Timur Gok

Founder @ Byteful | ex sneaker twitter

[Timur Gok @timatbyteful]

This week Max taught the whole company how 100+ servers talk to each other without the public internet ever finding out.

Wisdom Wednesday is where one person at @byteful teaches everyone else something they know well. Max's was @Tailscale. One private network across datacentres, ISPs and cloud providers, nothing left open to the public web, and when a traffic rule changes you change it once instead of touching every machine.

Open source and written in Go, which visibly pleased Max more than the security did.

(We are still hiring a full-time Support Engineer to join us in person in Manchester. There will be more useful nerdiness.)

[Timur Gok @timatbyteful]

Bot detection keeps moving down the stack…

user agents
JS fingerprints
TLS
now TCP

Before HTTP, the handshake can already leak the OS behind it so we rebuilt TCP in user space for ISP & Datacenter proxies.

Try the Beta here:
https://t.co/9CjyZfG0fJ

[Timur Gok @timatbyteful]

Formatting a proxy list by hand is the sort of small job that eats twenty minutes and teaches you nothing... one missing colon and the import fails. Free formatter, whole list at once. It won't tell you which proxies are live, just how the list is written.

[Byteful @byteful]

One missing colon can stop a proxy list importing 🔧

Our proxy formatter converts a whole list at once. Paste or upload, it works out the source format on its own, you pick the output, then copy or export.

It rewrites the list. It will not tell you which proxies are live.

[Timur Gok @timatbyteful]

Free data, long term discounting and direct access to our team. What more can you ask for.

[Byteful @byteful]

The Byteful Startup Program is live🚀

Free residential data for three months, then up to 50% off for two years. Three tiers for bootstrapped, VC or accelerator backed, and Y Combinator companies.

Plus a Slack channel with a senior Byteful developer.

[Timur Gok @timatbyteful]

@mynameisyahia 🎉

[Timur Gok @timatbyteful]

The jump from 100 requests to 100,000 breaks things that looked fine in testing, and it's usually the boring stuff... timeouts set off the average, retries with no backoff, no real idea what your concurrency ceiling is.

[Byteful @byteful]

A scraping job that works at 100 requests does not automatically work at 100,000 📋

1️⃣ Data consumption at volume
2️⃣ Your timeout
3️⃣ Your concurrency ceiling
4️⃣ Retry strategy, with backoff
5️⃣ Whether you can tell why something failed

[Timur Gok @timatbyteful]

Your browser can claim whatever it likes, but the TCP handshake underneath tells a different story... proxy servers run Linux. We rebuilt the stack in user space so you can set that layer yourself. Beta for now, so tell us if it does something odd.

[Byteful @byteful]

Introducing TCP/IP Fingerprint Emulation, now live in beta on datacenter and ISP proxies!

Your browser says Windows. Does the TCP handshake agree? 💻

Windows, macOS, Linux, Android or iOS, set per request in your proxy username or once when you export your list.

[Timur Gok @timatbyteful]

We brought TCP/IP into user space?! Samsung smart fridge fingerprint please🤝

[Byteful @byteful]

Day two of @zytedata's Extract Summit is underway, and Byteful is here in Austin, Texas!

Today at 12:00pm, our founding engineer Joe Dye takes the stage at Brazos Hall for a talk on TCP/IP fingerprint emulation🫆

Come and say hello before or after👋

[Timur Gok @timatbyteful]

@itsNoahPham @elonmusk Austin TX🤠 Here for @zytedata Extract Summit

[Timur Gok @timatbyteful]

First time in a driverless taxi

> more comfortable / leg room
> smooth ride
> $7 compared to 15 dollar + tip

@elonmusk bring to the UK

[Timur Gok @timatbyteful]

Two bot-traffic numbers came out this month and they do not agree. DataDome says bots and AI agents make up 26.5% of traffic across its customer base. Cloudflare puts automated traffic at roughly 57% of web requests.

My guess is both are low. The agentic era is real and exponential.

[Cloudflare @Cloudflare]

More than half the traffic reaching sites on Cloudflare is now automated, and AI agents are the fastest-growing part of it. We're giving site owners the tools to see who's visiting, decide who gets in, and charge for access. https://t.co/WzchYEKudA #BirthdayWeek

[Timur Gok @timatbyteful]

@mynameisyahia + more

[Timur Gok @timatbyteful]

@mynameisyahia If milliseconds count, can I tempt you with some free data to try our proxies?

