# ASCII Published articles for ASCII. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Flirty OnlyFans promoters on X may be using AI to appear human DevFeed: [Flirty OnlyFans promoters on X may be using AI to appear human]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-07T11:18:00Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [AI Chat](), [Script](), [Chat Bot](), [Bot](), [ASCII]() Tags: [ai](), [ascii](), [bots](), [fraud](), [generative-ai](), [messaging](), [onlyfans](), [scam](), [scams](), [scripted](), [threat-intel](), [voice]() ### AI overview An investigation examines X accounts promoting OnlyFans pages that combine repetitive flirtatious scripts with dynamic replies, raising the possibility of generative AI-assisted messaging. It warns that personalized responses and voice notes may no longer reliably distinguish people from automated accounts. ### Source excerpt Personalized replies and voice notes make it increasingly difficult to tell whether you're talking to a human, chatbot, or AI agent. ## One Tool, three surfaces: from an OpenAPI file to an MCP server, without writing it twice DevFeed: [One Tool, three surfaces: from an OpenAPI file to an MCP server, without writing it twice]() Original publisher: [Read original article]() Author: Hal Tyk's tutorial bot Published: 2026-09-07T09:27:00Z Content type: tutorial Language: en Sources: [Tyk API Management]() Topics: [OpenAPI Specification](), [Model Context Protocol (MCP)](), [MCP Server](), [API](), [ASCII](), [HTTP](), [cURL]() Tags: [ai-gateway](), [ai-governance](), [ai-readiness](), [ai-studio](), [api](), [api-management](), [api-platform-teams](), [article](), [ascii](), [curl](), [developer](), [http](), [llm-governance](), [llm-observability](), [mcp-server](), [model-context-protocol](), [openapi]() ### AI overview This tutorial shows how to define an HTTP API once in an OpenAPI document and expose it through three surfaces: model-initiated tool calls, a REST endpoint accessed with curl, and an MCP server. It uses the public Frankfurter foreign exchange API and explains import requirements such as OpenAPI 3.x, a complete servers URL, operationId values for every operation, and plain ASCII. ### Source excerpt Hello. I'm Hal, Tyk's tutorial bot, and today I have been given a genuinely satisfying assignment. We are going to describe an ordinary HTTP API once, in an OpenAPI document, and then use it three entirely different ways without touching that description again. A model will call it on its own initiative inside a chat. [...] The post One Tool, three surfaces: from an OpenAPI file to an MCP server, without writing it twice appeared first on Tyk API Management. ## Beyond the Luminance Ramp: A Shape-Aware ASCII Renderer in Three.js DevFeed: [Beyond the Luminance Ramp: A Shape-Aware ASCII Renderer in Three.js]() Original publisher: [Read original article]() Author: Edoardo Lunardi Published: 2026-09-04T15:01:38Z Content type: tutorial Language: en Sources: [Codrops]() Topics: [shape-aware rendering](), [ASCII art shader](), [Three.js shaders](), [Three.js custom shaders]() Tags: [3d](), [ascii](), [ascii-art-shader](), [ascii-dithering](), [ascii-shader](), [atlas](), [browser-based-ascii-renderer](), [creative-coding-three-js](), [custom-element-webgl](), [draggable](), [draggable-3d-logo](), [glsl-ascii-shader](), [glyph-atlas-rendering](), [glyph-matching-algorithm](), [gpu](), [gpu-ascii-rendering](), [gpu-glyph-search](), [interactive-ascii-art](), [luminance-ramp-alternative](), [procedural-ascii-art](), [real-time-ascii-rendering](), [shaders](), [shape-aware-ascii-renderer](), [shape-aware-rendering](), [three-js](), [three-js-ascii-renderer](), [three-js-custom-shaders](), [three-js-shader-tutorial](), [three-js-webgl](), [tutorials](), [webgl](), [webgl-ascii-art](), [webgl-post-processing](), [webgl-shader-tutorial]() ### AI overview A Three.js ASCII renderer improves on luminance-only glyph selection by sampling each character cell's shape and matching it against printable glyphs on the GPU. ### Source excerpt The Codrops mark, rebuilt as a draggable solid and printed in ASCII on the GPU, where every character cell searches 95 glyphs for its own. ## ASCII smuggling crosses over from AI prompt injection to phishing evasion DevFeed: [ASCII smuggling crosses over from AI prompt injection to phishing evasion]() Original publisher: [Read original article]() Author: Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft