Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]
24
I wrote this post on November 23rd, 2020 when I reported the issue via Craigslist’s vulnerability disclosure process. I didn’t want to publish it until I confirmed the issue was fixed, but it appears to have been fixed on February 28th, 2021 so I am posting it now. Background Someone reached out to me recently because of an issue they were having. They had evidence that people in their area were using automation to be able to access Craigslist postings before everyone else. I knew that Craigslist index pages and search results only update every 15 minutes, so I interpreted this to mean that there was a way to get access to new postings in near real-time. This would mean you could potentially see postings almost instantaneously after they were posted and you wouldn’t need to wait for the index pages and search results to update; this would be a huge deal in competitive categories like used cars as it could give you up to a 15-minute advantage over other buyers. How the Exploit...
over a year ago

Improve your reading experience

Logged in users get linked directly to articles resulting in a better reading experience. Please login for free, it takes less than 1 minute.

More from Alex Meub

The Magic of Solving Problems with 3D Printing

3D Printing has allowed me to be creative in ways I never thought possible. It has allowed me to create products that provide real value, products that didn’t exist before I designed them. On top of that, it’s satisfied my desire to ship products, even if the end-user is just me. Another great thing is how quickly 3D printing provides value. If I see a problem, I can design and print a solution that works in just a few hours. Even if I’m the only one who benefits, that’s enough. But sharing these creations takes the experience even further. When I see others use or improve on something I’ve made, it makes the process feel so much more worthwhile. It gives me the same feeling of fulfillment when I ship software products at work. Before mass-market 3D printing, creators would need to navigate the complexity and high costs of mass-production methods (like injection molding) even to get a limited run of a niche product produced. With 3D printing, they can transfer the cost of production to others. Millions of people have access to good 3D printers now (at home, work, school, libraries, maker spaces), which means almost anyone can replicate a design. Having a universal format for sharing 3D designs dramatically lowers the effort that goes into sharing them. Creators can share their design as an STL file, which describes the surface geometry of their 3D object as thousands of little triangles. This “standard currency” of the 3D printing world is often all that is required to precisely replicate a design. This dramatically lowers the effort that goes into sharing printable designs. The widespread availability of 3D printers and the universal format for sharing 3D designs has allowed 3D-printed products to not only exist but thrive in maker communities. This is the magic of 3D printing: it empowers individuals to solve their own problems by designing solutions while enabling others to reproduce those designs at minimal cost and effort.

2 months ago 66 votes
Building the DataToaster 3000

Last summer, I was inspired by a computer that was built inside of a toaster that I saw at a local computer recycling store. The idea of a computer with the design of a home appliance was really appealing and so was the absurdity of it. It occurred to me that this would be a fun and creative way to integrate technology into my life. After thinking about it, I realized there’s also something visually appealing about how simple and utilitarian toasters are. I have major nostalgia for the famous After Dark screensaver and I think this is why. I knew now that I wanted to make my own attempt at a toaster/computer hybrid. I decided to do just that when I created the DataToaster 3000: a toaster NAS with two 3.5 inch hard disk docking stations built inside it. The hard disks can be easily swapped out (while powered off) without taking anything apart. It uses a Zimaboard x86-64 single board computer and even has a functional knob that controls the color of the power LED. I designed a fairly complex set of 3D-printed parts that attach to the base of the toaster and hold everything neatly in place. This allows it to be easily disassembled if I ever want to make any modifications and also hopefully makes the project easier to build for others. It’s a ridiculous thing but I really do love it. You can find the build guide on Instructables and the 3D models on Printables.

5 months ago 60 votes
Building a Removable Bike Basket for the Yepp Rack

I wanted to add more hauling capacity to my bike and was looking for something compatible with my Yepp rear rack. I also use my rack with a child seat (the Yepp Maxi) which has a mechanism that allows it to attach and detach easily without sacrificing safety. I was thinking it would be great to build a Yepp compatible rear basket that could I just as quickly attach/detach from my rack. I designed a removable Yepp-rack-compatible rear basket that consists of a milk crate, some plywood for stability and a 3D printed bracket threaded for M6 bolts which hold it all together. It can be attached and removed in seconds and is very secure. 3D Printed Mounting Bracket I modeled my mounting bracket after the one on the Yepp Maxi childseat. After a few iterations I was able to make it perfectly fit. I printed it in PETG filament so it was UV resistant and then installed threaded inserts for M6 bolts to attach it to the milk crate and my rear rack. 3D Print and Build Instructions You can find the 3D print on Printables and a full build guide on Instructables.

