文章

A few patterns with Truchet tiles

Small tool showcasing a few patterns on a grid of Truchet tiles

Carlos Neves / Blog · EN

Pointer to Array in C: Compression File Analogy

DISCLAIMER Keep in mind that this is only an analogy to help newcomer understand pointer to array in C programming language. This does not mean there&rsquo;s any sort of compression when we use pointer to array. &arr vs &arr[0] In case you didn&rsquo;t know, we can get the address of an array using the address-of operator like &array. Here&rsquo;s an example: #include <stdio.h> int main(void) { int arr[2]; printf("&arr: %p\n", &arr); // Address to _whole array_.

/dev/null · EN

Shell Redirection Order

A Brief Intro When i take a look at bash&rsquo;s documentation about shell redirection , i found out that this two examples are different. This one: ls > dirlist 2>&1 and this one: ls 2>&1 > dirlist So let&rsquo;s try understanding why it is different. What 2>&1 means? From this hacker news comment , it looks like the expression 2>&1 is like calling system call dup2(2, 1). If we take a look at the man page (man dup2), here is one of the description:

/dev/null · EN

Initialize Struct to Zero in C

DISCLAIMER: Keep in mind that at the time of writing this blog post, i am still learning about C programming language and lack experience to validate the information from the low-level perspective. This blog post act like my public notes, which might be wrong. When i read this article about self-pipe trick, i found this code snippet: ... struct sigaction sa; memset(&sa, 0, sizeof(sa)); ... That make me wonder, do we need to use memset() to initialize the struct to 0?

/dev/null · EN

Alternative to strcpy() and strncpy() in C

Brief Intro I have seen some people said that strcpy() can be dangerous to use. At that time, I am not sure why strcpy() can be dangerous, but now I have found a simple replication of why strcpy() can be dangerous. This is also the case with strncpy(), which does not guarantee a null terminated string. At the time of writing this blog post, I am still getting started learning C programming language.

/dev/null · EN

Disable Memory Address Randomization for Shell

At the time of writing this blog post, i recently learn about virtual memory. So i am curious, how can we trigger the same memory address on different process? After reading this gcc wiki , it looks like we can use setarch to do that. First thing first, we need to create a simple program to print the memory address. For this example, i am going to use C programming language, like this:

/dev/null · EN

Linux Kernel Mentorship Spring 2026 Journey

A Brief Intro Before starting the Linux Kernel Mentorship Program from Linux Foundation , I used to work as a web developer. With how chaotic web development has become , I decided to take a career break. I have been interested in the low-level programming, so I use my time during this career break to learn more about low-level programming. With that in mind, this blog post&rsquo;s perspective is from someone who is completely new to kernel development and also new to C programming language.

/dev/null · EN

The Future Is Undefined

If you ever learn about programming, especially using C programming language, you will most likely know about undefined behavior . Undefined behavior in C programming language is basically anything can happen at that point, there are no restrictions on the behavior of the program. When we enter the undefined behavior zone, the program behavior become unpredictable, the program can crash or even delete the root filesystem, anything is valid. A lot of people didn&rsquo;t like undefined behavior in C programming language most likely because it&rsquo;s unpredictable or non-deterministic, but the b

/dev/null · EN

Programming from the Ground Up as Primer to Programming

Recently I read the book titled Programming from the Ground up and I think this book can be considered as one of the options for anyone wants to learn programming for the first time. Keep in mind that this is not the only book you can use to learn about programming, there other books you can use too. What I found interesting about this book is that this book give a nice explanation about a basic concept, such as what is buffer and how computer view memory, which is not always the case in other introductory programming book.

/dev/null · EN

I Hacked BellaBot and Every Robot from China's Biggest Robotics Company (Pudu Only Fixed It When I Told Their Clients)

Critical vulnerabilities in Pudu Robotics allowed unauthorized control of every Pudu Robotics Robot worldwide. They ignored emails until I contacted Skylark Holdings and Zensho about their compromised robot fleets.

bobdahacker blog · EN

Taimi: Finding Everyone's Private Photos Was Easy, But So Was Getting Paid

How I found critical IDOR vulnerabilities in Taimi that exposed "expiring" videos, private photos through a bizarre location feature, and allowed fake system messages - and how they actually handled it right with a $10k bounty.

bobdahacker blog · EN

Bandsintown: How I Almost Rickrolled 191k People

How I found a verification bypass in Bandsintown that let anyone claim unclaimed artist pages with a single API call - including Rick Astley's 191k followers, their emails, and the ability to send push notifications as any artist.

bobdahacker blog · EN

Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks

How I found critical vulnerabilities in Petlibro smart pet feeders allowing complete account takeover via broken OAuth, access to anyone's pet data, device hijacking, and private audio recordings - and how they're still leaving the auth bypass active for 'legacy compatibility' two months later.

bobdahacker blog · EN

I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.

