jclarkcom

I do something similar but this only protects secrets at rest. If you app has an exploit an attack could just export all your secrets to a file.

I prototyped a solution where I use an external debugger to monitor my app, when the app needs a secret it generates a breakpoint and the debugger catches it and then inspects the call stack of the function requesting the secret and then copies it into the process memory (intended to be erased immediately after use). Not 100% security but a big improvement and a bit more flexible and auditable compared to a proxy

Would it even crash a computer? They would fill up their hard drive but that would just yield warnings to the user in most operating systems. Chances are they would kill it manually because it would take a long time

Thanks for your response, I'm acknowledging it and taking to heart.

Here are some of the commands it used (censored & auto-generated) with a few specific examples at the end: https://jonathanclark.com/posts/bonded-internet-connection-c...

It was able to one-shot deploying a digital ocean droplet and configure wireguard?

Yes, that part was pretty easy - but the whole thing wasn't one shot. The parts I struggled with were: - getting automated SSH installed on the $130 router, once you have that the LLM can drive things - during security hardening, I got fully locked out and had to recreate a new VM. But it was able to automatically recreate everything in a few minutes.

Harsh, but a good point on egress cost that I overlooked, I'm adding a section on this - if you use Oracle cloud it looks like you get 10TB included at no additional cost where DO would be around $84 at the same bandwidth levels

I've experimented with using LLM to setup and/or maintain some servers for me for various different use cases (this being one). What I like is an agentic LLM can either document it's initial build process or "explore" your server to better understand how it works, what configuration files are used, software versions installed, etc. When you have that documentation/context provided to a frontier LLM it can take care of most maintenance work you'd like do by hand for "simple" servers. A good prompt to get an llm to explore an existing server to make sure it fully understands it is to ask it to make a working backup.

That's a very good point. I included a "Cost Comparison by Bandwidth Usage" section that shows the cost for Digital Ocean compared to a commercial bonded solution. At 10TB the monthly DO cost goes up to $84/month which is significant, but if you compare that with a commercial solution that gives you a bonded connection (Speedify) they would charge $120/m for 10TB.

If you used Oracle cloud, I think 10TB is still in their free tier so you'd be looking at ~$15/month.

or how many services like streaming, banking, gaming will restrict, block, or otherwise treat the connection differently because the traffic now exits via a datacenter or VPN IP/ASN.

I did run into this and claude implemented a work-around (see step 8) to route some traffic through the normal exit IP for those special use cases. So far I've only run into this problem with 3 services (Ring, Blink, and Paychex). Surprisingly none of the streaming services seem to care (Netflix, Amazon, Apple TV).

Maybe I didn't make it clear from the post, the llm (cursor+claude 4.5 sonet) was actually driving the whole process from provisioning a server, installing wireguard, setting up certificates, configuring network, installing packages, and updating security - with some testing at each step. I never ran any commands manually, I just told it what to do.

nice. I wish fiber was available for me. I only had access to AT&T's copper service (DSL) but they do 2-pair bonding so speed is not far from Xfinity.

Bonding two ISPs was previously too complex for most home use until agentic AI. Claude can automate the entire WireGuard/OpenWRT/VPN setup, testing, and security hardening via SSH as an afternoon project. Total cost: $305 over 3 years vs $1,241 for commercial solutions. Downgrade your current ISP and add a second cheap one to get faster more reliable internet at home.

the purpose of blogging is to organize your own thoughts

I don't get this comment. People can create content for any number of reasons and those reason will vary widely by the author. I like to use it to share something interesting to me that is too long for a Linkedin post.

It's a good point and I should make a distinction on what models are appropriate. I think of chatGPT 4 like a college student and chatGPT 5.1 5 Pro (deep thinking model) more like a seasoned professional. I wouldn't trust non-frontier, non-thinking models with a result for this kind of question. But the determinism of the result does not scare me, the out output may vary but not directionally. The same thing would happen if you asked the foremost security expert in the world, you'd get slightly different answers on different days. One time as a I test I ran a very complex legal analysis through chat GPT pro 10 times to see how the results would vary and it was pretty consistent with ~10% variation in numbers it suggested.

For me, it is about learning about what AI can and can’t do, how to progressively prompt, how to avoid problem, etc. once you understand that you can build more things quickly. I gained a pretty good understanding of what it can/cant do, how many prompt it will take to get there, and which model(s) are capable.

yes, for example this article including charts and summaries were generated by AI. https://jonathanclark.com/posts/ai-coding-million-lines-2025... Typically I act as an editor rather than a direct writer with cursor now replacing word

I restarted my blog after a 20 year break (https://jonathanclark.com) thanks to AI making taking out the drudgery.