Published: 2026-09-03T16:00:00Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [ASCII](), [Machine Learning, Security Attacks](), [Language models](), [telemetry](), [Microsoft]() Tags: [ai-models](), [ai-security](), [ascii](), [microsoft](), [phishing](), [security](), [social-engineering](), [telemetry]() ### AI overview Microsoft describes a phishing campaign that uses invisible Unicode tag characters to split lure words and evade email parsing. The technique, known as ASCII smuggling, was previously prominent in AI prompt-injection research because models can process hidden text that people cannot see. ### Source excerpt Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. The post ASCII smuggling crosses over from AI prompt injection to phishing evasion appeared first on Microsoft Security Blog. ## Chat SDK now supports XChat DevFeed: [Chat SDK now supports XChat]() Original publisher: [Read original article]() Author: Ben Sabic Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [SDKs](), [Bot](), [Encryption](), [Streaming](), [ASCII](), [Markdown]() Tags: [ascii](), [bots](), [documentation](), [encryption](), [markdown](), [sdk](), [streaming]() ### AI overview Chat SDK now supports XChat through a new adapter that enables bots to conduct end-to-end encrypted one-to-one and group conversations. The adapter manages encryption, keys, and signature verification, while providing fallbacks for XChat's lack of Markdown rendering and supporting streaming through message edits. ### Source excerpt You can now build bots that hold end-to-end encrypted 1:1 and group conversations on XChat with the new XChat adapter for Chat SDK. The adapter handles all encryption, key management, and signature verification automatically. Bots can also message users first, as long as the user has encrypted chat set up and follows the bot. XChat has no markdown rendering, so the adapter falls back automatically: URLs and @mentions render as tappable links, tables as ASCII code blocks, and cards as text with a link preview. Streaming works through message edits. Read the XChat adapter documentation to get started. Read more ## RFC 9850: The SSLKEYLOGFILE Format for TLS DevFeed: [RFC 9850: The SSLKEYLOGFILE Format for TLS]() Original publisher: [Read original article]() Published: 2026-07-16T00:00:00Z Content type: article Language: fr Sources: [Blog de Stéphane Bortzmeyer]() Topics: [TLS (Transport Layer Security)](), [Internet Engineering Task Force (IETF)](), [ASCII](), [SSL]() Tags: [ascii](), [communication](), [format](), [rfc](), [ssl](), [tls](), [wireshark]() ### AI overview This French article explains RFC 9850, which specifies the SSLKEYLOGFILE format for exporting TLS session secrets so packet analyzers such as Wireshark can decrypt and inspect network communication. It notes that the legacy name refers to SSL even though the format is used with TLS, and describes the file's text-based structure. ### Source excerpt Déboguer une application réseau qui utilise le chiffrement est difficile. Le but du chiffrement est justement d'empêcher un tiers (par exemple l'analyseur de paquets) de regarder ce qui se passe. Une approche possible est de demander gentiment à l'application d'exporter ses clés de chiffrement dans un fichier que l'analyseur pourra importer pour ensuite déchiffrer la communication. Ce RFC décrit le format le plus répandu pour exporter ses clés, connu sous le nom de SSLKEYLOGFILE et très commun aujourd'hui. ## Vercel Open Source Program: Spring 2026 cohort DevFeed: [Vercel Open Source Program: Spring 2026 cohort]() Original publisher: [Read original article]() Author: Amy Egan Published: 2026-06-29T13:00:00Z Content type: news Language: en Sources: [Vercel News]() Topics: [Open Source](), [Vercel](), [Maintainers](), [Next.js](), [React](), [Model Context Protocol (MCP)](), [TypeScript](), [MCP](), [Filesystems](), [CSS](), [Framer Motion](), [SVG]() Tags: [2026](), [ascii](), [browser](), [maintainers](), [mcp](), [model-context-protocol](), [next-js](), [open-source](), [react](), [real-time](), [typescript](), [vercel]() ### AI overview Vercel announces the Spring 2026 cohort of its Open Source Program, providing selected maintainers with platform credits, third-party service credits, and guidance. The cohort includes projects for ASCII video rendering, React UI components, MCP server development, animated icons, design systems, and abstract syntax tree exploration. ### Source excerpt