Rebane

https://infosec.exchange/@rebane2001

Public Key

npub1jd6jws6am6vmwt8yyuke86l7sxrt6zlymaynfdsqnwgr2atk2pnqt408ye

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsfxaf8gdwaaxdh9njzwtvna0lgrp4ap0jd7jf5kcqfhyp4w4m9qespz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsxzxzjn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1jd6jws6am6vmwt8yyuke86l7sxrt6zlymaynfdsqnwgr2atk2pnqt408ye

Show more details

Last Notes

2026-07-15 08:45:02 UTC

i
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/923/099/687/113/540/original/4e3a2ea3984e8d99.jpg

2026-07-08 08:15:45 UTC

so turns out you can *still* use ublock on chrome if you just inspect element it lmfao
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/883/347/995/969/344/original/a10d0dcd94712042.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/883/348/235/584/697/original/5f256a21d22cb3c9.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/883/348/550/843/201/original/65d4dbfbc2bbf336.png

2026-06-29 20:45:03 UTC

til that ℃ is a single unicode character

2026-06-27 07:16:52 UTC

offering early draft access to my new blog post about reddit's internal anti-spam systems
if you're a mutual* & able to read and give feedback on a post within the next 8 hours, please reply
*mutual means we follow each other

2026-06-23 23:49:38 UTC

i actually use she/it pronouns but i dont tell people about it because how tf am i supposed to say it out loud 😭😭

2026-06-06 07:06:43 UTC

RE: https://infosec.exchange/@rebane2001/116659539248452042
hii im back now!!
the time off was good, i think from now on im gonna try to limit my twitter/bsky usage to computers when possible, it's a bit harder to just keep scrolling (fedi gets a free pass because it doesnt have an addicting algorithm)
anyways hii i missed u all so much!!
#note14dt…kdsj

2026-05-24 23:34:26 UTC

i made a new game called js crossword where you have to solve it by literally writing javascript code that eval()'s into the correct values!
check it out if you're into ctfs or wanna challenge your javascript skills
https://lyra.horse/fun/jscrossword/ <3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/632/163/015/230/784/original/474d56775d4c4f95.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/632/163/848/594/940/original/92d867d8ca84014e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/632/164/396/361/786/original/3470ab85a6b77cc9.png

2026-05-22 04:17:54 UTC

i should frame this
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/616/282/372/979/980/original/4302781dc34cee47.jpg

2026-05-20 19:48:55 UTC

RE: https://infosec.exchange/@rebane2001/116606719764376414
accidentally ended up on the news
https://arstechnica.com/security/2026/05/google-publishes-exploit-code-threatening-millions-of-chromium-users/
#note14k9…x7r3

2026-05-20 12:12:07 UTC

- reply

OH NO I JUST REALIZED THIS IS NOT ACTUALLY PROPERLY FIXED AND STILL WORKS 💀💀
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/606/835/033/827/884/original/402b20343a50e84c.png

2026-05-20 11:42:20 UTC

back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member
in edge, you wouldn't even notice anything out-of-place, and would stay connected to the c2 even after closing the browser
today, almost 4 years later, the bug is finally public:
https://issues.chromium.org/issues/40062121
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/606/712/499/138/378/original/751aadcfcdfad72a.mp4

2026-05-15 16:00:57 UTC

yay, rebane mention on tom scott podcast!!
https://lateralcast.com/episodes/188/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/579/422/664/239/964/original/7e6f99342057341b.png

2026-05-13 09:54:18 UTC

laptop
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/566/658/136/984/006/original/53558480db877360.jpg

2026-05-11 23:27:15 UTC

the recording for my "CSS Clicker Training: Making games in a “styling” language" talk i gave at meets style sheets is out now!
https://www.youtube.com/watch?v=4GzHqfAQQb4&list=PLxQqv_fazRs1VlMEbqC0Jlw6VFd97UpT2
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/558/521/636/249/322/original/6d32d37da577fb37.jpeg

