Fuddy

Information Security undergraduate at NUS.
I like plants, fishes and cats ;)

[Zhao DaShuai 东北进修🇨🇳 Commentary @zhao_dashuai]

Now you know why Epstein didn't invite him to the island.

[Sound Dobad @SoundDobad]

Jensen deciding what to pack

[加密小象 @cryptoxiaoxiang]

今晚Trump和Xi会面之后的after party be like

[Rishabh @Rixhabh__]

This guy used AI to put himself in Game of Thrones and fix everything

[Not Jerome Powell @alifarhat79]

That moment when you forget which glass you poisoned

[App Economy Insights @EconomyApp]

$AAPL Apple Q2 FY26 (March quarter):

📱 Products +17% Y/Y to $80.2B.
💳 Services +16% Y/Y to $31.0B.

• Revenue +17% Y/Y to $111.2B ($1.6B beat).
• Operating margin 32% (+1pp Y/Y).
• EPS $2.01 ($0.07 beat).

[App Economy Insights @EconomyApp]

$GOOG Alphabet Q1 FY26:

• Revenue +22% Y/Y to $109.9B ($2.9B beat).
• Operating margin 36% (+2pp Y/Y).
• $37.7B net gains from equity investments.

☁️ Google Cloud:
• Revenue +63% Y/Y to $20.0B.
• Operating margin 33% (+15pp Y/Y).

▶️ YouTube ads +11% to $9.9B.

[Yahoo Finance @YahooFinance]

Fed Chair Powell has left the building. 🫡

[ChatGPT @ChatGPTapp]

at long last

[Tim Cook @tim_cook]

I want to thank everyone for the outpouring of love and thank you for believing in me to lead the company that has always put you at the center of our work. This is not goodbye. It’s a hello to John and I can’t wait for you to get to know him like I do! 🙏

[Dexerto @Dexerto]

A KitKat truck with 'presidential-level' protection was spotted in Canada, surrounded by four black SUVs with red flags

The stunt comes weeks after 12 tons of the bars were stolen

[Chaofan Shou @Fried_rice]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G

[KITKAT @KITKAT]

Regarding recent press coverage

[Mandy Lu @mandylu]

justifing my bubble sort solution in the technical interview

[Neil Zeghidour @neilzegh]

Me defending my O(n^3) solution to the coding interviewer.

[Cinema 4 You @cinema4yu]

Best in The World:⤵️

1. 🇸🇬 Best Education → Singapore
2. 🇨🇭 Best Innovation → Switzerland
3. 🇮🇹 Best Food → Italy
4. 🇮🇸 Best Safety → Iceland
5. 🇹🇼 Best Healthcare → Taiwan
6. 🇨🇭 Best Quality of Life → Switzerland
7. 🇳🇱 Best Work-Life Balance → Netherlands
8. 🇸🇬 Best Public Transport → Singapore
9. 🇸🇬 Best Internet Speed → Singapore
10. 🇺🇸 Best Universities → United States
11. 🇫🇮 Best Happiness → Finland
12. 🇮🇸 Best Clean Energy Use → Iceland
13. 🇺🇸 Best Startup Ecosystem → United States
14. 🇨🇳 Best Manufacturing → China
15. 🇫🇷 Best Tourism → France
16. 🇩🇰 Best Governance → Denmark
17. 🇩🇰 Best Low Corruption → Denmark
18. 🇩🇰 Best Women Safety & Equality → Denmark
19. 🇸🇬 Best Smart Infrastructure → Singapore
20. 🇪🇪 Best Digital Government → Estonia
21. 🇩🇰 Best Rule of Law → Denmark
22. 🇳🇿 Best Air Quality → New Zealand
23. 🇩🇰 Best Climate Action → Denmark
24. 🇺🇸 Best Space Technology → United States
25. 🇨🇭 Best Financial Stability → Switzerland
26. 🇵🇦 Best Ease of Living for Expats → Panama
27. 🇩🇰 Best Social Security → Denmark
28. 🇳🇱 Best Urban Planning → Netherlands
29. 🇳🇴 Best Renewable Energy Share → Norway
30. 🇨🇭 Best Overall Living Country → Switzerland

Source: OECD, UN, World Bank

[Jack @jackunheard]

PRESIDENT TRUMP is a SAVAGE 🤣

TRUMP: "Who are you with?"

CNN: “US White House TV pool. I'm wondering….”

TRUMP: "What NETWORK?"

CNN: “I'm with CNN, sir.”

"Why didn't you just say CNN? Fake News!"

[The Kobeissi Letter @KobeissiLetter]

BREAKING: Fed Chair Powell responds after Federal prosecutors open a criminal investigation into him:

“The threat of criminal charges is a consequence of the Fed setting rates based on our best assessment of what will serve the public, rather than following the preferences of the President,” he says.

[Ryanair @Ryanair]

another happy customer

[Peter Girnus 🦅 @gothburz]

Someone found an RCE on my website yesterday.

CVE-2025-55182.

React2Shell.

I don't have a bug bounty program.

I never asked for a security assessment.

I woke up to a DM: "Hey I found a critical vulnerability in your site. I only ran the exploit to verify it worked. Here's my PayPal for the bounty."

Bounty?

I checked my logs.

Forty-seven requests to my RSC endpoint.

Something, something ... Prototype pollution payloads.

They used the GitHub script.

The one with 2,000 stars.

The one that runs id automatically "for verification purposes."

They spawned a shell on my production server.

uid=1001(nextjs) gid=65533(nogroup)

They took a screenshot.

They posted it on Twitter.

"Popped a Shell on a Live Website 🚀💀 #BugBounty #CVE-2025-55182 #YOLO"

They got 84781 likes.

My customers' data was on that server.

I asked them to delete the screenshots.

They said "I removed the domain name, you should be thanking me."

Thanking them.

For unauthorized access to my production infrastructure.

For running arbitrary commands on systems I own.

For posting proof of exploitation for clout.

They called it "responsible disclosure."

I called my lawyer.

They called me "ungrateful."

I called the FBI.

Now they're in my DMs explaining that "this is how the industry works" and I "don't understand pen testing."

A pen what?

I understand it perfectly.

I understand that running https://t.co/C6kmBequB5 against random websites isn't research.

I understand that "I removed the identifying info" doesn't undo the unauthorized access.

I understand that #BugBounty doesn't apply when there's no bounty program.

I understand that finding my site on Shodan doesn't constitute authorization.

Their followers are defending them now.

"Presumption of innocence."

"You don't know if it was authorized."

"The screenshots were redacted."

Three hundred people are calling me a bootlicker for reporting a crime.

Someone said I should be grateful they didn't deploy a cryptominer.

The bar is underground.

I just wanted to run a small Next.js app.

I didn't ask to be someone's proof-of-concept.

I didn't consent to being their "first"

I didn't sign up for an unscheduled penetration test from a stranger with a GitHub account.

There is no safe harbor for spraying public exploits at random websites.

There is no legal protection for "I was just verifying the vulnerability."

There is no ethical framework where unauthorized prototype pollution is a favor.

But sure.

Thank you for your service.

You found a CVE that was already public.

Using a tool someone else wrote.

Against a target that never authorized you.

And you posted about it on main.

For likes.

Hero.