Snowmen, Recruiters, and Terry Pratchett: The Web's HTTP Header Junk Drawer
I crawled the top 1,000 sites and read their response headers. Browser fossils, CDN breadcrumbs, leaked codenames, a snowman, and a tribute to Terry Pratchett.
JonLuca's Blog
Essays by JonLuca DeCaro about programming, reverse engineering, product systems, travel, and technology.
Latest posts
Smoothing the jagged frontier
AI models may bring back the ability to combine deep expertise from every field toward a single goal.
Vibecoding native apps has gotten really good
I built a fine dining tracker app using React Native, and the experience was surprisingly smooth, both from how good React Native has gotten, and how much better the models are.
Markets as the ultimate RL environment
Why financial markets are an unusually pure, brutal, and adversarial reinforcement learning environment.
SkyCards, ground truth: reverse‑engineering a flight‑spotting game
Automating SkyCards, the FlightRadar24 plane‑spotting game
Finding cool custom vanity CA license plates
Reverse engineering the California DMV's license plate availability checker to find cool custom plates.
Optimizing AI Model Load Times
Improving PyTorch model loading performance using memory-based filesystems and distributed storage in Kubernetes.
Noticing when an app is only hosted in us-east-1
Using latency measurements to infer when a globally used application is served only from us-east-1.
Exploring how Magic Link works
Examining passwordless Magic Link authentication and the implementation exposed in its onboarding flow.
Semantic search in iMessage, iMessage Wrapped, and AI conversations
Building semantic search and conversation analysis for an exported iMessage archive.
Getting a vanity phone number with 4 repeating digits
Automating Verizon number searches to find rare phone numbers with repeating digits.
Web3, Free Candy, and exploits galore
Finding and disclosing vulnerabilities in Metaplex Candy Machine NFT minting contracts.
Snapshotting memory to scrape encrypted network requests
Using browser heap snapshots to recover structured data after network responses have been encrypted.
JavaScript gotchas
A tour of surprising JavaScript behavior involving functions, coercion, arrays, and language edges.
Writing fast async HTTP requests in Python
Controlling concurrency with asyncio and semaphores to make large batches of Python HTTP requests fast.
A boilerplate for SSR'd Vite, React 17, and TypeScript 4.3
A minimal server-rendered starter setup for Vite, React 17, and TypeScript 4.3.
How to redeem $2000 of HNS for being a FOSS developer
Claiming a Handshake developer airdrop and turning an unexpected token allocation into cash.
Fun VPN tricks due to Apple owning all of 17.X.X.X
How Apple's large address allocation can interact unexpectedly with VPN routing and airplane Wi-Fi.
What is tax loss harvesting?
An accessible explanation of tax-loss harvesting, wash sales, and portfolio tradeoffs.
Zoh-no Zogo: Manufacturing pineapples (and cash) with Burp Suite
Reverse-engineering Zogo reward redemption requests and finding a profitable validation flaw.
Setting up Matomo in such a way to bypass adblockers
Configuring self-hosted Matomo analytics behind custom routes and POST tracking.
Unlimited free WiFi on flights with T-Mobile
Investigating an airline Wi-Fi authentication flow that granted T-Mobile connectivity.
Habitat 2020 - Coliving during COVID
A look back at living in a coliving community during the first year of COVID-19.
American Airlines is an e-currency company that happens to own some planes
Examining how airline loyalty currencies shape American Airlines as much as flying passengers does.
Thoughts on user growth and product
Reflections on product engineering, growth work, experimentation, and building for user behavior.
Reversing Lyft's ride history API to analyze 6 years worth of rides
Reverse-engineering Lyft's ride-history APIs to analyze six years of personal trips.
How the Nintendo Switch prevents downgrades by irreparably blowing its own fuses
How the Nintendo Switch uses irreversible hardware fuses to prevent firmware downgrades.
Promise.all vs Promise.allSettled in JavaScript
Comparing Promise.all and Promise.allSettled for concurrent JavaScript workflows and failures.
Goodreads has a time to first byte of nearly 5 seconds
Investigating why Goodreads pages responded slowly and what its requests revealed.
Re-enabling context actions on websites
Restoring paste, context menu, and selection actions on websites that disable them.
How much space would it take to store every word ever said?
Estimating the storage required to preserve every word humans have ever spoken.
The hidden value of automation in programming comes from saving mental context switches
Why small automations are valuable because they preserve focus, not merely because they save keystrokes.
2019 Travel in Review - 52,848 miles, 137 hours, and 40 flights
A year of travel summarized through flights, mileage, routing, and memorable stops.
Flight stats, entertainment, and trying to crack widevine
Investigating onboard flight entertainment APIs, flight telemetry, and Widevine-protected media.
Email authentication: SPF, DKIM and DMARC out in the wild
Studying SPF, DKIM, and DMARC adoption and behavior across real-world email domains.
Reversing private APIs, Safeway, and not-so-extreme couponing
Reverse-engineering Safeway's coupon APIs to automate adding digital offers to an account.
Ember.js, Dr. Carvers Shave Butter, and disappearing products
Exploring an Ember application's data layer to find discontinued Dollar Shave Club products.
An analysis of activity on /r/churning
Scraping and analyzing activity patterns in the credit-card churning subreddit.
Compensation in 2019 new grad tech offers
Analyzing compensation packages from 2019 new-graduate technology job offers.
Useful shell aliases and functions
A collection of practical shell aliases and functions for faster daily command-line work.
What's better - a broken clock or a clock that's always 5 minutes off?
Using probability to compare a broken clock with one that is consistently five minutes slow.
Around the world in business class: ANA RTW in J
Planning and taking an ANA round-the-world business-class award itinerary across Asia and Europe.
Identifying non-default global variables in JavaScript
Finding application state and implementation clues by comparing unexpected browser global variables.
Experiments, growth engineering, and the perils of not disguising your API routes: Part 1
Inspecting exposed experiment APIs to understand how growth teams test product changes in production.
Obfuscated javascript, scam emails, and American Express
Reverse-engineering an obfuscated American Express phishing campaign from email to exfiltration endpoint.
Class schedules, a cease and desist from Viacom, and accidental monetization
How a student scheduling project drew a cease and desist and unexpectedly started earning money.
Uber, statistics, and a chrome extension
Building a Chrome extension to retrieve and analyze personal Uber trip history.
Ryanair, Hamiltonian Cycles, and using graph theory to find cheap flights
Using graph theory and Ryanair route data to find cheap multi-city flight loops through Europe.
An introduction to credit card churning
An introduction to credit card rewards, sign-up bonuses, and the mechanics of churning.
Making high-fidelity audio sound like it came through the phone
Exploring bandwidth, filtering, and compression to reproduce the distinctive sound of phone calls.