6 months ago 55 votes
The Yoto Mini is Perfect

The Yoto Mini is one of my favorite products. The team behind it deeply understands its users and put just the right set of features into a brilliantly designed package. I have no affiliation with Yoto, I’m just a happy customer with kids who love it. If you aren’t aware, Yoto is an audio platform for kids with what they call “screen-free” audio players (even though they have little pixel LED screens on them). The players are Wi-Fi enabled and support playing audio from credit card-sized NFC tags called Yoto cards. Yoto sells audio players and also licenses audio content and offers it on its platform as well. The cards themselves do not contain any audio data, just a unique ID of the audio content that is pulled from the cloud. After content is pulled on the first play, it is saved and played locally from the player after that. Yoto also supports playing podcasts and music stations without using cards. Their marketing puts a lot of emphasis on the platform being “ad-free” which is mostly true as there are never ads on Yoto cards or official Yoto podcasts. However, some of the other podcasts do advertise their content. So, what’s so great about the Yoto Mini? This concept isn’t new as there have been many examples of audio players for kids over the years. What sets it apart is how every detail of the hardware, mobile app, and exclusive content is meticulously designed and well executed. Yoto Mini Hardware The main input methods of the Yoto Mini are two orange knobs, turning the left knob controls volume and the right knob navigates chapters or tracks. Pressing the right knob instantly plays the Yoto Daily podcast and pressing it twice plays Yoto Radio (a kid-friendly music station). These actions are both configurable in the mobile app. The NFC reader slot accepts Yoto cards and instantly starts playing where you left off after you insert one. It has a high-quality speaker that can be surprisingly loud, an on/off button, a USB-C charging port, an audio output jack, and a small pixel display that shows images related to the audio content. The Yoto Mini is also surprisingly durable. My kids have dropped it many times on hard surfaces and it still basically looks as good as new. Yoto understands that the physical audio player itself is primarily used by younger kids and the design reflects this. My 3-year-old daughter was able to figure out how to turn it on/off, start listening to books using cards, and play the Yoto Daily podcast each morning which was empowering for her. This was her first technology product that she was fully capable of using without help from an adult. I can’t think of many other products that do this better. Yoto Mobile App The Yoto team understands that parents are users of this product too, mostly for managing the device and its content. Yoto has built a very good mobile experience that is tightly integrated with the hardware and provides all the features you’d want as a parent. From the app, you can start playing any of the content from cards you own on the player or your phone (nice if your kids lose a card), you can set volume limits for both night and day time, you can set alarms, and configure the shortcut buttons. You can record audio onto a blank Yoto card (which comes with the player) if your kid wants to create their own story, link it to their favorite podcast or favorite music. The app even lets you give each track custom pixel art that is displayed on the screen. Audio Content By far the most underrated feature is a daily podcast called Yoto Daily. This ad-free podcast is run by a charming British host and it is funny, entertaining, and educational. My kids (now 4 and 7) look forward to it every morning and the fact that it’s daily free content that is integrated directly into the Yoto hardware is amazing. To me, this is the killer feature, as my kids get to enjoy it every day and it’s always fresh and interesting. Yoto licenses content from child book authors, popular kid’s shows, movies, and music (recently the Beatles) which are made available in their store. I also discovered that Yoto does not seem to lock down its content with DRM. My son traded some Yoto cards with a friend and I assumed there would be some kind of transfer or de-registration process but to my surprise, they just worked without issue. Conclusion The Yoto Mini is a delightful product. The team behind it thought through every detail and made it an absolute joy to use both as a child and parent. I’m impressed at how well the Yoto team understands their users and prioritizes simplicity and ease of use above all else.

9 months ago 46 votes
How To Quiet Down Your 3D Printer

When I first got my 3D printer, I built an enclosure to protect it from dust, maintain a consistent temperature, and minimize noise. I was surprised to find that the enclosure didn’t reduce noise that significantly. I then placed a patio paver under my printer, which made it noticeably quieter, but it was still audible from other rooms in my house. Recently, I found the most effective noise reduction solution: squash balls. These balls are designed with varying bounce levels, indicated by colored dots. The “double-yellow dot” balls have a very low bounce, making them ideal for dampening vibration, which is the primary cause of printer noise. I found an existing design for squash ball feet, printed it, and hot glued them evenly under my patio paver. My current setup includes the enclosure, patio paver, and squash balls under the paver. Now, the printer is so quiet that I actually can’t tell if it’s running, even when I’m in the same room. Occasionally, I will hear the stepper motors, but that’s rare. Most of the time I need to open the enclosure to make sure it’s still printing.

a year ago 21 votes

More in programming

Supa Pecha Kucha

slug: supapechakucha

20 hours ago 3 votes
The Power of Principles in Web Development Decision-Making (article)

Discover how The Epic Programming Principles can transform your web development decision-making, boost your career, and help you build better software.