Independent test results 👇

[Timur Gok @timatbyteful]

A very cool example of what web-scraped data can enable in academic research. Found more than 70% of the thousand most repeated questions were templates or boilerplate. FAQ copy, repeated page elements, the same question published over and over.

You can collect an enormous amount of the web quickly. Working out what the data actually matters is the tough bit.

In the agentic age, that is only getting harder…😅

[Common Crawl Foundation @CommonCrawl]

Bodhium Labs: From web pages to a question corpus

FineQuestions draws on 110 snapshots of FineWeb, the filtered English-language corpus derived from Common Crawl, spanning 2013–2025. Extraction yielded roughly 13.4 billion raw questions filling 22 TB. Normalization and aggregation reduced these to approximately 1.5 billion unique questions.

[Timur Gok @timatbyteful]

sharing one login around a team was never a good answer, and it got worse once agents started holding the keys... organizations gives you roles and keys scoped to specific actions with an expiry. nothing to migrate, no extra charge.

[Byteful @byteful]

Byteful accounts now support organizations 👥

A shared workspace for your team with its own proxies, billing and API keys. Each member gets a role, so no more sharing one password.

API keys can be scoped to specific actions with an expiry date, which is what you want when an agent holds the key.

[Timur Gok @timatbyteful]

selling concurrency in tiers always struck me as charging for the wrong thing... you pay for data or for ips, not for how many requests run at once. unlimited doesn't mean no safeguards though, and pretending otherwise would be dishonest.

[Byteful @byteful]

Unlimited concurrent sessions means there is no concurrency tier to buy 🔓

No plan-level cap to hit, no upgrade to reach for. You pay for data or for IPs, not for how many requests run at once.

Fair usage safeguards still exist for traffic that threatens stability. Rarely triggered.

[Timur Gok @timatbyteful]

@charlierward Congrats🥂

[Timur Gok @timatbyteful]

🔥

[Noah Pham @itsNoahPham]

𝗘𝗺𝗗𝗮𝘀𝗵 𝟭.𝟬 𝗶𝘀 𝗵𝗲𝗿𝗲: a stable, open source modern successor to WordPress, built on Astro, with a secure, decentralized plugin registry!

i’m incredibly proud to have contributed to this release during my internship at Cloudflare ⛅️

Read more: https://t.co/iHxnMvXukW

[Timur Gok @timatbyteful]

a page makes far more requests than the one you asked for, and most don't need a residential ip... paying residential rates for every asset a browser pulls is waste. smartpath decides per request, under 10ms. our own test last july: 40.79% less residential data.

[Byteful @byteful]

Smartpath decides in under 10ms whether a request actually needs a residential IP.

If it does, it uses residential. If it does not, the request can go through datacenter instead without consuming residential data.

Most request latency comes after that routing decision.

[Timur Gok @timatbyteful]

A 1996 protocol still carries most of the proxy world. The detail people miss: SOCKS5 takes hostnames, not just IPs, so DNS resolves proxy-side, in the region doing the work. Old spec, still quietly correct.

[Byteful @byteful]

SOCKS5 has been standardised since 1996 and defines three commands 🔌

CONNECT for TCP. BIND when the client needs to accept a connection back. UDP ASSOCIATE for UDP datagrams.

It can also pass a hostname to the proxy for proxy-side DNS resolution instead of resolving locally.

[Timur Gok @timatbyteful]

Last week's Wisdom Wednesday 🧙‍♂ came directly out of work Denver Whiteley had been doing to further improve @byteful's security.

He gave a presentation on infrastructure hardening and firewalls after learning more about both through actual work. That is pretty much the ideal source for these sessions... someone runs into something, understands it, then teaches the rest of us.

Denver used a simple building analogy. An IP address is the street address, ports are the doors on the building, and behind each door sits a different application or service. Some doors need to be reachable for legitimate traffic. Others may be left exposed unnecessarily, which gives attackers another place to look.

A firewall guards the street by only allowing legitimate traffic through the doors.

That is the pattern with these sessions. Someone does the work, learns something doing it, then teaches the rest of us.