How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live FIFA World Cup 2026 camera feed. I then spent hours calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.

bobdahacker blog · EN

Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.

How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.

bobdahacker blog · EN

Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails

How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported January 3rd. Still live six months later. Nobody has ever responded.

bobdahacker blog · EN

tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open

How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me nothing but seen receipts.

bobdahacker blog · EN

Warranty Void If Regenerated

Warranty Void If Regenerated by Scott Werner (via Valentine): His shop was in a corrugated steel building on Highway 29, between a feed store and a Laundromat. It had a waiting area with four plastic chairs and a coffee machine that Tom had specified himself and which made coffee that was, by consensus of his clients, exactly adequate and no better. He’d tried to improve the spec three times. Each time, the regenerated firmware made the coffee subtly worse in a different way. He’d eventually concluded that coffee machine specs existed at the exact intersection of fluid dynamics, thermal manage

bjorn.now · EN

It's beginning to crumble — The first steps of my breadcrumb tool

I had a breakthrough while working on bjornstack that made me realize how I could make an MVP of breadcrumb, the tool I’ve wanted to build for ~18 months. So anyway, bjornstack is my opinionated take on how to write code, aimed at constraining and guiding genies to get their work done. And while working on it, like I have been whenever I’m working with genies, I got thoughts that I wanted to explore later, or ideas for other things I’m working on. I realized that since I started using beads capturing in this project has gotten easier, while chatting I just mention we need “a new bead about x b

bjorn.now · EN

How to manually restore a dolt db from its git remote

You can manually clone a dolt database from its git remote when bd bootstrap or bd init won’t cooperate. bd dolt stop: stop the server in the git repo you’re restoring so you can operate on its database cd ~/.beads/shared-server/dolt: go to the shared dolt server (it’s .beads/dolt/beads otherwise, I think) rm -rf : remove the DB if it exists already dolt clone git+ssh://git@github.com/user/repo.git : clone it to your prefix cd - && bd ready: see if you can see the listing I don’t know why my local just refused with bd bootstrap but this allowed me to fix it manually.

bjorn.now · EN

How to find which dolt databases need to be committed

dolt’s shared server won’t pull until all databases on the server have committed changes, not just the beads project you’re pulling. You’ll get Error 1105 (HY000): cannot merge with uncommitted changes and it’s confusing when the beads project you’re working in has autocommit on. The uncommitted changes are in a different project that’s also using the shared server. The fix is to go through your other projects and commit their changes (or enable autocommit by adding dolt.auto-commit: "on" to .beads/config.yml). To find which databases have uncommitted changes:

bjorn.now · EN

How to recover from a corrupted dolt journal

When dolt’s journal is corrupted, dolt fsck --revive-journal-with-data-loss will truncate it back to the last valid record. I found this error message when starting dolt up after upgrading the server: invalid journal record at offset 5831169: invalid journal record: CRC checksum does not match. To recover, go to your dolt DB: cd ~/.beads/shared-server/dolt/ \ && dolt fsck --revive-journal-with-data-loss It backs up the journal, truncates to the point it failed, and makes it possible to start the server again. In my case the db came back up with data loss. I did a bd dolt pull and it pulled in

bjorn.now · EN

beads 1.0.1 silently starts exporting issues.jsonl by default

beads 1.0.1 flipped the export.auto default to on, so old projects silently start exporting issues.jsonl after upgrade. To opt back out, run: bd config set export.auto false New projects get prompted during init, only existing projects will get this nice surprise. If you’re using dolt’s git export instead, commit the config change and delete the issues.jsonl file.

bjorn.now · EN

The IKEA Kajplats bulb wouldn't pair because my network had no IPv6

Matter over Thread requires IPv6 on your local network, so if you can’t pair the IKEA Kajplats bulb that might be why. I didn’t have IPv6 enabled, and my ISP doesn’t assign IPv6, so I used unique-local-ipv6.com to get a unique prefix. Configured it as static in my local network setup, alongside the IPv4 configuration, on my UniFi Dream Machine and then all my bulbs connected. Now my niece is learning to pronounce English colors as she cycles my apartment through every shade of the rainbow 😁

bjorn.now · EN