Habr•September 13, 2026•🇷🇺Translated from Russian

rkn-block-checker 0.6.0 Adds Local Web UI and Reduces False Positives on Anti-Bot Responses

The open-source utility rkn-block-checker has been updated to version 0.6.0, bringing both improved detection accuracy and a new local web interface.

Earlier releases contained a simple list of Russian-language markers used by ISP block pages, including phrases such as “доступ ограничен” and “решению роскомнадзора”. When a target returned HTTP 429 with the text “Доступ с вашего IP временно ограничен”, the tool treated the response as a Roskomnadzor stub and reported a high-confidence block. The issue surfaced most clearly on Avito, whose anti-bot system issues 429 responses to requests lacking proper cookies even when the User-Agent mimics Chrome.

Distinguishing censorship from rate limiting

The fix adds an explicit status-code check inside core.py. If the body matches a known stub marker but the status is 429, the verdict is set to DOWN with LOW confidence and a note explaining the likely anti-bot cause. Only responses that match both the textual marker and an expected block status (200 or 451) receive the HTTP_STUB verdict with HIGH confidence.

Lightweight local Web UI

Although the project began as a pure CLI tool, users requested an easier way to examine individual checks. The new interface is served by Python’s built-in ThreadingHTTPServer and a single static HTML file containing vanilla JavaScript and CSS. No external dependencies are required. Users start the server with the command rkn-check startweb or rkn-check startweb --port 8080; the service listens on 127.0.0.1:7777 by default.

Scan results are delivered as a newline-delimited JSON stream. The browser reads the ReadableStream chunk by chunk, parses each line, and immediately updates the corresponding table row. This approach avoids both WebSocket complexity and repeated polling while still providing live feedback.

Release highlights

  • Full local Web UI with charts, Russian/English localization, and on-the-fly addition of custom domains
  • Improved filtering of anti-bot false positives (HTTP 429)
  • One-click JSON report export directly from the browser
  • Zero additional dependencies beyond a standard Python installation

The complete source code remains available under the MIT license on GitHub, and the package can be installed or upgraded via pip install rkn-block-checker.

Related articles

AntiMalware•Privacy & Surveillance

WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References

Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.

Habr•Privacy & Surveillance

WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws

Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.

Habr•Privacy & Surveillance

Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305

A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.

Habr•Privacy & Surveillance

LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem

LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.