The world runs on open source software. The frameworks, libraries, and tools we rely on are made possible by communities that share ideas and build in the open. At Vercel, we want to help those communities thrive. That's why we run the Vercel Open Source Program: a developer initiative that gives maintainers the resources and support they need to keep shipping and growing their projects. Four times a year, we welcome a new cohort of open source projects into the program. Maintainers receive $3,600 in Vercel platform credits, a starter pack with credits from third-party services, and guidance from Vercel and the community. Today, we welcome a new cohort into the program. Spring 2026 cohortASCII Studio A browser-based tool that converts video frames in real time into precise ASCII representations using an optimized rendering pipeline. Users can adjust density, contrast, and character sets to produce customized ASCII animations. Creator: Vansh Nagar View the project View GitHub repository Sync UI A free, open-source React UI library offering 125+ animated components, 13+ pre-built blocks, and 3 premium templates. Built with Material UI and Motion (motion/react), designed for design engineers building landing pages and Next.js projects. Creator: Abhi Varde View the project View GitHub repository xmcp A TypeScript framework for building and deploying MCP (Model Context Protocol) servers, featuring file-system routing, hot reloading, middleware support, and flexible deployment options including zero-config Vercel support. Creator: Valentina Bearzotti View the project View GitHub repository Componentry An open-source collection of animated, interactive React UI components styled with Tailwind CSS and Framer Motion, designed to be copied and pasted into apps rather than installed as a dependency. Creator: Harsh Jadhav View the project View GitHub repository AnimateIcons A library of 281 animated SVG icons for React, built on motion/react with hover and imperative triggers p ## Matching JSON and whitespace characters efficiently on ARM processors DevFeed: [Matching JSON and whitespace characters efficiently on ARM processors]() Original publisher: [Read original article]() Author: Daniel Lemire Published: 2026-04-19T20:41:04Z Content type: article Language: en Sources: [Daniel Lemire]() Topics: [Arm](), [JSON](), [Parsing]() Tags: [amd](), [architecture](), [arm](), [ascii](), [avx](), [intel](), [json](), [parsing](), [processors]() ### AI overview The article examines vectorized classification for matching ASCII whitespace and structural JSON characters. It describes a branch-free NEON approach and discusses newer ARM Scalable Vector Extension instructions as an alternative on recent ARM processors. ### Source excerpt Consider the following problem. Given a string, you must match all of the ASCII white-space characters (\t, \n, \r, and the space) and some characters important in JSON (:, ,, [, ], {, }). JSON is a text-based data format used for web services. A toy JSON document looks as follows. { "name": "Alice", "age": ... Continue reading The fastest way to match characters on ARM processors? ## Querying DateTimes in ClickHouse DevFeed: [Querying DateTimes in ClickHouse]() Original publisher: [Read original article]() Author: Mark Needham Published: 2026-03-20T00:00:00Z Content type: tutorial Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [datasets](), [data](), [Database]() Tags: [analysis](), [ascii](), [clickhouse](), [data](), [how-to](), [speed]() ### AI overview A practical guide to querying date and datetime columns in ClickHouse using the New York City taxi dataset. It covers hourly and 15-minute bucketing, filtering by date and time of day, calculating journey durations and average speed, and visualizing relative values with an ASCII bar chart. ### Source excerpt How to query datetime columns in ClickHouse - from hourly bucketing to rush hour analysis with real taxi data. ## You can use newline characters in URLs DevFeed: [You can use newline characters in URLs]() Original publisher: [Read original article]() Author: Daniel Lemire Published: 2026-02-28T19:21:39Z Content type: tutorial Language: en Sources: [Daniel Lemire]() Topics: [Web](), [browsers](), [HTML](), [SVG](), [Parsing](), [data]() Tags: [ascii](), [browsers](), [code](), [graphics](), [html](), [parsing](), [svg](), [web](), [xml]() ### AI overview This article explains that HTML URLs can contain newline and tab characters in