HN user

jwally

940 karma

email me at justin [at] wolcott [dot] io.

Posts27
Comments262
View on HN
qr.arcades.click 1mo ago

Show HN: My Attempt at QR as a Captcha

jwally
4pts2
github.com 4mo ago

AI Powered Exploit Kit

jwally
1pts0
quake.wolcott.cc 4mo ago

Show HN: In Browser, Serverless Quake 3 Arena

jwally
1pts4
app.hornpub.click 10mo ago

Anonymous Age Verification Demo

jwally
2pts3
www.youtube.com 10mo ago

Show HN: Free and Anonymous Age Verification Demo

jwally
1pts0
gist.github.com 10mo ago

Show HN: Anonymous Age Verification

jwally
71pts85
couchtime.click 1y ago

Show HN: Couchtime.click – my YouTube whitelist app

jwally
2pts1
www.npmjs.com 1y ago

Show HN: Vomitorium – all of your project in 1 text file

jwally
79pts53
github.com 2y ago

Show HN: Storing Private Keys in the Browser Securely

jwally
10pts14
news.ycombinator.com 2y ago

Show HN: Secure Session Cookie Scheme Using Existing Tech

jwally
3pts0
www.pcmag.com 2y ago

Chrome to Prevent Session Hijacking via TPM

jwally
2pts1
news.ycombinator.com 2y ago

Ask HN: Should Banks Phish Their Own Customers

jwally
21pts63
qr-maker.wolcott.io 2y ago

Show HN: My Simple QR Maker

jwally
2pts1
news.ycombinator.com 3y ago

Ask HN: Scammer Using Git as CDN – What to Do?

jwally
4pts2
news.ycombinator.com 3y ago

Ask HN: Can I Know If My Website Is Being Spoofed?

jwally
2pts1
www.defenseone.com 4y ago

Ukraine Offers to Pay Russian Soldiers to Surrender

jwally
10pts1
news.ycombinator.com 4y ago

Ask HN: Losing job at year end. What should I do in the meantime?

jwally
7pts14
www.youtube.com 5y ago

What would make you believe Aliens visit Earth

jwally
2pts7
en.wikipedia.org 5y ago

Josephus Problem: Suicide via Fizz Buzz

jwally
2pts0
news.ycombinator.com 5y ago

Ask HN: Do Public Profiles Encourage Fake Reviews

jwally
1pts0
www.wfaa.com 5y ago

Why people care less as more people die

jwally
2pts0
addictionlocker.com 5y ago

Show HN: AddictionLocker – Simple Password Manager to reduce screen-time

jwally
1pts1
news.ycombinator.com 7y ago

Ask HN: If all events are random or deterministic is there free will

jwally
9pts13
news.ycombinator.com 7y ago

Ask HN: Has anyone heard of RPA? I think it is a bad idea. Am I wrong?

jwally
1pts0
news.ycombinator.com 8y ago

Show HN: Index funds are better than Managed funds?

jwally
1pts2
github.com 9y ago

Show HN: Fake Google Oauth2 for Spear Phishin'

jwally
2pts2
mathfood.com 11y ago

Show HN: Create a perfect meal with linear programminga

jwally
27pts26

For whatever its worth I built this about a decade ago because I am a non academic who can't think in tableaus, but still wanted to solve optimization problems.

I created a json like schema/struct/whatever to describe the problem. Maybe adopt something like this and more people will be able to see how they could use your tool:

https://github.com/JWally/jsLPSolver/blob/master/API.md

I need to re go through the docs, but you get the gist.

Here is the Berlin Airlift problem for example:

const model = { optimize: "capacity", opType: "max", constraints: { plane: { max: 44 }, person: { max: 512 }, cost: { max: 300000 }, }, variables: { brit: { capacity: 20000, plane: 1, person: 8, cost: 5000 }, yank: { capacity: 30000, plane: 1, person: 16, cost: 9000 }, }, };

Maybe I'm not paying close enough attention (probably) - but I feel that China is providing a glimmer of hope that this (only the uber elite can get good AI assistance) isn't true, and we're maybe at a weird inflection point of sorts wrt the leverage that tech can now provide.

China gets sanctions and stale chips - fine, they just DIY the algorithms through CPU instead of GPU and open source it.

American warships have the latest, coolest, highest-tech tactical weaponry imaginable - which is great until you have to fend off 10,000 consumer/wal-mart/IED grade drones at $2mm/clip.

Money is amazing, but if you lean on it too heavily in lieu of _practical_ innovation, it'll bite you in the ass. The apocryphal story of the Soviet Rocket scientist who suggested using a pencil instead of investing 100k in a space pen that worked in 0g's.

Brutal own goaling by the USA. I'm glad it happened, but the USA had a golden opportunity to subsidize domestic providers for 10 years and lease to China to discourage competition and side innovation.

DeepSeek and Qwen would have been neat parlor tricks, never developed further because the US subsidized mega models would have been too cheap and reliable to make them necessary.

Nope! USA played its hand and forced the world to have to account for its USA exposure risk and deversify. A serious one time use strategic advantage pissed away.

