AURA - Detecting Fake Cell Towers with RF Fingerprinting AII built AURA after the recent KT hack in Korea where criminals used fake base stations to steal $170k through SMS interception.## The Problem
IMSI catchers (fake cell towers) can&#x27;t be detected by phones because they perfectly mimic protocol handshakes. But they can&#x27;t fake the unique electromagnetic &quot;fingerprint&quot; created by hardware imperfections.## Our Solution
- Train AI on legitimate base station RF signatures (phase noise, transients, drift)
- Real-time anomaly detection using efficient SSM&#x2F;Mamba architectures
- &lt;200ms detection latency, runs on edge devices## Technical Details
```python
# Dual-layer detection
1. RF Fingerprint: Hardware imperfections (amplifier nonlinearity, clock drift)
2. Protocol Behavior: Forced 2G downgrade, abnormal power levels
→ Trust Score: Real-time 0-100% confidence rating
```Key innovations:
- Wave-based AI (wAI): Treats RF signals as &quot;language&quot; with grammar&#x2F;syntax
- Tokenization pipeline: STFT → Quantized TFR → Transformer
- Edge-first: 50MB quantized model, runs on Raspberry Pi## Results
- 99.9% detection accuracy in Seoul&#x2F;Tokyo field tests
- Found 17 unknown suspicious transmitters
- Prevented 278 unauthorized transactions in pilot
- Zero false positives on 10,000+ legitimate base stations## Implementation
```bash
# Minimal PoC
python collect_baseline.py --sdr hackrf --duration 3600
python train_wai.py --model mamba --epochs 100 
python detect_realtime.py --threshold 0.85
```Stack: GNU Radio + PyTorch + RTL-SDR&#x2F;HackRF## Next Steps
- Open-sourcing core detection engine (Q1 2025)
- Building crowdsourced threat intelligence network
- Adding 5G SA&#x2F;NSA supportGitHub: [coming soon - email for early access]
Technical paper: [arxiv link pending]Looking for feedback from RF&#x2F;SDR folks: What attack vectors am I missing? How would you bypass RF fingerprinting?

Aura – Detecting Fake Cell Towers with RF Fingerprinting AI

I signed up for Cloudflare&#x27;s Business plan and paid for a year in advance. While adding a new domain I made a typo and now the subscription is stuck in a limbo.I can&#x27;t change the domain without contacting their support or paying another $2400. When I open a support ticket, their portal shows &#x27;Unable to find your account&#x27; and tells me to open another support request for it.All support tickets are closed automatically by their &quot;AI&quot; which points to the same article that says open a ticket.Is shaming them on Twitter my only option left?

Paid $2400 to Cloudflare, support refuses to help

I&#x27;m trying to get a Wikipedia page for Single File Web Apps approved (https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Draft:Single_File_Web_Apps), and I&#x27;m trying to find good examples of Single File Web Apps (web apps that are just a single HTML file). Please comment if you know of any.

Ask HN: What Single File Web Apps do you know of?

Demo broke us: Datastripes stalled on a 200MB sheet.Fix = rip logic into WASM analytical DB (&lt;3 duckDB), wire workers with synced message channels, cut the overhead. Parsing + aggregation now run parallel, no BS.Benchmarks:
 500MB ingested in ~2s
 Charts on 100k+ rows live
 Plain i7, 16GB RAMBasically spreadsheets at GPU-speed, no GPU.
Play with it: https:&#x2F;&#x2F;datastripes.com

How WASM DB and worker messaging helped me handle 500MB in 2s in browser

I&#x27;m a software dev, and I feel like I can do more in this world than be a crud-monkey for a Fortune 500 company. However, most of the problems that I see in the world don&#x27;t seem solvable through software. Does anyone else have this problem? Are there obvious outstanding problems that can be solved through software? If there are, who are the people solving these problems?