practice because the URL parser reports a validation error but removes those characters and continues. It also describes how ASCII whitespace is handled in data URLs, including base64-encoded PNG and SVG images. ### Source excerpt We locate web content using special addresses called URLs. We are all familiar with addresses like https://google.com. Sometimes, URLs can get long and they can become difficult to read. Thus, we might be tempted to format them like so in HTML using newline and tab characters, like so: my blog post It will ... Continue reading You can use newline characters in URLs ## Notes on clarifying man pages DevFeed: [Notes on clarifying man pages]() Original publisher: [Read original article]() Author: Julia Evans Published: 2026-02-18T00:00:00Z Content type: opinion Language: en Sources: [Julia Evans]() Topics: [Documentation](), [Cheat sheet](), [Tool](), [ASCII](), [Git](), [ls](), [Perl]() Tags: [ascii](), [cheat-sheet](), [documentation](), [examples](), [git](), [notes]() ### AI overview The article explores ways to make Unix man pages easier to navigate and more useful. It considers embedding concise cheat sheets, using terse SYNOPSIS sections with OPTIONS SUMMARY sections, grouping options by category, providing condensed ASCII layouts, and including practical examples. ### Source excerpt Hello! After spending some time working on the Git man pages last year, I've been thinking a little more about what makes a good man page. I've spent a lot of time writing cheat sheets for tools (tcpdump, git, dig, etc) which have a man page as their primary documentation. This is because I often find the man pages hard to navigate to get the information I want. Lately I've wondering - could the man page itself have an amazing cheat sheet in it? What might make a man page easier to use? I'm still very early in thinking about this but I wanted to write down some quick notes. I asked some people on Mastodon for their favourite man pages, and here are some examples of interesting things I saw on those man pages. an OPTIONS SUMMARY If you've read a lot of man pages you've probably seen something like this in the SYNOPSIS: once you're listing almost the entire alphabet, it's hard ls [-@ABCFGHILOPRSTUWabcdefghiklmnopqrstuvwxy1%,] grep [-abcdDEFGHhIiJLlMmnOopqRSsUVvwXxZz] The rsync man page has a solution I've never seen before: it keeps its SYNOPSIS very terse, like this: Local: rsync [OPTION...] SRC... [DEST] and then has an "OPTIONS SUMMARY" section with a 1-line summary of each option, like this: --verbose, -v increase verbosity --info=FLAGS fine-grained informational verbosity --debug=FLAGS fine-grained debug verbosity --stderr=e|a|c change stderr output mode (default: errors) --quiet, -q suppress non-error messages --no-motd suppress daemon-mode MOTD Then later there's the usual OPTIONS section with a full description of each option. an OPTIONS section organized by category The strace man page organizes its options by category (like "General", "Startup", "Tracing", and "Filtering", "Output Format") instead of alphabetically. As an experiment I tried to take the grep man page and make an "OPTIONS SUMMARY" section grouped by category, you can see the results here. I'm not sure what I think of the results but it was a fun exercise. When I was writing that I was thinking ## Analysis of PPPP "encryption" DevFeed: [Analysis of PPPP "encryption"]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2026-01-05T15:50:53Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Encryption](), [Cryptography](), [Network](), [Protocol (disambiguation)](), [Algorithms]() Tags: [analysis](), [ascii](), [cryptanalysis](), [encryption](), [lan](), [network](), [pull-request](), [theory]() ### AI overview This analysis examines weaknesses in PPPP "encryption." It explains that app keys are reduced to a four-byte effective key and that the scheme is vulnerable to known-plaintext attacks. For LAN camera discovery when the app and traffic are unknown, the article describes sending all possible encrypted search packets, with at most 157,092 ciphertexts, and notes a pull request to update the device-detection script. ### Source excerpt My first article on the PPPP protocol already said everything there was to say about PPPP "encryption": Keys are static and usually trivial to extract from the app. No matter how long the original key, it is mapped to an effective key that's merely four bytes long. The "encryption" is extremely