Doesnt really bother me personally per se; but armchair quarterbacking the USA's decisions seem Suboptimal...

This also exists: https://abrahamjuliot.github.io/creepjs/

TBH, its never anything super exotic (though it helps) but simple stupid basic things like cookies that does 70% of the work here. Also, your IP address at home is _really_stable_.

If I can give you a sticky cookie (cookies, indexdb, localstorage), a half-assed fingerprint, and tie it to your IP-address, and know you're not on a cell-tower; this is probably good enough for most purposes.

Use safari on private relay in private mode.

Ads in ChatGPT 3 months ago

Literally where my head was. Take every negation statement and append "...yet!"

The world isn't binary. People want to look for jobs and network.

At the same time they don't want their data turned over and sold to the kind of people who scrape LinkedIn.

Plus - Your data is LinkedIn's cash cow. They're not going to leave it out for every Tom, Dick, and Harry to export en masse whenever they want.

Fingerprint (and its ilk) use a tiered identification system to identify you, with a decrease in confidence with each step down.

They start with a supercookie approach (first-party cookies, third party cookies, indexdb, localstorage, session storage, favicon timing, etc) which is a direct look up, and unique. This is tier-1.

Next they slam as many signals as they can get your browser and network to cough up into an ML db and find your nearest neighbor. If its greater than threshold ${x} - they return its ID with a confidenc of say 85%

If that misses, they slide down to tier 3 which is your IP address plus some browser signals on a TTL so they don't just call everyone with your IP address "you". This is maybe say 50% confident.

Below that, they create a new record.

If you want to beat it - tbh - Safari, especially on IOS is a monster. Most people with an iPhone default to it, and they remove their biggest entropy signals (offlineAudio, canvas profiling), so they're left with almost nothing to work with that is really unique.

Fingerprint _really_ pushes merchants to reverse proxy their services so that they can serve cookies as first party and Apple doesn't nuke them after 1 week. Its complicated and most merchants don't want to diddle with it - but it circumvents adblockers (ps - use an adblocker and call out fingerprint specifically if you want to hit them. LLM to see who else you need to include).

After that, if you're on Apple, use their Apple-VPN service (forget what its called) - which exists _literally_ for this.

Sorry about that...public now.

So the whole selling point of this approach is that after coordination with other browsers - the server is completely out of the picture. All telemetry is done peer-to-peer instead of coordinating with a central server for someone to maintain and pay for.

The API cost...ughhhhh

I set $10 on fire the other day as I was running through some tests.

Like old school arcade games "Please insert more ${money} to keep playing...". Local, smaller, specialized (unix philosophy?) seems like the way to go so you don't bk yourself having AGI distill pintrest recipes to just recipes.

Thanks for sharing.

For the past month or so I've been slowly having claude build something in the same ballpark. Basically something to nag you to take care of grown-up things so your boss/spouse/local municipality doesn't have to.

I was going to call it "Nagatha Christy", but the joke gets old after 48 hours. At the moment, its called "Jarbis" (old Simpsons reference).

For me, checklists are useful but I suck at creating them, maintaining them, etc. I want this thing to be able to look at my calendar/email/groupme and be able to say things like:

"Hey, you have 2 kid birthday parties this weekend and a soccer game - you're bringing snacks. You want me to update your shopping list?"

or

"The dentist office just sent out a reminder - you have an appointment on Thursday that's not on the calendar. It conflicts with your daily standup. You want me to create a task for you to resolve it?"

Its using: - AWS CDK - Telegram as primary chat interface - Trello/Jira/Something Custom - Integrations into GoogleCalendar and GMail - Ability to use Claude/OpenAI and different models

FWIW, if someone figures out how to create a reliable "secretary in a box" that I don't have to DIY but doesn't scream data-collection-watering-hole (facebook) I'd _happily_ pay $200 / mo for it. ;-)

I updated a really outdated, but surprisingly popular repo for linear programming:

https://github.com/JWally/jsLPSolver

I'm tinkering around building "JARVIS" (I didn't want to come up with a clever self deprecating name - this works) - a personal project to manage my life. Integrates into Google Mail, Google Calendar, Trello, GroupMe, EveryDollar. Basically it nags me to do grown up thing and is a better UX than Google Calendar/Trello - I just talk to it and ask it things.

Also experimenting with a new Claude-Code flow; give the bot its own AWS account, Put a bunch of tickets on my personal JIRA, be persnickity about what constitutes "pass" and tell the bot "follow these instructions, pull down tickets until there are no more. Your branch cannot merge until you have integration tests passing in your own dev env first" (I use AWS CDK). Then let it loose to build. The instant feedback loop that Claude has with Build-Code->Deploy to AWS->Run Integration Tests->Address Failures is really nifty fwiw...

Wasp Blower 9 months ago

When the crusader army reached Béziers, they demanded that all heretics be handed over. The townspeople refused, and the crusaders stormed the city. Once inside, they couldn’t tell Catholics from Cathars—everyone spoke the same language and lived side by side.

