Ex-Akamai, creator of Basic RUM: https://nitter.cf/t.co/RQShZ6CVso, Webperformance enthusiast, Magento addict since Magento CE 1.2.1.2
Munich, Germany
Joined December 2010
- Tweets3.6K
- Following771
- Followers795
- Likes1.5K
Tsvetan Stoychev retweeted
CVE-2026-116366
first CVE on my name just dropped. unauthenticated RCE on any @ClickHouseDB instance using just the public service hostname.
special thanks to San and the ClickHouse security team. the report was accepted within 20 minutes on Bugcrowd.
P.S. Clickhouse Security Team emailed me 1 hour before I reported the vulnerability stating that they "detected attempts of unauthenticated RCE on my instance" which shows how seriously they approach the security of their service in general.
Tsvetan Stoychev retweeted
officially captured the flag on CloudFlare CTF
@dok2001 , thanks for making this CTF happen.
was a tough nut tbh. took me a few hours. reproduced the php2shell exploit on local lab within 30 mins. hard part was bypassing the WAF and leaking the address.
Tsvetan Stoychev retweeted
Quick and Dirty (and Good) Syntax Highlighting for your Slides
Every now and again my marketing team needs to show code snippets in webpages and presentations. There are multiple utilities out there that do the job… sort of.
medium.com/@luca.passani/qui…
Tsvetan Stoychev retweeted
Built this for our marketing team (solved a real nuisance of an issue): syntax-coloring (source code syntax-highlighting).
Snippet in, picture out. PowerPoint, Keynote and Word. Or copy it as colored HTML and paste into Google Docs, Sheets, WordPress, or your own HTML.
#DevTools #webdev
Free, of course. Nothing users paste is uploaded anywhere. Enjoy.
onlineimageoptimizer.com/cod…
Tsvetan Stoychev retweeted
We are live!
We've been building a lot of this stuff over the past 1-2 years, battle testing it with real users in b2b and enterprise.
Now we're opening it up for everyone 🙌
Vendure plans are live, from €199 a month.
For the first time you can buy Vendure without talking to us: company accounts, quotes, contract pricing and approvals.
Vendure Core stays free and open source. Vendure Cloud joins every paid plan in Q1 2027.
vendure.io/blog/introducing-…
Tsvetan Stoychev retweeted
Today, I’m open-sourcing Drost-v1 as Drost Community Edition.
Drost Community is a genuinely powerful offensive cybersecurity tool: It comes with one Docker container, 159 MCP tools, Linux and MacOS support, and direct integration with MCP-compatible AI agents.
In short, you can use your existing coding agents to carry out offensive cybersecurity engagements.
It runs entirely locally, on your hardware, with your models. Drost receives no engagement telemetry.
This is where Drost began.
drost.ai/community
Enjoy! 🚀💥
Tsvetan Stoychev retweeted
FlipperHero now also has a rust CLI apart from the iOS App flipper-hero.net/en/#cli
Tsvetan Stoychev retweeted
There’s a German company that scans the web for images, then emails people asking for money and warning them about lawyers.
It’s called COPYTRACK.
They came after me over a photo I’d bought a licence for in 2018. Their email listed €350 in compensation and warned of lawyers and higher fees unless I provided licence proof.
I asked for documents showing they had the right to make the claim.
Their email replies? No documents. Just more lawyer warnings.
Somehow, in Germany, that counts as a respectable business. And the government doesn’t seem to mind.
Germany has an entire cottage industry built around Abmahnungen and aggressive legal demands over minor alleged infringements.
COPYTRACK once repeatedly threatened me over an image I had legally licensed, while failing to provide convincing evidence that their client even owned the rights they claimed to enforce.
Somehow, Germany has normalized an entire industry of pseudo-legal companies posturing as law firms and firing off extortionate demand letters.
Tsvetan Stoychev retweeted
Update on founding a company in Germany:
The VAT ID arrived. 203 days after I started, almost €12k later.
Then my tax firm asked for my trade registration. First time anyone mentioned it. Legally due the day I started.
Filed it 3 weeks ago. Still waiting. Probably gonna get fined 1000€ for doing business before it.
paolino.me/founding-a-compan…
Not an absolute statement but as of today Codex is lightning years ahead of Claude in terms of Browser control/use. I stay open minded and I know that this statement could not be true in a few weeks :)
Tsvetan Stoychev retweeted
First time I really want to repost my own post as it deserves more attention.
Distributed LLMs locally across OSX, Linux and Windows machines.
Inference through internet that allows access to LLMs any individual machine can't run.
It definitely deserves more than few hundred views...
Astra, GPT Sol, Fable 5.1 and Grok to worked on the same prompt and reported where where they add extra value to a research. Any expert on "Dedusting CMB B-modes when the spectral index will not sit still." who can validate the work - subtle-tiramisu-47f322.netli…
Tsvetan Stoychev retweeted
This is the best article yet in my programmatic advertising series. It packs in a lot of knowledge on how privacy regulations work on both sides of the Atlantic — How we got the consent-banner theater; Why everyone now treats data like HAZMAT; and why tracking survived GDPR anyway.
You don't need to memorize all of it line by line, but if you invest some time to read to the end, I'm confident you'll emerge from it with a clear sense that you've done yourself a favor.
#programmatic #adtech #privacy #GDPR #HowProgrammaticActuallyWorks
scientiamobile.com/the-priva…
Tsvetan Stoychev retweeted
Server timing headers make backend performance metrics available on the front-end.
Our latest article explains how these headers work and how to view them in DevTools and DebugBear.
debugbear.com/blog/server-ti…
Used GPT 5.6 Sol / Daybreak Blue in order to get remote access my Xiaomi Pocophone F1 that got broken screen. Writeup - xdaforums.com/t/authorize-ad…
Tsvetan Stoychev retweeted
🌐 Most of us install a dependency once and never look at it again. It does its job, the tests pass, and we move on. But the web platform keeps moving too, and a surprising number of the libraries sitting in your package.json today are now built into the browser.
Here’s a practical guide by @JoubranJad to auditing your dependencies and replacing libraries with the platform where it makes sense: smashingmagazine.com/2026/08…
Tsvetan Stoychev retweeted
Making it in this AI era is still possible, but the bar is much higher and so is the competition.
How do you make the most out of your hacking time nowadays?
Episode 186, part 2
@OpenRouter is it only me or other users are not able to add credits? I clicked but I wasn't able to add credits. I hope that this problem happens only for me. In this case I created a second workspace for a friend and I wanted to add some credits?