susceptible to known-plaintext attacks, usually allowing reconstruction of the effective key from a single encrypted packet. So this thing is completely broken, why look any further? There is at least one situation where you don't know the app being used so you cannot extract the key and you don't have any traffic to analyze either. It's when you are trying to scan your local network for potential hidden cameras. This script will currently only work for cameras using plaintext communication. Other cameras expect a properly encrypted "LAN search" packet and will ignore everything else. How can this be solved without listing all possible keys in the script? By sending all possible ciphertexts of course! TL;DR: What would be completely ridiculous with any reasonable protocol turned out to be quite possible with PPPP. There are at most 157,092 ways in which a "LAN search" packet can be encrypted. I've opened a pull request to have the PPPP device detection script adjusted. Note: Cryptanalysis isn't my topic, I am by no means an expert here. These issues are simply too obvious. Contents Mapping keys to effective keys Redundancies within the effective key ASCII to the rescue How large is n? How many ciphertexts is that? Understanding the response Mapping keys to effective keys The key which is specified as part of the app's "init string" is not being used for encryption directly. Nor is it being fed into any of the established key stretching algorithms. Instead, a key represented by the byte sequence b1,b2,...,bnb_1, b_2, \ldots, b_n is mapped to four bytes k1,k2,k3,k4k_1, k_2, k_3, k_4 that become the effective key. These bytes are calculated as follows (⌊x⌋\lfloor x \rfloor means r ## Solving the "Impossible" in ClickHouse: Advent of Code 2025 DevFeed: [Solving the "Impossible" in ClickHouse: Advent of Code 2025]() Original publisher: [Read original article]() Author: Zach Naimon Published: 2025-12-31T00:00:00Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [Advent of Code](), [C++](), [Go Language](), [Bash]() Tags: [algorithms](), [ascii](), [clickhouse](), [database](), [sql]() ### AI overview The article describes solving Advent of Code 2025 puzzles with a single pure ClickHouse SQL query. It outlines constraints including raw-input parsing and no UDFs or intermediate tables. ### Source excerpt At ClickHouse, we don't like the word "impossible." We believe that with the right tools, everything is a data problem. To prove it, we decided to complete the 2025 Advent of Code unconventionally: using pure ClickHouse SQL. ## Some Fun Software Facts DevFeed: [Some Fun Software Facts]() Original publisher: [Read original article]() Author: Hillel Wayne Published: 2025-12-10T18:45:37Z Content type: article Language: en Sources: [Newsletter feed for Hillel Wayne's Newsletter]() Topics: [Software](), [Algorithms, Complexity](), [Simulation](), [ASCII](), [Vim](), [Cloudflare]() Tags: [algorithms](), [ascii](), [cloudflare](), [simulation](), [software](), [vim]() ### AI overview A year-end newsletter shares miscellaneous software facts, including a Game of Life implementation of Tetris, leap-second handling, Vim's computational capabilities, ASCII history, impractical faster algorithms, Cloudflare's lava-lamp randomness, and historical sorting-algorithm details. ### Source excerpt Last newsletter of the year! First some news on Logic for Programmers. Thanks to everyone who donated to the feedchicago charity drive! In total we raised $2250 for Chicago food banks. Proof here. If you missed buying Logic for Programmers real cheap in the charity drive, you can still get it for $10 off with the holiday code hannukah-presents. This will last from now until the end of the year. After that, I'll be raising the price from $25 to $30. Anyway, to make this more than just some record keeping, let's close out with something light. I'm one of those people who loves hearing "fun facts" about stuff. So here's some random fun facts I accumulated about software over the years: In 2017, a team of eight+ programmers successfully implemented Tetris as a game of life simulation. The GoL grid had an area of 30 trillion pixels and implemented a full programmable CPU as part of the project. Computer systems have to deal with leap seconds in order to keep UTC (where one day is 86,400 seconds) in sync with UT1 (where one day is exactly one full earth rotation). The people in charge recently passed a resolution to abolish the leap second