> This way, you relay the account register process to the seller. These tokens are sold in the format username|password|2fa_code|cookies (including auth token, id and ct0), which makes it very easy and convenient for us to use.
is this legit? this sounds extremely shady. maybe an ad?
I know the guy and it does work, and it's not an ad. Accounts from that website are used on shitter.thepixora.com. The website is extremely sketchy though, he recommends that you don't give it more than a dollar at a time.
No way to know if that particular site is legit without trying it, but account buying and selling on internet gray markets is very normal and the prices quoted are reasonable.
Yes, you have to give up all your personal data and submit to anal probing to get an account on a sillycon valley service, but a bad actor just has to pay $10 in bitcoin to get a thousand of them.
> As a thumb rule never trust the client. The request headers and ability to interact with browsers are what provides you with relatively better state and session control. As an IDP provider I do not want to loose that and still be on the hook for security.
ok so why NOT allow extreme ui customization since client is untrusted anyway? i dont get it. theres no security concern (within this ui) bc the whole thing is untrusted.
> My favorite part of AMT is always going to be figuring out that if we only paid in $0.07 intervals, their commission algorithm would round down to the nearest whole cent when their 20% commission resulted in a fractional cent on the unit transaction level, not the monthly invoice level.
Amazon took 20% of all workers earnings for doing essentially nothing for years and years.. of course I take great joy in giving AWS as little money as possible.
On most of these sites you can just copy the requests the browser makes. There's a walls and ladders game going on, but all the easy to implement walls aren't very high so most sites don't bother building the tallest one possible.
You can start by making a burner account and viewing some pages in a browser and watching the developer network tab. Either you'll see some dynamic JSON request that fetches the main page content, or it'll be in the initial page request. In either case you can copy that request and parse it. If it's in the initial page then it's in HTML so parse it with BeautifulSoup or similar. A minority of sites are using TLS fingerprinting, so try curl-impersonate if plain curl doesn't work.
At least in Firefox I suggest right click "copy as cURL [command]" and then delete parts of the command to see what's actually needed to get the data, or copy the whole exact thing if you're worried about getting fingerprinted based on the parts you deleted.
There's certainly some kind of auth cookie or token. How long does it last? Maybe 15 minutes, an hour, a day, forever? If it's not forever there's a way to refresh it so look through the network requests again, or maybe the network requests when you log in.
If you get rate limited it's probably by IP address and you can try a few things. Rebooting your router to change IP? If you have IPv6 you can change your address arbitrarily within a /64 and if the site is really dumb it will consider that a new IP, but most know about that. If your ISP gives you a /48 or /56 you can change subnet. You can try running on cloudflare workers or Amazon lambda, which have big IP pools that continually churn. Some sites that use cloudflare may exempt all of cloudflare from rate limiting and you may greatly benefit from running on a cloudflare worker. You can try a mobile connection that may use CGNAT, forcing the site to choose between unblocking you or blocking your carrier. If all else fails, residential proxy access is either very cheap or very expensive to buy, depending on how much data you need to move.
i love that you patiently answer these hopelessly antagonistic comments with reason and substance. you'll never convince them, but still i respect that you don't lose your cool. ofc, you're no stranger to this.
Tbh this wording actually made Google Translate render it as “GitHub’s new Git platform.” I got confused and had to look at the original English text to understand what it meant.
Ha, no I just tried to think of an example and an accountant wearing a visor turned AI came to mind. Pardon my hallucinations. It happens to meat sacks too.
Of course, of course, it turns out that name is already taken. Though not anything accounting related. A million monkeys all armed with a million typewriters is quite something.
It seems that way but I don't think it is. That user hasn't posted any similar promotional-seeming messages in any other recent comments. I believe they were meaning to offer an example to illustrate the point they're making about how Stripe can generate revenue by owning intermediary APIs.
> This way, you relay the account register process to the seller. These tokens are sold in the format username|password|2fa_code|cookies (including auth token, id and ct0), which makes it very easy and convenient for us to use.
is this legit? this sounds extremely shady. maybe an ad?
reply