nickr

@kasada_io bot smasher. I fight robots. I build things to break other things.

[Addy Osmani @addyosmani]

Chrome just became massively more agent-friendly 🔥 Your real, signed-in browser can now be natively accessible to any coding agent.

No extensions.
No headless browser.
No screenshots.
No separate logins.

Just one toggle to enable it.

Check this out: https://t.co/6ugwmOolnj

[nickr @WebsecNick]

@thejuicemedia I don't know about anyone else, but my kids have not even been age verified yet.
https://t.co/nckQcC41ZV

[nickr @WebsecNick]

Are Aussie teens really being kept off social media? 🤔

I just shared my experience with the new social media ban. The data so far is surprising.

Parents: share yours too 👇
https://t.co/nckQcC41ZV

#socialmediaban

[nickr @WebsecNick]

@BohuangMars It's a common tactic - they call it email bombing. It's intended to push any automatic email alert created by the purchase to be pushed beyond page one of your email in box

[nickr @WebsecNick]

@MSeqVC @kasada_io Thanks for joining us on this wild adventure 🙌

[nickr @WebsecNick]

Oh dear. https://t.co/KBLmgbbMNc's new anti-bot solution seems to be struggling under the pressure...

[nickr @WebsecNick]

@andrewqu @MadsMcIlwain @vercel I was expecting them to be names of famous ships…

[nickr @WebsecNick]

@clairevo @MattyB FWIW, Gong provides an API that you can use to export transcripts rather than using Zapier.
We've built a bunch of internal tools on Lovable that leverages vendor this API and others.

[nickr @WebsecNick]

@vercel_dev @rauchg Let’s smash more bots!!!

[nickr @WebsecNick]

@andrewqu 10x human

[nickr @WebsecNick]

@theo As at May/June it had better backend integration. I built a puppeteer browser pool app back then and it was ok

[nickr @WebsecNick]

@re_jevi @cramforce I think it’s largely marketing led product development. The concept sounds fine. The practical realities are that this will be DOA.
They’ve generated lots of PR though, so they achieved that goal at least.

[nickr @WebsecNick]

Saturday vibes: coded a functioning config model + UI for Puppeteer stealth.
#vibecoding

[nickr @WebsecNick]

The #vibecoding lifecycle

[nickr @WebsecNick]

@_k3ru Yes my 100% clientside tinder for bots test is secretly recording! 🫣

[nickr @WebsecNick]

🔥 Just scored 190 points (Expert level) on our Bot Detection Challenge

Built this as internal training - turned out way more fun than expected

Think you can beat my score?
It's trickier than it looks 👀

Accuracy + speed both count, just like real systems
https://t.co/1GIX0lXWJi

[nickr @WebsecNick]

@vladcooks dont tell our sales team ;)

[nickr @WebsecNick]

@vladcooks IPowered By K4sada

[Malte Ubl @cramforce]

I was reading a HN post about a new Chrome header `x-browser-validation` that appeared in the wild. The quality of the discussion is just absolutely abysmal, but it turns out to be quite interesting:

- I first tried to validate if the post is actually talking about something real and the answer is: Not really. At least not generally. You can easily validate by going to any[See below] website and check devtools.

- Chrome does NOT actually generally send a new header called x-browser-validation (a lonely commenter on HN realized this but was ignored)

- However, knowing Google quite well, I was like: “Maybe it is real, but they only send it to their own properties”

- Turns out that is right. https://t.co/S9khBbdbWS and https://t.co/aZC3iGVPgv (at the very least) actually do get the header

- Can it be used for tracking? Not really, it’s sha1(userAgent + hardCodedAPIKeyThatIsNowOnGithub)

- Can it be used for validating real browsers? No, cause, like, it’s a hard coded value

- What is it for then: My guess is that this is used to remove noise from experimentation that happens during Chrome version and potentially feature roll out. It must be a use case where there is more accidental spoofing than malicious activity