12 hours ago 2 votes
Closing the borders alone won't fix the problems

Denmark has been reaping lots of delayed accolades from its relatively strict immigration policy lately. The Swedes and the Germans in particular are now eager to take inspiration from The Danish Model, given their predicaments. The very same countries that until recently condemned the lack of open-arms/open-border policies they would champion as Moral Superpowers.  But even in Denmark, thirty years after the public opposition to mass immigration started getting real political representation, the consequences of culturally-incompatible descendants from MENAPT continue to stress the high-trust societal model. Here are just three major cases that's been covered in the Danish media in 2025 alone: Danish public schools are increasingly struggling with violence and threats against students and teachers, primarily from descendants of MENAPT immigrants. In schools with 30% or more immigrants, violence is twice as prevalent. This is causing a flight to private schools from parents who can afford it (including some Syrians!). Some teachers are quitting the profession as a result, saying "the Quran run the class room". Danish women are increasingly feeling unsafe in the nightlife. The mayor of the country's third largest city, Odense, says he knows why: "It's groups of young men with an immigrant background that's causing it. We might as well be honest about that." But unfortunately, the only suggestion he had to deal with the problem was that "when [the women] meet these groups... they should take a big detour around them". A soccer club from the infamous ghetto area of Vollsmose got national attention because every other team in their league refused to play them. Due to the team's long history of violent assaults and death threats against opposing teams and referees. Bizarrely leading to the situation were the team got to the top of its division because they'd "win" every forfeited match. Problems of this sort have existed in Denmark for well over thirty years. So in a way, none of this should be surprising. But it actually is. Because it shows that long-term assimilation just isn't happening at a scale to tackle these problems. In fact, data shows the opposite: Descendants of MENAPT immigrants are more likely to be violent and troublesome than their parents. That's an explosive point because it blows up the thesis that time will solve these problems. Showing instead that it actually just makes it worse. And then what? This is particularly pertinent in the analysis of Sweden. After the "far right" party of the Swedish Democrats got into government, the new immigrant arrivals have plummeted. But unfortunately, the net share of immigrants is still increasing, in part because of family reunifications, and thus the problems continue. Meaning even if European countries "close the borders", they're still condemned to deal with the damning effects of maladjusted MENAPT immigrant descendants for decades to come. If the intervention stops there. There are no easy answers here. Obviously, if you're in a hole, you should stop digging. And Sweden has done just that. But just because you aren't compounding the problem doesn't mean you've found a way out. Denmark proves to be both a positive example of minimizing the digging while also a cautionary tale that the hole is still there.