That’s when the Cistercian legate Arnaud Amalric supposedly gave his infamous order:

“Caedite eos; Novit enim Dominus qui sunt eius.” “Kill them all; for the Lord knows those that are His.”

It’s a paraphrase of 2 Timothy 2:19 (“The Lord knoweth them that are his”).

The crusaders slaughtered virtually the entire population—estimated between 10,000 – 20,000 people—before burning the city.

ps I have an irrational fear of wasps

Banks and most sites requiring age verification are _littered_ with tracking software that does _literally_ this.

Further, if you put on an adblocker and I get access to the logs at ironbank and hornpub; I could just query them for your IP address.

Collusion to this degree is possible, but doesn't seem worth worrying about if the aforementioned attack vectors still exist. My $0.02.

Not asking to troll or be a jerk. Promise.

What would need to happen in the United States to implement a reliable ZKP age verification system - and how long would it take to roll it out?

Asking because it feels like the Titanic has sunk, and we're eschewing a floating door because the coast guard has regulation conformant life rafts that would work better.

Chase.com currently is using:

mPulse

Google Marketing Platform Meta

LinkedIn Ads

Trade Desk

Aggregate Knowledge (Trans Union)

Adobe Audience Manger

Can you elaborate on how the risk of ironbank and hornpub colluding by de-anonymizing you via rainbow tables or IP forensics is substantially greater than Chase and PornHub using - Google Marketing?

If I work for Aylo (pornhub, etc) I'm telling every fintech and click-and-mortar bank who wants more customers to do this yesterday!

"Hey third fifth of Oregon! Do you want to triple your customer base in Oregon for the cost of a small dev team and 1 month of work?!"

f*cking app on my phone

I need another app on my phone like I need another hole in my head...

Here's my crack at a good-enough solution for the U.S. It doesn't have a ton of granularity - but the concept is shovel ready now, dirt cheap, and privacy preserving.

Video Demo: https://www.youtube.com/watch?v=MmcUJ5u65Q0

Actual Demo: https://app.hornpub.click

How it works:

1) Go to app.horpub.click

2) Create an ephemeral passkey

3) Extract its public-key and id (this binds the credential you're creating to your device)

4) The user copies this data to their bank's Age-Verification-Section

5) The bank creates an object that it signs with an attestation of the user's age (KYC) and their pass-key-public-key

6) The user copies this back to app.hornpub.click

7) The passkey is verified on the server, the bank's signature is verified by the server, some other meta-data is verified to make sure nothing weird is happening.

8) The user's age has been verified by their bank without the bank knowing who is asking for verification

* This method is more private than anything requiring sharing your photo-id online

* This method doesn't trigger GLBA or GDPR (user copies data themselves)

* This method is free to the merchant (hornpub)

I'm not as concerned with preventing kids from accessing adult materials. Thats what parents are for. My main driver here is to offer a free counter punch to tx sb 1181.

Making adult sites verify age with expensive and leaky third parties. Bad. My proposal is free, and helps to take the sting away from being required to perform age verification.

And, its shovel ready now.

As a father of three, I think a lot about online safety. Kids need protection, but current age verification mandates are creating a dangerous precedent—not because of their goal, but because of how they’re being implemented.

Texas SB1181 and similar laws in other states require age verification for adult content. The intention is sound. The execution is problematic.

*Today’s verification methods are:*

• Expensive ($0.31–$1.53 per user)

• Privacy-invasive (require uploading government IDs)

• Easily weaponized (complex compliance makes selective enforcement trivial)

Make something costly and risky enough, and you’ve created a de facto ban without ever saying the word.

*There’s a better way.*

I’ve built a demo using passkeys and banks’ existing KYC infrastructure. Banks already verify your age when you open an account. My system lets them attest “this person is 18+” without knowing where you’re going or what you’re accessing.

*Live demo:*

https://app.hornpub.click (a mock bar & grill site)

*Video walkthrough:* https://m.youtube.com/watch?v=MmcUJ5u65Q0

The bank sees: “User needs age attestation”

The site sees: “Valid attestation from trusted institution”

Nobody sees: “John Smith, age 34, visited this specific website”

*Why this matters:*

Age verification isn’t going away. If we don’t build privacy-preserving solutions now, we’ll normalize surveillance infrastructure that gets repurposed for far more than protecting kids.

We can verify age without building databases of who visits which sites. We can protect children without creating tools for censorship. We can meet legitimate safety goals without sacrificing privacy as the cost of access.

If you see flaws in this approach or have ideas to improve it, I genuinely want to hear them. This problem deserves better solutions than we’re currently deploying. h

Better to go down with the titanic than leave your cabin with your hair disheveled! And what will the survivors say if you show up in the life boat with the same formal attire you had on the night before!?!

Also, mulling over it; I would bet pornhub and chase.com both use google-ad trackers and 200 other ad networks. The issues my mvp create require chainalysis and a warrant. Maybe big picture, not so bad.

Given the static nature of most residential IP addresses, what stops this from happening today?

If I subpoena facebook, google, chase, and pornhub - I can unmask who you are by correlating your IP and profile info. If I want higher certainty, I can further narrow down time windows.