2026-05-11 00:07:27 UTC

- reply

https://www.youtube.com/watch?v=f2qsNd1nhV0&list=PLiO3Rmoio16YJu0Pyha7QKr5O0uvXzLOs&index=3

2026-05-10 23:00:33 UTC

- reply

this is from some old set i made:
Sonic Adventure 2 - Space Trip Steps (Meteor Herd)
trndytrndy - minimal beat
Composerily - HOW TO SOUND LIKE PORTER ROBINSON

2026-05-10 22:58:54 UTC

mac vs pc visualizer
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/552/753/849/408/194/original/350b9f11ced6953e.mp4

2026-05-10 22:23:01 UTC

audacity visualizer
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/552/614/713/496/186/original/9fe93f7e8642fece.mp4

2026-05-03 08:23:51 UTC

i'll be giving my css clicker training talk at smashing meets next wednesday!
it's a free online event! check it out here:
https://smashingconf.com/meets-style-sheets
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/509/662/419/943/204/original/fc2a0cfd7b83fd55.png

2026-04-29 17:47:47 UTC

i love my wife so much i edit /shorts/ to /watch?v= before sending it a yt link

2026-04-20 16:32:11 UTC

btw y'all should* write cracks for software you use, even (and especially) if you paid for it
it's a good reversing exercise and you'll thank yourself when the licensing server has an outage or some company doesn't like your new motherboard
(*only if you can do it legally)

2026-04-17 13:48:34 UTC

135tb ram bitches
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/420/349/014/037/726/original/d8b14a5143b81b21.jpg

2026-04-10 19:17:46 UTC

"gotcha"ing an autistic person into eating something with an ingredient they don't like to prove they can't tell is like me spitting in your drink to prove you can't tell that you've just drank my spit

2026-04-06 11:15:30 UTC

did you know? the google forms share icon has a stray pixel in its corner
why? because the icon spritesheet has a massive black triangle overlapping the icons
what is that triangle? it's a giant out-of-bounds hat!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/357/452/365/762/220/original/9fed92f349085974.png

2026-03-28 18:28:47 UTC

had to check my archive to make sure this was in fact the original thumbnail
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/308/215/141/473/132/original/6a94243de5d60e23.png

2026-03-23 09:04:31 UTC

the new image-animation css property is so cool wtf
i don't think you've ever been able to pause GIFs on the web before, this is such an accessibility win!!
https://github.com/w3c/csswg-drafts/issues/1615#issuecomment-2652101726
https://drafts.csswg.org/css-image-animation-1/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/277/670/377/548/781/original/d769f29ac2bd4d47.png

2026-03-22 23:09:15 UTC

we're finishing a game of sudoku that's been going on for 16 years
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/275/332/670/449/845/original/29223f3d434f59ee.jpg

2026-03-20 14:09:02 UTC

hii! if you're someone learning webdev and specifically css, what are some difficult or hard to understand/grasp parts for you?
i wanna make some beginner-friendly tutorial stuff and it would be good to know what i should focus on the most

2026-03-17 10:40:55 UTC

in linux you can use the evil bird emoticon (:>) to destroy files, eg `:> important_document.txt`
the bird will eat the file and leave it completely empty!

2026-03-15 15:48:04 UTC

somebody took my repo, reuploaded it with an ai-slopped README, and then added a zip file with lua malware in it??
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/233/966/597/214/745/original/b0df94acc681a081.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/233/967/503/997/313/original/42b2a0e15b477d04.png

2026-03-12 12:08:01 UTC

yay i got my 10th chrome cve!!
i wrote a pretty fun patch for this one too
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/216/117/367/888/502/original/4431a2a0f4fa8734.png

2026-03-09 15:59:47 UTC

did you know that SSH has a little-known secret menu?
i wrote a post about this on cohost a while back, but since that site shut down i'm posting it here too
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/035/509/605/989/original/a0ed7a4028eb7157.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/041/472/217/483/original/84cef1e14a4516b3.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/045/409/467/223/original/1e4755e92c930f4c.jpg

