hacked dev account or just paid $25 with a stolen id + stolen credit card
    5. User see the message “APK verified by Google play protect” and would totally believe the bullshit, giving all the possible permissions to the app




  • Assistant was made 100x stupider over the course of the years. I clearly remember in 2020 asking basic questions like “where’s Lima” and it replied “Peru”, while since 2023 it replied “ok, starting navigation to Lima, Peru, estimated time 2 days and 10 hours”.

    Around 2023 also they made the voice assistant completely useless by changing the responses from “for this answer open the link in your notification bar on the phone” to “sorry, I didn’t understand”, which was pissing me off too much. I completely stopped to use it as 9 questions out of 10 would be “sorry I didn’t understand” instead of “I understood but I’m not programmed to give a voice answer, use your phone”.

    Navigation by voice was a complete disaster.

    “Navigate to <CONTACT NAME>” - “Ok navigating to <a random business 1000 km away with a name slightly similar to what I said>”

    Or, it dropped the road name: you asked to go to “street name, city” and it placed the destination on the geographic center of that city

    Also the navigation instructions would have maximum priority and would play even when listening to a command.

    “Send a message: I’m going to be late <assistant overlaps my speech>” - “Sending: I’m going to be late on the next exit take the right lane then after 600 meters turn left. Ready to send it?”

    “Call Anna” - “OK, I call Daniel”








  • Background: many people vibe coded a python proxy for the official Claude code app “converting” its outputs as an openai compatible API to be used with openclaw

    edit: i did some web search and found snippets like:

    OpenClaw spawns Claude Code sessions via ACP

    and

    ACP gives OpenClaw a way to run external coding harnesses — Claude Code, Codex, Gemini CLI — as supervised child processes instead of doing everything inline in the main agent loop.

    so it looks like openclaw users were using this ACP method as a workaround to use a $20 subscription to get $1000 worth of token usage. I’m guessing that openclaw JSON example posted in the article is the configuration of this ACP server or something like that.