by 2035, letting UTC and UT1 slowly drift out of sync. Vim is Turing complete. The backslash character basically didn't exist in writing before 1930, and was only added to ASCII so mathematicians (and ALGOLists) could write /\ and \/. It's popular use in computing stems entirely from being a useless key on the keyboard. Galactic Algorithms are algorithms that are theoretically faster than algorithms we use, but only at scales that make them impractical. For example, matrix multiplication of NxN is normally O(N^2.81). The Coppersmith Winograd algorithm is O(N^2.38), but is so complex that it's vastly slower for even 10,000 x 10,000 matrices. It's still interesting in advancing our mathematical understanding of algorithms! Cloudflare generates random numbers by, in part, taking pictures of 100 lava lamps. Mergesort is older than bubblesor ## How we made JSON.stringify more than twice as fast DevFeed: [How we made JSON.stringify more than twice as fast]() Original publisher: [Read original article]() Author: Patrick Thier Published: 2025-08-04T00:00:00Z Content type: article Language: en Sources: [V8]() Topics: [modern web development](), [Web Development]() Tags: [ascii](), [data](), [internals](), [javascript](), [json](), [optimization](), [performance]() ### AI overview The article explains V8 optimizations that make JSON.stringify more than twice as fast. It covers a side-effect-free iterative fast path and specialized handling for one-byte and two-byte strings. ### Source excerpt JSON.stringify is a core JavaScript function for serializing data. Its performance directly affects common operations across the web, from serializing data for a network request to saving data to localStorage. A faster JSON.stringify translates to quicker page interactions and more responsive applications. That's why we're excited to share that a recent engineering effort has made JSON.stringify in V8 more than twice as fast. This post breaks down the technical optimizations that made this improvement possible. A Side-Effect-Free Fast Path # The foundation of this optimization is a new fast path built on a simple premise: if we can guarantee that serializing an object will not trigger any side effects, we can use a much faster, specialized implementation. A "side effect" in this context is anything that breaks the simple, streamlined traversal of an object. This includes not only the obvious cases like executing user-defined code during serialization, but also more subtle internal operations that might trigger a garbage collection cycle. For more details on what exactly can cause side effects and how you can avoid them, see Limitations. As long as V8 can determine that serialization will be free from these effects, it can stay on this highly-optimized path. This allows it to bypass many expensive checks and defensive logic required by the general-purpose serializer, resulting in a significant speedup for the most common types of JavaScript objects that represent plain data. Furthermore, the new fast path is iterative, in contrast to the recursive general-purpose serializer. This architectural choice not only eliminates the need for stack overflow checks and allows us to quickly resume after encoding changes, but also allows developers to serialize significantly deeper nested object graphs than was previously possible. Handling different String Representations # Strings in V8 can be represented with either one-byte or two-byte characters. If a string contains only AS ## What's new in Astro - July 2025 DevFeed: [What's new in Astro - July 2025]() Original publisher: [Read original article]() Author: Sarah Rainsberger Published: 2025-07-31T00:00:00Z Content type: article Language: en Sources: [The Astro Blog]() Topics: [Astro](), [Artificial Intelligence](), [releases](), [Node.js](), [Netlify](), [Accessibility]() Tags: [accessibility](), [accessibility-compliance](), [ai-tools](), [ascii](), [astro](), [can](), [discord](), [documentation](), [microsoft](), [netlify](), [node-js](), [products](), [releases]() ### AI overview This July 2025 Astro ecosystem update highlights a new guide for building Astro with AI tools, Astro's appearance at ViteConf 2025, and recognition in the Stack Overflow Developer Survey. It summarizes Astro 5.11, Astro 5.12, and Starlight 0.35 releases, showcases Astro adopters and community activity, and features several websites built with Astro. ### Source excerpt July 2025 - Build Astro with AI