2026-03-09 15:46:42 UTC

fun linux fact:
the `if` shell built-in just executes the command you give it and looks at its exit code
so how can you do stuff like `if [ $a -gt 10 ]`?
well, [ is just a program usually in /bin/[ that takes the arguments ($a, -gt, 10, ]) and returns an exit code accordingly
this is also why you need the spaces between everything as well as quoting - they're ordinary arguments and need to be provided as such
also note that many shells do actually have similar shell built-ins such as [[ ]] and (( )), which are not stand-alone programs like [ is

2026-03-02 09:20:10 UTC

it performs decss in HOW MANY LINES??
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/158/831/903/991/396/original/bbdc0ced12308467.jpg

2026-02-26 16:35:02 UTC

i just got a notification for my own project?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/137/898/330/713/037/original/2e81eac3c3b46adb.jpg

2026-02-24 02:23:52 UTC

i built an entire x86 CPU emulator in CSS (no javascript)
you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS
https://lyra.horse/x86css/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/123/213/856/871/600/original/14beecddcc6775f2.mp4

2026-02-19 21:50:17 UTC

self-hosting my S3 bucket the right way
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/099/496/323/659/317/original/8e3edf02213ae783.jpg

2026-02-18 17:08:45 UTC

turns out tied up legs work great as a steam deck stand
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/092/721/246/727/047/original/485deb3fb4e887c8.jpg

2026-02-16 18:15:45 UTC

slides for my disobey talk out now!!
slide #54 onwards is all new content, showing a real google pay attack/vulnerability through SVG filters, as well as a visualization on how the SVG filter QR code generator works
https://lyra.horse/slides/?#2026-disobey
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/081/655/138/157/887/original/b7846b0a1b89581e.png

2026-02-12 14:21:48 UTC

the joke of "cool feature, can't wait to be able to use it in 5 years" is now baseline widely available

2026-02-12 06:32:03 UTC

what real inclusivity looks like
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/056/254/974/935/434/original/a41ebde7cdfd1877.jpg

2026-02-06 18:10:38 UTC

Xikipedia, the Wikipedia doomscrolling "app", is now available as an actual app (PWA)!
Also:
- fully available offline
- algorithm saving/persistence (optional)
- multiple profiles
- light theme (optional)
- full english wikipedia links (optional)
- statistics screen
have fun!!
https://xikipedia.org/?2
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/025/015/246/162/083/original/ea7e96631bb3f23f.mp4

2026-02-05 00:26:52 UTC

"dont use a blue light filter there are no studies that prove it works"
shut up it makes my eyes not bleed its fucking great, whenever i need to pull an all-nighter i make sure my f.lux is set to solid red

2026-02-03 17:40:27 UTC

did you know? if you're a paying adobe user, you can message the support and ask for offline installers for the software you pay for
why would you do that? if they ever were to discontinue one of their products (*cough* animate), you could still install and activate it
and while i do not publicly endorse piracy (for obvious reasons), i do want to note that installations made with these offline installers have way safer methods of patching them than downloading a pirated copy that's potentially malicious
all i'm saying is, those installers are kind of annoying to get these days. if you pay for the software, ask for the installers and make backups of them.
oh and last - you can ask for older versions too! even older than what the CC app shows you
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/007/882/815/175/426/original/5f16d0834b835b93.png

2026-02-02 05:42:09 UTC

so annoyed at apple for making ios impossible to make websites for
like how am i supposed to test the fact that my site crashes random iphones? it works fine on my iphone.. i can't emulate other iphones on my computer..
and then they don't allow you to use any other web browser

2026-02-02 04:39:12 UTC

one of the things i lowkey hate is when people talk about my projects and say that they could never do anything like that themselves
like, half the reason i make stuff is to inspire people! i don't obfuscate or minify my code, i want you to view-source it!! create cool stuff!!

