Connor Tumbleson

@Sourcetoad Director of Engineering, Apktool Maintainer, PHP nerd, Leaf Halo stats, OSS maintainer, Cicada 3301 researcher. Opinions are my own.

[Connor Tumbleson @iBotPeaches]

Made some time as hits got too heavy floating around 80-90/sec. Averaging 2-3 million a day.

Not natural growth w/ mix of AI and some attack (mix of slowloris style & early client closes).

Have deployed caches, bans, rate limits and more all via NGINX.

[Connor Tumbleson @iBotPeaches]

Leaf is having some issues because our traffic went from like 50k requests a day to ~2mil/day. Of course most of that traffic is all AI agents.

Don't like it, but don't have time at the moment to dig into it more. Don't understand why OpenAI needs to hit Leaf 356k times in 24h.

[Connor Tumbleson @iBotPeaches]

fastlane (tools) 2.235.0 is out!

- app clips!
- bye bye Ruby 2.7
- vuln patches
- fix 2fa on match
- fix crashes if no builds on Android track

https://t.co/GeqvP7Em2S

[Connor Tumbleson @iBotPeaches]

fastlane 2.234.0 is out!

- frameit support for iPhone 16 & 17
- match fixes for cert filtering
- supply support for ADG creds (Google)
- bug fixes all around

https://t.co/lClDOdakRA

[Connor Tumbleson @iBotPeaches]

https://t.co/bdVJtmoMQE

[Connor Tumbleson @iBotPeaches]

fastlane 2.333.1 is out!

- Fixes regression that caused app previews to run on deliver no matter what.

We were also approved on OpenCollective! As fastlane lost funding in 2021 we are now moving to community donations to help fund the maintainers!

[Connor Tumbleson @iBotPeaches]

@enunomaduro We did the same a few years ago - https://t.co/PcVd5nShea

Each Laravel release has more fluent and less magic strings and I'm all here for it.

[Connor Tumbleson @iBotPeaches]

Hard-stuck lvl30 in Halo 2. Never hit 50 in Halo 3 :(

Dark Peach & Bio Toxic Peach

All older accounts that led up to "iBotPeaches" and "iBot" present names.

Shout out @HaloArchive

[Connor Tumbleson @iBotPeaches]

OpenAI for PHP v0.19.2 is out!

- fixes for response streaming
- fixes for 5xx error catching
- fixes for vector store

https://t.co/05zCozWbrm

[Connor Tumbleson @iBotPeaches]

apktool 3.0.2 is out!

- performance boosts
- CVE-2026-39973 fix
- bug fixes for splits & Meta apks

https://t.co/UYjzwXBH2g

[Connor Tumbleson @iBotPeaches]

fastlane 2.33.0 is out!

- fixes for scan, match and more
- patches for vulnerabilities
- sirp fixes
- initial support for app preview videos

https://t.co/TArCmnr67T

[Connor Tumbleson @iBotPeaches]

An attacker using their pwned credentials to spam the issue thread of the discovery is interesting, thankfully PyPI quarantined LiteLLM to reduce the blast radius.

https://t.co/EPAYkbd6lS - 311 comments and counting.

[BSides Tampa IT Security Conference @BSidesTampa]

The 2026 BSides Tampa schedule is now live! We're thrilled to present an exciting lineup of tracks for you to explore: Main Room, AI, Compliance, Defense, Offense, Career, and Leadership. Seize the opportunity to craft your upcoming journey today! ARRRRRR! https://t.co/TMIaVImrDt

[Connor Tumbleson @iBotPeaches]

Leaf v11.17.0 is out!

* Been tracking playlist changes for almost a year. Now there is an interface to visualize them.
* Can look at delta of current rotation (vs last)
* Can look at historic breakdown of a playlist

https://t.co/UTdS2ENItw

[Connor Tumbleson @iBotPeaches]

Over my head. The cert has an extension that standard tooling doesn't recognize (1.2.840.113635.100.6.27.3.2) and thus rejects it.

Safari accepts it, but my iPhone using Enterprise apps does not. So who knows. Still no sign of Apple acknowledging - https://t.co/RyuvRxvGbn

[Connor Tumbleson @iBotPeaches]

Things are melting. Apple unable to verify application.

trustd - Malformed anchor records, not an array
springboard - validation failed because of missing trust and/or authorization (0xe8008026)

[Connor Tumbleson @iBotPeaches]

fastlane 2.232.2 is out!

- vuln patches
- prevents cluttering of global bin space w/ "console"
- prevents swallowing catastrophic errors (missing gems, etc)
- fixes regression on resign(.sh)

https://t.co/ZiJgRcqUNC

[Connor Tumbleson @iBotPeaches]

@0xD34D @Flock_Safety thanks. New to this, but I drove to one on a map and never found it.

I will return with this app to see if its real or a bogus map entry.

https://t.co/1Os5yEQrSj

[Connor Tumbleson @iBotPeaches]

The big Apktool 3.0.0 is out!

https://t.co/DjgQdkxhUH

- no more aapt1
- no more 32bit
- tons of fixes
- tons of improvements

[Connor Tumbleson @iBotPeaches]

Been down with Pneumonia since late January. Way worse of a sickness when you are older.

Behind in everything open source and more. I'll catch up when back at it.