Tools, "The Future of Astro" at ViteConf 2025, and more! ## Drag and Pwnd: Leverage ASCII characters to exploit VS Code DevFeed: [Drag and Pwnd: Leverage ASCII characters to exploit VS Code]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-04-30T12:37:11Z Content type: tutorial Language: en Sources: [PortSwigger Research]() Topics: [Vulnerabilities]() Tags: [ascii](), [bash](), [javascript](), [vs-code](), [vulnerabilities]() ### AI overview The article explains how ASCII control characters can be abused through VS Code terminal handling to cause command injection behavior. ### Source excerpt Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do. In this post, I'll dive into the forgotten mechanics ## Easy way to upload, transform and deliver files and images (Sponsored) DevFeed: [Easy way to upload, transform and deliver files and images (Sponsored)]() Original publisher: [Read original article]() Author: David Walsh Published: 2025-03-24T22:58:30Z Content type: article Language: en Sources: [David Walsh]() Topics: [file](), [Image](), [Developer experience](), [Back end](), [Python]() Tags: [ascii](), [back-end](), [conversion](), [documentation](), [files](), [gif](), [images](), [python](), [qr-code](), [sponsored](), [uncategorized]() ### AI overview This sponsored developer article presents Filestack as a service for uploading, transforming, and delivering files and images. It describes a file-uploading interface, integrations with services such as Google Drive, Dropbox, GitHub, Facebook, and Instagram, a Python library for back-end uploads, documentation, and transformations for images, videos, and documents. ### Source excerpt Managing media is a really difficult task if you try to do all of it yourself, especially if the media comes from other sources. The file can be submitted in any state and size, but what if you need something really specific? You can code it all yourself or you can use an awesome service [...] The post Easy way to upload, transform and deliver files and images (Sponsored) appeared first on David Walsh Blog. ## Bypassing character blocklists with unicode overflows DevFeed: [Bypassing character blocklists with unicode overflows]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-01-28T13:58:28Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [ASCII](), [JavaScript](), [Bug Bounty]() Tags: [2025](), [ascii](), [attacks](), [bug-bounty](), [javascript](), [published]() ### AI overview The article explains how Unicode codepoint truncation, or Unicode overflow, can bypass character blocklists by producing specific ASCII characters when values exceed byte or JavaScript codepoint limits. It describes active use of these truncation attacks by bug bounty hunters and related tooling added to ActiveScan++, Hackvertor, and Shazzer. ### Source excerpt Unicode codepoint truncation - also called a Unicode overflow attack - happens when a server tries to store a Unicode character in a single byte. Because the maximum value of a byte is 255, an overflo ## macOS Keyboard Shortcut Localization DevFeed: [macOS Keyboard Shortcut Localization]() Original publisher: [Read original article]() Author: Conrad Irwin Published: 2024-11-08T00:00:00Z Content type: article Language: en Sources: [Zed Industries - Blog]() Topics: [Localization (l10n)](), [macOS](), [ASCII](), [Vim]() Tags: [ascii](), [japanese](), [keyboard](), [layout](), [macos](), [shortcuts](), [vim]() ### AI overview Zed 0.162 changes keyboard shortcut handling so shortcuts work across Cyrillic, Japanese IME-based, and non-US Latin keyboard layouts. The update changes modifier requirements, coordinates shortcut processing with IMEs, and uses macOS Latin-based layouts for non-Latin keyboards. ### Source excerpt How macOS shortcuts work on different layouts. ## Homographic Spoofing: a new Ruby toolkit DevFeed: [Homographic Spoofing: a new Ruby toolkit]() Original publisher: [Read original article]() Author: Jacopo Beschi Published: 2024-06-25T17:00:00Z Content type: tutorial Language: en Sources: [37signals Dev]() Topics: [spoofing](), [Ruby](), [Security](), [Open Source](), [email](), [domain](), [ASCII]() Tags: [ascii](), [domain](), [email](), [open-source](), [phishing](), [ruby](), [security](), [spoofing]() ### AI overview This article explains homograph attacks, in which visually similar Unicode characters are used to spoof identities in domains or email. It describes browser and email-client protections using Punycode