What problems are worth solving?

it seems there is a quite a bit of gap between the performance of Rust iterator and C++ ranges&#x2F;views unless I am missing something.https:&#x2F;&#x2F;godbolt.org&#x2F;z&#x2F;v76rcEb9n
https:&#x2F;&#x2F;godbolt.org&#x2F;z&#x2F;YG1dv4qYhRust:
&lt;code&gt;
use std::time::Instant;fn expand_iota_views(input: &amp;[i32]) -&gt; impl Iterator&lt;Item = i32&gt; + &#x27;_ {
 input
 .iter()
 .flat_map(|&amp;n| 1..=n)
 .flat_map(|n| 1..=n)
 .flat_map(|n| 1..=n)
}fn main() {
 let input: Vec&lt;i32&gt; = (0..=50).collect();<pre><code> let sample_result: Vec&lt;i32&gt; = expand_iota_views(&amp;input).collect();
 println!(&quot;Rust Result count: {}&quot;, sample_result.len());

 let start = Instant::now();
 let mut total_count = 0;
 for _ in 0..1000 {
 let result = expand_iota_views(&amp;input);
 total_count += result.count();
 }
 let duration = start.elapsed();

 println!(&quot;Rust Total count (1000 iterations): {}&quot;, total_count);
 println!(&quot;Rust Total time: {} microseconds&quot;, duration.as_micros());
 println!(
 &quot;Rust Average per iteration: {:.2} microseconds&quot;,
 duration.as_micros() as f64 &#x2F; 1000.0
 );</code></pre>
}
&lt;&#x2F;code&gt;Output:
Rust Result count: 292825
Rust Total count (1000 iterations): 292825000
Rust Total time: 1025 microseconds
Rust Average per iteration: 1.02 microsecondsC++:
&lt;code&gt;
#include &lt;chrono&gt;
#include &lt;iostream&gt;
#include &lt;numeric&gt;
#include &lt;ranges&gt;
#include &lt;vector&gt;inline auto expandIotaViews(const std::vector&lt;int&gt;&amp; input) {
 auto iota_transform = [](const int number) {
 return std::views::iota(1, number + 1);
 };<pre><code> return input 
 | std::views::transform(iota_transform) 
 | std::views::join 
 | std::views::transform(iota_transform) 
 | std::views::join
 | std::views::transform(iota_transform) 
 | std::views::join;</code></pre>
}int main() {
 std::vector&lt;int&gt; input(51);
 std::iota(input.begin(), input.end(), 0);<pre><code> auto sample_result = expandIotaViews(input);
 std::vector&lt;int&gt; result_vec;
 for (auto val : sample_result) {
 result_vec.push_back(val);
 }

 std::cout &lt;&lt; &quot;C++ Result count: &quot; &lt;&lt; result_vec.size() &lt;&lt; std::endl;

 auto start = std::chrono::high_resolution_clock::now();
 size_t total_count = 0;
 for (int i = 0; i &lt; 1000; ++i) {
 auto result = expandIotaViews(input);
 total_count += std::ranges::distance(result);
 }
 auto end = std::chrono::high_resolution_clock::now();
 auto duration =
 std::chrono::duration_cast&lt;std::chrono::microseconds&gt;(end - start);

 std::cout &lt;&lt; &quot;C++ Total count (1000 iterations): &quot; &lt;&lt; total_count
 &lt;&lt; std::endl;
 std::cout &lt;&lt; &quot;C++ Total time: &quot; &lt;&lt; duration.count() &lt;&lt; &quot; microseconds&quot;
 &lt;&lt; std::endl;
 std::cout &lt;&lt; &quot;C++ Average per iteration: &quot; &lt;&lt; duration.count() &#x2F; 1000.0
 &lt;&lt; &quot; microseconds&quot; &lt;&lt; std::endl;

 return 0;</code></pre>
}
&lt;&#x2F;code&gt;Output:
C++ Result count: 292825
C++ Total count (1000 iterations): 292825000
C++ Total time: 174455 microseconds
C++ Average per iteration: 174.455 microseconds