22 hours ago 2 votes
We all lose when art is anonymised

One rabbit hole I can never resist going down is finding the original creator of a piece of art. This sounds simple, but it’s often quite difficult. The Internet is a maze of social media accounts that only exist to repost other people’s art, usually with minimal or non-existent attribution. A popular image spawns a thousand copies, each a little further from the original. Signatures get cropped, creators’ names vanish, and we’re left with meaningless phrases like “no copyright intended”, as if that magically absolves someone of artistic theft. Why do I do this? I’ve always been a bit obsessive, a bit completionist. I’ve worked in cultural heritage for eight years, which has made me more aware of copyright and more curious about provenance. And it’s satisfying to know I’ve found the original source, that I can’t dig any further. This takes time. It’s digital detective work, using tools like Google Lens and TinEye, and it’s not always easy or possible. Sometimes the original pops straight to the top, but other times it takes a lot of digging to find the source of an image. So many of us have become accustomed to art as an endless, anonymous stream of “content”. A beautiful image appears in our feed, we give it a quick heart, and scroll on, with no thought for the human who sweated blood and tears to create it. That original artist feels distant, disconected. Whatever benefit they might get from the “exposure” of your work going viral, they don’t get any if their name has been removed first. I came across two examples recently that remind me it’s not just artists who miss out – it’s everyone who enjoys art. I saw a photo of some traffic lights on Tumblr. I love their misty, nighttime aesthetic, the way the bright colours of the lights cut through the fog, the totality of the surrounding darkness. But there was no name – somebody had just uploaded the image to their Tumblr page, it was reblogged a bunch of times, and then it appeared on my dashboard. Who took it? I used Google Lens to find the original photographer: Lucas Zimmerman. Then I discovered it was part of a series. And there was a sequel. I found interviews. Context. Related work. I found all this cool stuff, but only because I knew Lucas’s name. Traffic Lights, by Lucas Zimmerman. Published on Behance.net under a CC BY‑NC 4.0 license, and reposted here in accordance with that license. The second example was a silent video of somebody making tiny chess pieces, just captioned “wow”. It was clearly an edit of another video, with fast-paced cuts to make it accommodate a short attention span – and again with no attribution. This was a little harder to find – I had to search several frames in Google Lens before I found a summary on a Russian website, which had a link to a YouTube video by metalworker and woodworker Левша (Levsha). This video is four times longer than the cut-up version I found, in higher resolution, and with commentary from the original creator. I don’t speak Russian, but YouTube has auto-translated subtitles. Now I know how this amazing set was made, and I have a much better understanding of the materials and techniques involved. (This includes the delightful name Wenge wood, which I’d never heard before.) https://youtube.com/watch?v=QoKdDK3y-mQ A piece of art is more than just a single image or video. It’s a process, a human story. When art is detached from its context and creator, we lose something fundamental. Creators lose the chance to benefit from their work, and we lose the opportunity to engage with it in a deeper way. We can’t learn how it was made, find their other work, or discover how to make similar art for ourselves. The Internet has done many wonderful things for art, but it’s also a machine for endless copyright infringement. It’s not just about generative AI and content scraping – those are serious issues, but this problem existed long before any of us had heard of ChatGPT. It’s a thousand tiny paper cuts. How many of us have used an image from the Internet because it showed up in a search, without a second thought for its creator? When Google Images says “images may be subject to copyright”, how many of us have really thought about what that means? Next time you want to use an image from the web, look to see if it’s shared under a license that allows reuse, and make sure you include the appropriate attribution – and if not, look for a different image. Finding the original creator is hard, sometimes impossible. The Internet is full of shadows: copies of things that went offline years ago. But when I succeed, it feels worth the effort – both for the original artist and myself. When I read a book or watch a TV show, the credits guide me to the artists, and I can appreciate both them and the rest of their work. I wish the Internet was more like that. I wish the platforms we rely on put more emphasis on credit and attribution, and the people behind art. The next time an image catches your eye, take a moment. Who made this? What does it mean? What’s their story? [If the formatting of this post looks odd in your feed reader, visit the original article]

yesterday 1 votes
Apple does AI as Microsoft did mobile

When the iPhone first appeared in 2007, Microsoft was sitting pretty with their mobile strategy. They'd been early to the market with Windows CE, they were fast-following the iPod with their Zune. They also had the dominant operating system, the dominant office package, and control of the enterprise. The future on mobile must have looked so bright! But of course now, we know it wasn't. Steve Ballmer infamously dismissed the iPhone with a chuckle, as he believed all of Microsoft's past glory would guarantee them mobile victory. He wasn't worried at all. He clearly should have been! After reliving that Ballmer moment, it's uncanny to watch this CNBC interview from one year ago with Johny Srouji and John Ternus from Apple on their AI strategy. Ternus even repeats the chuckle!! Exuding the same delusional confidence that lost Ballmer's Microsoft any serious part in the mobile game.  But somehow, Apple's problems with AI seem even more dire. Because there's apparently no one steering the ship. Apple has been promising customers a bag of vaporware since last fall, and they're nowhere close to being able to deliver on the shiny concept demos. The ones that were going to make Apple Intelligence worthy of its name, and not just terrible image generation that is years behind the state of the art. Nobody at Apple seems able or courageous enough to face the music: Apple Intelligence sucks. Siri sucks. None of the vaporware is anywhere close to happening. Yet as late as last week, you have Cook promoting the new MacBook Air with "Apple Intelligence". Yikes. This is partly down to the org chart. John Giannandrea is Apple's VP of ML/AI, and he reports directly to Tim Cook. He's been in the seat since 2018. But Cook evidently does not have the product savvy to be able to tell bullshit from benefit, so he keeps giving Giannandrea more rope. Now the fella has hung Apple's reputation on vaporware, promised all iPhone 16 customers something magical that just won't happen, and even spec-bumped all their devices with more RAM for nothing but diminished margins. Ouch. This is what regression to the mean looks like. This is what fiefdom management looks like. This is what having a company run by a logistics guy looks like. Apple needs a leadership reboot, stat. That asterisk is a stain.

2 days ago 3 votes