Not yet, but very close...

One time my manager was on my case about a client integration delay. The issue wasn’t on our side, the partner we were integrating with hadn’t properly completed their error handling.

I told him we needed to wait until they finalized it so we could correctly map response codes and avoid processing issues. He got impatient and escalated. He called the partner’s manager, who then looped in their tech manager. The three of them agreed that anything not explicitly marked as “success” should be treated as failed and retried up to three times if failure continues.

He came back and relayed the decision to me.

I raised concerns again. Since their system was still in active development, I warned that if they returned unexpected statuses, we could run into serious problems.

The response was the classic: I’ve spoken to their manager and tech lead. Implement it as discussed.

He even looped in CTO and CEO in the email to shift delay blame.

So ...

Not Successful → wait 10 seconds → retry

Repeat if not successful → stop after attempt 3

At that point I was exhausted. I implemented it exactly as instructed because clearly my concerns weren’t being taken seriously.

Everything ran smoothly for 6 days.

Then the provider started returning HTTP 403 responses with HTML bodies instead of JSON.

The system did exactly what it was told to do.

Long story short, 228K was incorrectly consumed across about 90 customers. The provider was actually processing the transactions successfully, but they had pushed a broken update on their side. Our system interpreted the unexpected 403 responses as failures and retried, causing duplicate processing.

Saturday afternoon, I’m at home having drinks when my phone starts blowing up. Manager in full panic mode.

I log in from my home PC, pull the logs, and send him a detailed breakdown of the issue and the incorrect dispatches.

Then I forward the email thread where I had clearly outlined this exact risk including his reply telling me to execute and stop delaying and I go back to drinks...

CTO: Royally pissed.

CEO: *To manager* "Your staff seem to know something you don't"..

Manager: *crickets*

Issue was eventually fixed and provider took blame partially and losses were split..

What have you been pushed to do knowing it will backfire in case something goes wrong and it does spectacularly and you just have to sit and watch the fireworks?

And android app I launched last year just crossed KES 100k. It is an app in the virtual number selling niche. Monthly income still keeps growing and is currently at KES 30K and costa around 5k for infra . It just pays basic bills for now. I have never done any marketing for it. I just took advantage of a popular keyword.

Rate my setup

A few months ago, I moved into a new area and was desperate for an internet connection.

There was a public WiFi hotspot available — all you had to do was pay Kshs 50 via M-PESA and you’d be redirected past the captive portal to access the internet.

I paid.

But being the "hacker" I consider myself, I couldn’t help but wonder: is there a way to bypass this system?

Attempt 1: MAC Spoofing via Airmon-ng

I fired up airmon-ng to monitor the network and see which devices were generating traffic.

The plan:

• Identify active users (by packet volume).

• Deauthenticate them.

• Spoof their MAC address.

• Reconnect as them.

It worked occasionally, but was unreliable. Whenever the original user tried to reconnect, we would clash, and I’d get kicked out.

Attempt 2: DNS Tunneling with Iodine

I then remembered a tool called iodine — it tunnels IPv4 data through DNS queries.

Because most captive portals allow DNS traffic, it should work.

And it did. But it was very slow. Plus I needed a VPS to act as the iodine server, which cost more than the WiFi itself.

So I paused.

One day, while paying again, I opened Firefox DevTools and started inspecting the network tab.

I noticed all authenticated requests from the portal frontend were being sent to an external subdomain — and they were all using a Bearer token in the header:

Authorization: Bearer <TOKEN>

That token caught my eye. It wasn’t being dynamically generated. Could it be hardcoded?

Here is a screenshot of one network request

I switched to the Debugger tab in Firefox DevTools and:

1. Opened the Api.js files from the static/js folder (that name Api.js attracted me)

2. Looked at the first few lines of code and saw:

export const BASE_URL =JSON.parse(process.env.REACT_APP_API_URL).BASE_URL;
export const TOKEN = JSON.parse(process.env.REACT_APP_API_URL).TOKEN
export const ENCKEY=JSON.parse(process.env.REACT_APP_API_URL).ENCKEY

3. Placed a breakpoint at the line:

    export const TOKEN = JSON.parse(process.env.REACT_APP_API_URL).TOKEN;

4. Refreshed the page. The breakpoint hit instantly.

5. And there it was: the token was hardcoded into the frontend.

Here’s the exact view from Firefox Debugger

Even worse — the token belonged to an admin account

With That Token, I Could:

• List all MAC addresses currently subscribed

• Create subscriptions with my MAC address for free

• Perform other admin-level actions through their API

The Ethical Path

Since I earn a living identifying security flaws, I wrote them a detailed report vial email.

They invited me to their headquarters to explain further. I was a bit skeptical (you know... Subarus), so I tagged along a friend just in case.

The dev team was actually great — we had a productive sit-down, I helped them understand the issues and how to patch them.

Before I left, they thanked me with a small token of appreciation.

Whether they fix the issue or not, I know I did my part...

Takeaways:

• Never hardcode secrets or tokens in your frontend code

• Never assume users won’t look under the hood

• Always use proper role-based access controls

Anyways if you are building software and want a second pair of eyes to spot issues before a hacker does...I am available for security reviews, API audits and pen testing.

Happy coding!

2 laptops, 2 computers

Oraimo electric table

Let me know what you think. Here's short story of myself: So last week I attended 2 interviews(same company), ubered both times to the location. The location was okay, they guys there looked nice to work with. The HR guy hit me with the "here we are like family". I could see myself working this job. He calls over the manager. The manager approves, we're all sh*ts and giggles then he hits me with the salary budget and I'm down right disappointed.