C++ ranges/views vs. Rust iterator

Hey HN,I’m a pentester and recently came across a new Mirai-based botnet called Gayfemboy (yes, the name sounds like a meme, but the threat is real). It’s currently infecting over 15,000 devices daily, mostly targeting routers and network gear from Cisco, TP-Link, DrayTek, and Raisecom.What it does:Launches DDoS attacks (UDP, TCP, ICMP)
Mines Monero using XMRig
Acts as a proxy for malicious traffic
Installs backdoors and evades analysis (e.g., UPX header tampering, nanosecond delays)Vulnerabilities exploited (At this moment):CVE-2025-20281 (Cisco ISE)
CVE-2023-1389 (TP-Link AX21)
CVE-2020-8515 (DrayTek)
CVE-2024-7120 (Raisecom MSG)Mitigation ideas I’m testing:Scanning client networks for vulnerable firmware
Blocking known malicious domains and IPs at the firewall level
Writing scripts to detect outbound traffic to those IOCs
Recommending disabling remote admin access on routers
I’d love to hear what others are doing to detect or contain this botnet. Has anyone seen it in enterprise environments? Any creative or effective mitigation strategies you’d recommend?

Mirai Variant "Gayfemboy" Infecting 15K+ Devices Daily – Mitigation Ideas?

A lot of repos are being under attack where branches are being created under the name [REDACTED] to trigger GH actions and send all secrets to a webhook website. This is new and here is an example:[REDACTED]Just search on github and you will see planty repos.

GitHub Attack – branches sending secrets to webhook

At least a 256x256x256mm print volume. Needs to be enclosed or enclosable. Need to be able to print with more durable, temperature&#x2F;chemical resistant materials such as PC&#x2F;Nylon&#x2F;ABS or infused materials. I do not need to print multi material models. I would prefer something that doesn&#x27;t phone home and can work offline. Opensource firmware&#x2F;software and repairability are important.I am ok assembling the machine and learning how to dial it in. I can do CAD work and make models by hand; I was a machinist in a past life. But, I am not very familiar with &#x27;slicer&#x27; software yet.

Ask HN: What's a good 3D Printer for sub $1000?

I&#x27;m doing a presentation on the dot com boom&#x2F;bust and wanted a screenshot of the web site. I can&#x27;t seem to find anything on the web.

Ask HN: Does anyone have any screenshots of fucked company?

I&#x27;m a top hacker for Cloudflare and the continuous declining level of their bug bounty assessment has made me very concerning.I submitted an 1-click Account Takeover on their VIP program, apart the previous ones which were assessed as High Severity. But the recent one is downgraded to Low Severity due to phishing, even when the High Severity issue also required phishing. I mean 1-click ATO do require phishing bro.This is the second incident after their publicly acked mishandled triaging of https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;unauthorized-issuance-of-certificates-for-1-1-1-1I do not know what&#x27;s happening to them, but they are declining to provide answers, even privately&#x2F;publicly. Also, they publicly boasts of their new VIP program: https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;cisa-pledge-commitment-bug-bounty-vip&#x2F;#the-vip-programs-new-enhanced-reward-structure but when submitting this recent report to it, they forwarded it to the public program.

Cloudflare Security Mistriages on Account Takeover

I&#x27;m consulting for a US-only startup that has approximately 2000 sellers. We don&#x27;t yet facilitate payments on site because we are worried about not being sales tax compliant. But now we&#x27;re thinking about biting the bullet.Assuming we sell into all states and that our transaction volume will reach $10 million USD, what would be the cost of calculating, collecting, and remitting sales tax to the relevant states, counties, and cities?Assume too that we only sell one type of product (i.e. we are a specialist marketplace not a general one).It might be worth separating into setup and recurring costs.Any surprises in store? Or recommendations in terms of tooling or vendors?