2026-02-01 23:42:50 UTC

i made a version of wikipedia you can doomscroll
https://xikipedia.org/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/998/016/573/869/062/original/73dab5d8d42bbcc0.mp4

2026-01-25 14:04:13 UTC

i think it would be fun to make an ios horror game where you only see the monsters or whatever on screenshots you take
ios lets you do overlays that appear on screenshots, but not on the screen, so this would be pretty doable

2026-01-22 15:06:16 UTC

ugh!! i was working on a NEW viral mobile game idea where you throw your phone like a basket ball and ended up breaking my screen when it bounced off my sofa onto the floor ☹️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/939/332/508/216/458/original/86d223d12a17df29.jpg

2026-01-21 16:10:10 UTC

i made an archery game that uses your charging cable as the controller
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/933/938/838/029/003/original/bbc64afa5cfc5e02.mp4

2026-01-15 16:05:37 UTC

hey fedi, im looking for some advice on masks
so sometimes i'd like to (or have to) wear a mask, but every time i do so for more than a few minutes it gets kinda bad - my nose clogs up, my face is covered in sweat, and my lips become chapped - and its pretty terrible for me sensory-wise
i've only ever tried disposable or basic masks though, so my question would be - are there any specific masks i should try out (i'm thinking maybe ones with a valve would be better), and are there any other ways to remediate the issues i'm having?
i don't like *need* a mask, but it would be nice if i had one with me i could comfortably wear if i want to

2026-01-06 10:51:37 UTC

its so cold im using chrome instead of firefox to read news on my phone cuz i need the ads to warm up my phone and hands

2026-01-02 21:12:29 UTC

i made a flappy bird clone that uses your folding phone as the controller
https://lyra.horse/fun/foldy-bird/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/827/559/144/790/208/original/dda3fb73a76e86a5.mp4

2025-12-25 14:20:58 UTC

CSS-only livesplit recreation (made in ~45 min)
https://lyra.horse/fun/livecssplit.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/780/638/755/067/261/original/26223fc368c942e7.mp4

2025-12-19 21:57:25 UTC

my #39C3 talk's at 21:05 on saturday in the ground room!
i'm still working on the slides, so if you have any CSS crimes or techniques you'd like to see explained please let me know! it can be both cohost and general CSS crimes & stuff!
see you there!!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/748/432/198/744/290/original/3a5ce86ef2cc665f.jpg

2025-12-05 10:16:26 UTC

calling svgs an attack vector is a diabolical pun

2025-12-04 14:03:39 UTC

my new blogpost is out!!
this one talks about a new web vulnerability class i discovered that allows for complex interactive cross-origin attacks and data exfiltration
and i've already used it to get a google docs bounty ^^
have fun <3
https://lyra.horse/blog/2025/12/svg-clickjacking/

2025-12-01 20:46:23 UTC

- reply

if ur wondering how it works ill be dropping the code in a blog post this week

2025-12-01 19:21:21 UTC

did u know the 'qr' in qr codes is pronounced as 'queer'

2025-12-01 18:56:44 UTC

would u believe this queer made a qr code generator inside an svg filter
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/645/824/015/020/296/original/39f5dbe0c1d5286a.png

2025-11-19 17:45:14 UTC

pretty fun stuff in here :)
https://hackaday.com/2025/11/18/congratulations-to-the-2025-component-abuse-challenge-winners/

2025-11-04 14:35:42 UTC

my #39c3 talk got accepted!!
see you at @npub15qj…3kl0 in december ^^
(yes, it will be livestreamed and recorded)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/491/899/077/151/412/original/4769b8aaa3558e31.png

2025-10-21 16:43:35 UTC

idk if i've ever posted here about my bliss keyboard
the keyboard itself is a WASD V3, but the keycap design is something fully custom i did myself
btw WASD Keyboards no longer exists, so that makes mine a bit more special
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/413/140/157/900/143/original/b9ca094b6b4128ce.png