30gs for a mid senior role made my heart sunk. Yk the feeling you get when you're like damn damn damn. Anywho, had to reject that offer with my 6yrs XP niendelee hunting. Is the economy that bad ama people just be low balling people for fun? PS: looking for leads, type at 60wpm, will code for food😂😂

This year i am actually spending my money on things that give back to me. Macbook pro M1 16 gigs ram,an office chair and a fundi made me this desk. Hakuna excuse this year buana.

My partner and I got into the onion business thinking it was simple trade.

Buy from the farm.

Transport to Marikiti.

Sell at a margin.

Repeat.

The reality hit fast.

First lesson: Quality determines turnover.

When we had clean, properly sorted onions, we sold out in one day. It did not matter whether the stock was Kenyan or Tanzanian.

Second lesson: Know your numbers before you celebrate margins.

Kenyan onions at the farm cost between KES 35 and 50 per kg. In town, you sell between KES 55 and 70 per kg depending on your expenses.

Tanzanian onions reach around KES 58 per kg at source. In Marikiti, you sell between KES 65 and 75 per kg.

On paper it looks profitable.

Add:

Transport

Loading

Offloading

Levy

Broker cuts

Spoilage

Wastage

Profit shrinks fast.

Third lesson: The market has power players.

If you enter blind, you bleed money.

As a seller:

Count your nets daily.

Track your kilos.

Never trust verbal agreements without confirming numbers.

As a buyer:

Verify weight.

Check quality inside the net.

Do not rush because of pressure.

Fourth lesson: Not every day is equal.

Tuesday and Wednesday slow down. Demand drops. Negotiation pressure rises.

If you do not understand market rhythm, you lose timing.

TLDR ; i only uploaded the powershell output because i like it , otherwise , the script automatically generates a beautiful web page

Not everyone buys new. Some of us go the refurbished route, and the experience at the repair shop is always the same — the seller quickly runs powercfg /batteryreport, opens the webcam, and says "see, it works."

But that barely scratches the surface. What about battery wear and cycle count? Is the listed RAM/CPU actually what's inside, or were the specs edited? Is the disk healthy? Is Windows even activated? Good luck checking all of that under pressure in a shop.

So I built LaptopInspector — a single .bat file you drop on a flash drive. Plug it in, double-click, and it runs 20+ weighted checks across the entire machine:

• Real hardware specs — CPU, RAM, GPU, serial number (pulled from WMI, not editable system dialogs)

• Battery deep-dive — wear level, design vs. actual capacity, cycle count, chemistry

• Storage health — S.M.A.R.T. status, disk type (SSD/HDD), free space

• Display — resolution, refresh rate, GPU driver version

• Security — Windows activation, antivirus, firewall, BitLocker, TPM version

• Peripherals — webcam, Bluetooth, audio, USB device detection

• Performance — running processes, startup bloat, top RAM consumers

• System events — critical/error events from the last 48 hours

• Temperature — thermal reading if available

• Speaker test — plays a quick beep sequence so you can verify audio output

It scores the laptop 0–100 using a weighted system (battery and storage issues weigh more than a missing Bluetooth adapter, for example) and gives you a clear PASS / WARNING / FAIL verdict.

At the end it generates a styled HTML report you can keep, plus TXT and CSV exports. The CSV appends to a history file, so if you're shopping multiple laptops you can compare them later.

No install. No admin required. No internet needed. Just a flash drive.

GitHub: https://github.com/bradleymaina/hwcheck.git

Star it if you find it useful — and PRs/suggestions are very welcome. 🙏

Mnaona aje wadau??

Wantam, I had a lightbulb moment 1 month ago and finally I am shipping something I'm genuinely excited about.

The problem: As Kenyans, we're incredibly politically engaged - we debate everything from elections to policy changes to corrrrrrupt government officials. But there's literally no way to put your money where your mouth is and actually profit from being right about political/current events outcomes.

What I built: Think fantasy sports, but for real-world events that actually matter.

"Will Ruto win 2027?"

"Will fuel prices hit KSh 200 by December?"

You buy YES/NO shares based on your conviction, and here's the cool part — you can trade them anytime before the event concludes, just like stocks. pix90.com

The vision: Turn your political instincts and news obsession into actual profit. If you're always right about election outcomes or policy changes, why not get paid for it?

Events include (but are not limited to):

Which political party will Raila Odinga support?

Will former Governor Wangamati be convicted?

Will Ruto fire any cabinet member in 2025?

Will Kate actress and Michael Mwangi breakup?

Will Vera Sidika actually buy a private jet before December 2025?

Will Flaqo buy a Mercedes GLE by September 2025?

All above are events you might be invested in one way or another — why not make money while at it?

Note: All YES and NO shares will be matched between participants. The only way the platform makes money is by a small 1% fee per trade — not from any participant’s losses.

LockIn and complete that pending task..

Congratulations 👏🎉 to him

I have two mobile apps, one mainly for Kenyan audience and the other for global audience. Started this around mid July and these are the current figures.

My best performing app is the Kenyan one. I rely on Social Media posts for Marketing, never paid for Ads.

If you’re wondering if Kenyans will pay for your app, build a product that they really need, sit down, know where and how to market it then wait.

Saw this and my drunk self almost thought I was getting into a TOR Browser😂 Karibu niseme “Disiyai pls”