Ask HN: Costs for US sales tax compliance for a two-sided marketplace

Accessing google.com in Lynx now shows:<pre><code> Google
 Update your browser
 Your browser isn&#x27;t supported anymore. To continue your search, upgrade to a recent version. [Learn more]</code></pre>

Google Ends Support for Lynx Browser

Some background on me: I&#x27;ve reached a point where I quit my job of 11 years without notice due to sheer burnout. Shortly after I was hospitalized for a bit.I&#x27;m trying to recover, getting back into healthy routines.I&#x27;m also suffering quite a bit of imposter syndrome due to not having a 4 year degree.I&#x27;m suffering from a lot of analysis paralysis trying to select a side project for a portfolio. Once I decide, I get another layer on how I&#x27;m going to implement it. And eventually it winds up feeling like I&#x27;m better off not doing any of them.In my last job I was responsible for a mission critical service in the form of an apache module. Which I can attest is a rather hostile environment. So I&#x27;m pretty battle tested in the c&#x2F;c++ arena.In my spare time I&#x27;ve reveled in physically based rendering. So I&#x27;ve got enough trig &amp; calc in my head to be dangerous.My asks of HN:- What are interviews like these days? How important is it to have a visable portfolio of working projects?- How much of the AI hype is HN nerds nerding out about AI versus actually implementing AI, versus gluing AI apis together?- How do you keep yourselves engaged with pet projects? My github is a field of projects 1&#x2F;4 of the way completed before I lost steam on them.I need some hope that future employment is possible.

Ask HN: Getting over Burnout with Imposter Syndrome

Wouldn&#x27;t git be simpler without stashes and tags?Tags can be deleted and recreated, so they are just like branches and not immutable as some claim.Same goes for stashes. They are commits which can&#x27;t be pushed. Stashes could be implemented by creating a new branch and committing both with a generated name.Am I missing something?
Do both things provide more value than they add complexity&#x2F;things to learn? :)

Git Without Stash/Tags

I just learned an expensive lesson and wanted to share it here so others don’t make the same mistake.I recently lost $300 because of an API key leak. It started with a surprise $200 charge from Google Cloud, and when I looked into it, I found another $100 charge from the day before. Both were for Gemini API usage that I never intentionally set up.After digging, I discovered the issue: I had hard-coded an API key in a script that was part of a feature I ended up deprecating. The file was only in the codebase for two days, but that was enough for the key to leak. Google actually sent me alerts about unusual activity, but I missed them because they went to a less-frequently-checked email account.Here’s what I learned:Never hardcode API keys - Use environment variables or a .env file, even for temporary code.Set up billing alerts - Google Cloud (and other providers) let you set up alerts for unexpected charges.Check all linked emails - Don’t ignore notifications, even if they’re sent to secondary accounts.Don’t rely solely on GitHub’s secret scanning - It’s useful, but renaming variables can bypass it.This happened while I was experimenting with &quot;vibe coding&quot; (letting AI generate code quickly), but I realized too late that human oversight is still crucial, especially for security.Hope this helps someone avoid the same costly mistake!TL;DR: Hard-coded an API key in a deprecated script, key leaked, and I got charged $300. Always use environment variables and set up billing alerts!

Lost $300 due to an API key leak from "vibe coding" – Learn from my mistake

Share your information if you are looking for work. Please use this format:<pre><code> Location:
 Remote:
 Willing to relocate:
 Technologies:
 Résumé&#x2F;CV:
 Email:
</code></pre>
Please only post if you are personally looking for work. Agencies, recruiters, job boards,
and so on, are off topic here.Readers: please only email these addresses to discuss work opportunities.There&#x27;s a site for searching these posts at <a href="https:&#x2F;&#x2F;www.wantstobehired.com" rel="nofollow">https:&#x2F;&#x2F;www.wantstobehired.com</a>.