This is so cool, thank you for sharing. I'm diving on the website and code and see what you got there. would be great to join and chat further about this.

RE Hello taking 18s, yes that is long, but one caveat is that with longer text it doesn't get longer linearly due to compression, the more repetition the better compression.

Let's talk on https://p2p.radio/chat/#development

Doesn't require credentials to chat there and we can talk about next steps, really enjoyed that concept of using normal phone calls again as modems.

For those interested to know more and discuss the protocol, here's my attempt at documenting what worked at the end: https://github.com/shayanb/Nedagram/blob/main/docs/PROTOCOL....

I had to make sure the sound could be transferred on phone calls so it has lower baud rate than let's say dial up modems and many other methods (e.g. minimodem), I'd love to find a way to make it better.

Also got a suggestion to mix this with songs so it's less dodgy to play something like this on the phone. something that I want to look into as well.

Mother of All VPNs, Internet Freedom Stack

- https://moav.sh/ - https://github.com/shayanb/MoaV

Basically a one command installation of 8+ protocols with easy user management.

My idea is to make it easy to run your own battle tested VPN server for yourself (when traveling or not) and your family and friends. Pretty useful in national internet shutdown situations

Looks great, although I'm still not convinced to install it :) what can you say to make me be like hell yes I want to move from vscode to thicc?

I love coding, but I love vibe coding even more. I look at the code, do proper git commits manually and review the changes mostly. Vibe coding helps me do in a few hours what would have taken me weeks to make/debug/document.

Then that's not vibe coding though.

Basically: Rage Bait is winning :/

> The Oxford Word of the Year 2025 is rage bait

> Rage bait is defined as “online content deliberately designed to elicit anger or outrage by being frustrating, provocative, or offensive, typically posted in order to increase traffic to or engagement with a particular web page or social media content”.

https://corp.oup.com/news/the-oxford-word-of-the-year-2025-i...

this is a gem from the past I believe

Human coders utilizing LLMs are better

Vibe coding a few apps I always felt humanity deserves (a bit exaggerated but kind of not :) )

- https://padsnap.app/ : PadSnap is a simple web app that adds customizable padding to your images so they fit Instagram’s/custom dimensions — no cropping, no quality loss. All on browser, no server uploads. Also no ads or login.

- https://shiryakhat.net/ : redid my podcasts website last week: Shir Ya Khat podcast, which translates to "Head or Tails" in Farsi, began its non-profit journey in 2016 with a mission to make blockchain and cryptocurrency technical knowledge accessible to Farsi speakers worldwide.

- life timetime visualizer, still WIP, feedback welcome: https://shayanb.github.io/timeline/

I had a similar experience with another dating app, although they never got back to me. When I tried to get the founders attention by changing his bio to contact me text, they restored a backup lol

years later I saw their instagram ad and tried to see if the issue still exists, and yes it did. Basically anyone with the knowledge of their API endpoints (which is easy to find using the app-proxy-server) you have full on admin capabilities and access to all messages, matching, etc.

I wonder if I should go back and try again... :-?

Why not disclose it as a responsible dev with contacts and move on.

If a company is not responsible enough to follow up on security reports you should not follow up, but instead disclose it to the world.

tbh, I agree.

I've sent 2 big bugs like this, one Funimation and one for a dating app.

Funimation you could access anyones PII and shop orders, they ignored me until I sent a linkedin message to their CTO with his PII (CC number) in it.

The "dating" app well they were literally spewing private data (admin/mod notes, reports, private images, bcrytped password, ASIN, IP, etc) via a websocket on certain actions. I figured out those actions that triggered it, emailed them and within 12 hours they had fixed it and made a bug bounty program to pay me out of as a thank you.

Importantly, I also didn't use anyone else's data/account, I simply made another account that I attacked to prove. Yes it cost me a monthly sub ~$10 to do so. But they also refunded that.

I think it took so long that I moved on, but you are right and I should have done that. Probably I'll take a look again to see if I can do it now :)

Been there. Nagged the city of Seattle for nearly two years about fixing their insecure digital wallets, and in return they just acted weird to me and never really fixed the problem. Wouldn't tell me anything not even the vendor so I could communicate to them that this issue could exist elsewhere. The goal of these tactics is to delay long enough that you give up on publishing. So publish. Just be ethical and stay within the bounds of the law on what you access and release.

I did a quick test and seems like the full admin access that I used to get is slightly fixed/changed. I'm wondering if there was an issue and I have enough data to show there were full compromised of all users data, but it is changed now (might still be vulnerable but let's say it's not). should I still release something? they should have notified their users of such an issue right?

Sounds worthy of a blog post to me