I don’t understand this comment. I’ve found AI a great tool for identifying red flags in scam emails and wanted to share that.

true, I can’t rule those out entirely. I access via iPhone to limit attack surface area, the info was never printed, present in emails, or disclosed to 3rd parties

I have attempted to condense it based on your feedback, and added some more info about email headers.

My first thought was someone they tied a blockchain transaction to my name and then traced it backwards. But they also knew my ETH and BTC balances, and date the account was opened. You might be able to figure out the open date by looking at the blockchain but I could never determine how they would know balances for two unrelated cryptos without some kind of coinbase compromise.

True - but be very careful. Roughly 10–18% of all BTC are believed gone forever due to lost keys/wallets. That is more than all hacks and exchange blowups combined. If you take your wallet offline it can be hard not to lose your keys over a long period of time, including across death to your next of kin.

That's true, but in this case I got a response from the head of trust and safety after I sent the phone recording, email + email headers, saying "This report is super robust and gives us a lot to look into. We are investigating this scammer now."

I sent the phone recording and emails to coinbase, and they acknowledged them saying "This report is super robust and gives us a lot to look into. We are investigating this scammer now."

Author here - yes, this was written using guided AI. I consider this different than giving a vague prompt and telling it to write an article. My process was to provide all the information, for example I used AI to: 1. transcribe the phone call into text using whisper model 2. review all the email correspondence 3. research industry news about the breach 4. brainstorm different topics and blog structures to target based on the information, pick one 5. Review the style of my other blog articles 6. write the article and redact any personal info 7. review the article and suggest iterate on changes multiple times. To me this is more akin to having a writer on staff who can save you a lot of time. I can do all the above in less than 30mins, where it could take a full day to do it manually. I had a blog 20 years ago but since then I never had time to write content again (too time consuming and no ROI) - so the alternative would be nothing.

There are some still some signs you can tell content is AI written based on verbosity, use of bold, specific HTML styling, etc. I see no issues with the approach. I noticed some people have an allergic reaction to any hint of AI, and when the content produced is "fluff" with no real content I get annoyed too - however that isn't the case for all content.

Very interesting... January 7th is when I reported it to them so that lines up. I suspect I wasn't the very first person, the person I spoke with on the phone had the confidence I wouldn't expect on the first try.

I would consider it but I'm not sure what my options are on this.

Yes, I did briefly touch on that in the article. "SEC rules require timely reporting of material cybersecurity incidents."

Looking into this more now I see SEC Rule requiring disclosure within 4 business days of determining a cybersecurity incident is "material"

There is a big list of SEC violations as a result: 1. Late Disclosure (Item 1.05) If materiality was determinable in January → 4-day rule violated Penalty: Fines, enforcement actions

2. Misleading Statements/Omissions (Rule 10b-5) Any public statements about security between Jan-May could be problematic Omitting known material risks = securities fraud

3. Inadequate Internal Controls (SOX) Failure to properly investigate and escalate user reports Inadequate breach detection systems

4. Failure to Maintain Adequate Disclosure Controls My report should have triggered disclosure review Going silent suggests broken escalation process

In January 2025, I was targeted by scammers who knew my exact Bitcoin balance, SSN, DL, and other private Coinbase account details. I immediately reported this to Coinbase's Head of Trust & Safety with recordings and technical evidence. Despite repeated follow-ups asking how attackers had my data, Coinbase went silent for 4 months. They only disclosed the breach in May after attackers demanded $20M ransom. The breach involved overseas contractors at TaskUs being bribed for customer data. This article documents the timeline with emails, recordings, and evidence showing Coinbase was aware of the breach months before their official "discovery" date.

Thanks for the encouragement. I do plan to make more of them open source, in the past it's been a bit of burden to document, test, and fix bugs before publishing but for some projects AI can do that for you now.

One project I did publish: https://github.com/jclarkcom/ble_proxy This turns your cell phone into a network proxy, but using BLE so the phone can be connected to a Wifi network (hotel, plane, etc). It's pretty slow, but in some cases you just need a little bit of data to work. I made it on a plane ride where my cellphone had data but my laptop didn't.

I have a node middleman that proxies request from an HTML/JS front end to a native cuda process using web sockets. To support multiple windows, the node process process provides communication between two browser windows. This lets me have render a model using 3JS in one window and a ray traced version in another window.