2025-10-03 08:56:38 UTC

- reply

> You can make webapps without WebAssembly, without ECMAScript, or even without CSS. But you absolutely need HTML
You don't actually need HTML to make a webapp, even an interactive one. HTTP, CSS, and Firefox is enough.
Try this on Firefox: https://lyra.horse/fun/tic-tac-nohtml/
View-source for that page should give you an empty 0b file.
(and you can't argue about the browser creating a DOM anyways, because in that case you cannot have a webapp without CSS since the browser always applies its own agent stylesheets)

2025-09-25 13:58:31 UTC

i can finally share the google docs attack poc from my slides!!
blogpost coming later
(video 1/2 - the attack)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/265/237/259/210/958/original/c89eb1537c32d864.mp4

2025-09-08 05:52:47 UTC

reviewing this hotel i'm staying at
pros:
- gigabit internet
- personal wifi router
cons:
- can't leave the room
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/167/118/226/576/930/original/ff5d2fe1e77b5e71.mp4

2025-08-24 09:39:00 UTC

somehow i still keep learning new stuff about css
today i discovered that `font-family: monospace;` causes the text to become smaller!
you can get around this by doing `font-family: monospace, monospace;`
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/083/068/445/295/231/original/6bbaf3a47c001f2f.png

2025-08-11 07:07:49 UTC

love my cross-platform oomfs
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/008/850/519/153/798/original/c4bbf7d49ed934f0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/008/855/981/754/541/original/febde946a9c28c44.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/008/857/984/813/389/original/4abfa312adddcc5a.png

2025-08-04 07:22:29 UTC

i kinda hate minification on the web, i think learning from others is a lot more accessible if the view-source of a page is fully readable
it also doesn't save as much data as people often assume, gzip gets pretty close to the minified size and yr images make it neglible anyways

2025-07-11 18:03:11 UTC

using government traffic cams for free selfies ^_^
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/835/898/842/387/854/original/88c2bb8b36857d49.png

2025-06-25 05:32:44 UTC

i love css 💖
also shoutout to @Fastmail for rolling out fixes for both reports in <48h
https://www.fastmail.com/bug-bounty/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/742/357/805/920/119/original/a56e213b709c77b8.png

2025-06-24 18:36:37 UTC

yay my first 2025 chrome cve!!
https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/739/786/074/085/442/original/324988a8ad379075.png

2025-04-27 16:32:24 UTC

this seems fun
https://www.fixbrowser.org/blog/fixproxy

2025-04-16 05:27:18 UTC

did they like, write this article with an ai that hallucinated a completely random first name for me??
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/345/973/390/477/891/original/5b230f72843c5cd5.png

2025-04-15 09:05:23 UTC

somebody broke into 4chan's servers, posted pics of the admin views and phpmyadmin page, and leaked partial source code and the posts from the jannie (mod) board
seems like the attacker had shell access on the server, so this might not be all
site itself is down right now

2025-03-30 09:48:47 UTC

- reply

quote from: https://gekk.info/articles/traceroute.htm

2025-03-30 09:48:26 UTC

this is pretty much all the computer art i make
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/250/739/067/161/335/original/9e4a4b1bb594b417.png

2024-12-29 17:58:13 UTC

i made a video about cohost css crimes!!
https://www.youtube.com/watch?v=LkMtiwitg-w

2024-10-20 13:28:59 UTC

- reply

yes, you should also submit links on the wayback machine
no, you shouldn't rely on it
to save websites: https://archivebox.io
to save videos (small scale): https://cobalt.tools
to save videos (large scale): https://github.com/rebane2001/sensible-yt-dlp-archive-scripts
please ctrl+s what you care about

2024-10-20 13:23:56 UTC

i wish it didn't take internet archive getting hacked for ppl to realize you really do need to save stuff yourself and not rely on anyone else....

2024-09-19 06:28:52 UTC

new blogpost time!!
this one's a fun writeup on a vulnerability chain i found across multiple google services that earned me a $4133.70 bounty
lots of fun css as usual! i had to recreate a bunch of drive/docs/gmail/youtube UIs c:
have fun!
https://lyra.horse/blog/2024/09/using-youtube-to-steal-your-files/