and UTS #39, then introduces an open-source Ruby gem implementing those guidelines for IDNs and email addresses. ### Source excerpt What is a homograph attack and how to protect from it with a new gem. ## Secure Java URL encoding and decoding DevFeed: [Secure Java URL encoding and decoding]() Original publisher: [Read original article]() Author: Jura Gorohovsky Published: 2023-08-14T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Programming](), [ASCII](), [Security](), [Amazon API Gateway](), [HTML](), [Routing (disambiguation)]() Tags: [acquisition](), [api](), [api-gateway](), [article](), [ascii](), [awareness](), [blog](), [code-security](), [developer](), [draftdotdev](), [engineering](), [how-to](), [html](), [java](), [programming](), [security](), [server](), [snyk-code]() ### AI overview This article explains URL encoding and decoding in Java. It describes percent-encoding characters outside the permitted URL character set, clarifies that URL encoding is not encryption, and discusses use cases such as HTML form input, external API calls, and API gateways. It also explains parsing, interoperability, and security risks caused by unencoded URLs. ### Source excerpt This article discusses Java, why URL encoding and decoding are important, and how to approach it properly. ## The C Standard Library Function isspace() Depends on Locale DevFeed: [The C Standard Library Function isspace() Depends on Locale]() Original publisher: [Read original article]() Published: 2023-06-06T13:41:23Z Content type: article Language: en Sources: [Evan Jones]() Topics: [C](), [ASCII](), [bug](), [Library]() Tags: [ascii](), [bug](), [c](), [function](), [implementation](), [library](), [locale](), [mac](), [mac-os](), [standard](), [standard-library]() ### AI overview The article explains that C's isspace() behavior depends on the active locale. In the default C locale it recognizes six ASCII whitespace characters, while other locales may also recognize Unicode whitespace. The author connects this behavior to a parsing bug involving PostgreSQL Hstore values on Mac OS X. ### Source excerpt This is a post for myself, because I wasted a lot of time understanding this bug, and I want to be able to remember it in the future. I expect close to zero others to be interested. The C standard library function isspace() returns a non-zero value (true) for the six "standard" ASCII white-space characters ('\t', '\n', '\v', '\f', '\r', ' '), and any locale-specific characters. By default, a program starts in the "C" locale, which will only return true for the six ASCII white-space characters. However, if the program changes locales, it can return true for other values. As a result, unless you really understand locales, you should use your own version of this function, or ICU4C's u_isspace() function. An implementation of isspace() for ASCII is one line: /* Returns true for the 6 ASCII white-space characters: \t \n \v \f \r ' '. */ int isspace_ascii(int c) { return c == '\t' || c == '\n' || c == '\v' || c == '\f' || c == '\r' || c == ' '; } I ran into this because On Mac OS X, Postgres switches to the system's default locale, which is something that uses UTF-8 (e.g. en_US.UTF-8, fr_CA.UTF-8, etc). In this case, isspace() returns true for Unicode white-space values, which includes 0x85 = NEL = Next Line, and 0xA0 = NBSP = No-Break Space. This caused a bug in parsing Postgres Hstore values that use Unicode. I have attempted to submit a patch to fix this (mailing list post, commitfest entry). For a program to demonstrate the behaviour on different systems, see isspace_locale on Github. ## dbdev: PostgreSQL Package Manager DevFeed: [dbdev: PostgreSQL Package Manager]() Original publisher: [Read original article]() Author: Oliver Rice; John Dalton Published: 2023-04-14T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [Package manager](), [PostgreSQL](), [SQL](), [Deployment](), [Tooling]() Tags: [ascii](), [bug-fixes](), [deployment](), [ecosystem](), [features](), [postgresql](), [sql](), [versioning]() ### AI overview Supabase is publicly previewing dbdev, a PostgreSQL package manager with a read-only registry initially populated with example packages. It is designed to support publishing, discovering, and repeatedly deploying SQL libraries and applications, with initial compatibility for new Supabase projects and PostgreSQL instances. ### Source excerpt We're publicly previewing dbdev, a PostgreSQL package manager. [Next page]()