|
tbf you'd think windows users are pretty fine with randomly having ads appear in something that used to just work fine without them
|
#
¿
Jan 9, 2017 17:40
|
|
|
|
| # ¿ May 17, 2024 02:33 |
|
|
anthonypants posted:the esea was the one with a secret bitcoin miner in the client so i don't feel too bad for them i remember that one iirc there story was "we put a secret bitcoin miner in the client that we only used for testing, and then a rogue employee turned it on for everyone", which didn't exactly inspire confidence
|
|
#
¿
Jan 10, 2017 03:03
|
|
|
spankmeister posted:They got what was coming to them imo if you're running mongo you have to assume all your data could just vanish at any point, so it probably wasn't even a big deal
|
|
#
¿
Jan 11, 2017 08:19
|
|
|
darkforce898 posted:How would you go about issuing valid certificates on hundreds of devices that change their public IP address daily? It's not clear to me what part of this needs a wildcard cert.
|
|
#
¿
Jan 11, 2017 19:36
|
|
|
McGlockenshire posted:why is the left one licking the right one's head? Pretty sure it's a zombie having a snack.
|
|
#
¿
Jan 18, 2017 04:51
|
|
|
Pretty sure no-one thinks this is a good fix for the issue, but if the developer thinks they've addressed it sufficiently then it makes sense to release the details so everyone else can make up their mind about it. I mean, what's the alternative? Say "we don't think your fix is good enough" followed by ... releasing the details after 90 days because the developer is happy with their solution and hasn't done anything more?
|
|
#
¿
Jan 24, 2017 00:47
|
|
|
please call things what they are, instead of giving in and using the sanitized name that the makers of that crap want you to use.
|
|
#
¿
Jan 28, 2017 05:02
|
|
|
Every hotel I've been in has had apparently the same door lock design, where the handles are connected to the latch and the electronic lock prevents the outer handle from turning. I'm not sure who would design a lock that's even physically capable of locking the inside handle. That seems like it provides zero benefit and a whole ton of extra potential liability.
|
|
#
¿
Jan 29, 2017 00:51
|
|
|
I'm still not sure why people habitually use -f when deleting stuff.
|
|
#
¿
Feb 1, 2017 08:13
|
|
|
Cybernetic Vermin posted:encountering systems now and then where rm has been aliased to rm -i, end up just doing -f every time rather than bothering to discover that. meaning to delete a non-writeable file is far more common than being actually warded away from deleting one. not that clear what *not* having -f ever gives you, for example in this case i imagine they could have deleted the database just fine without it i guess it was more the immediate jump from "I want to remove something" to "just rm -rf it I guess". This would 100% not have happened if he'd thought "hmm, maybe the empty data dir is causing problems" -> "rmdir"
|
|
#
¿
Feb 1, 2017 08:46
|
|
|
should have bounced through internic instead, then they could have gone back and deleted the logs afterwards
|
|
#
¿
Feb 3, 2017 06:29
|
|
|
I just don't get it. Why would you make a thread about a topic you already know things about? And try to educate other people in such a thread? It makes no sense I tell you.
|
|
#
¿
Feb 3, 2017 06:45
|
|
|
one advantage to browser integration in your password manager is protecting yourself from phishing attacks - convincing someone to copy-paste their password into a phishing site is just as easy as convincing them to type it in, while fooling the browser integration is (at least in theory) a bit more challenging.
|
|
#
¿
Feb 4, 2017 01:50
|
|
|
my understanding was that they really care a lot about pirated copies not appearing before your legit customers get their hands on the officially released version. long-tail sales have always been pretty garbage in comparison to launch day for aaa games, so you really don't want pirates cutting into those launch day sales after that who really cares, but it's not like you're going to spend actual money on patching out drm later, since that gives you literally no benefit
|
|
#
¿
Feb 6, 2017 02:34
|
|
|
ate all the Oreos posted:there's standard protocols for doing this securely already iirc but lol if people will even use them let alone implement them correctly you just hash random.org's non-https error page, right?
|
|
#
¿
Feb 7, 2017 06:57
|
|
|
cinci zoo sniper posted:
im the ones that simultaneously validate and don't validate certificates
|
|
#
¿
Feb 9, 2017 14:00
|
|
|
in general i'd expect good pedagogy for teaching hacking to start with "here's how we used to break stuff back in the day", because the fundamentals of getting control flow out-of-the-expected-path-somehow are still pretty much the same. then once you've mastered the basics it moves on to "here's what people came up with to make these things harder, and here are the more advanced techniques we use to defeat that and gain control anyway" so first you introduce stack protection, and then start talking about finding rop gadgets. then you start talking about aslr, and then about the common ways it gets hosed up (lookin' at you av-injecting-a-dll-at-a-known-location-in-every-process) or how you can get a process to leak address layout information in order to get an exploit through it. stuff like that.
|
|
#
¿
Feb 13, 2017 14:03
|
|
|
bgp hijacking is a pretty well-known attack, and it's pretty hard to detect unless you have a high-level view and are explicitly looking out for it. it's a bit out of reach of most rando hackers though, since you need to be in at least a somewhat privileged position on the internet to do it. but if, say, you're the turkish government and you want to censor certain dns queries, you might set up a server you control and have it claim to be 8.8.8.8. or if you're the nsa and you want to spy on domestic communications with less worry about that niggling "leave domestic spying to the cia" part of your mandate, you might set up a server in iceland that claims to be the best connection between two different locations in new york.
|
|
#
¿
Feb 13, 2017 14:32
|
|
|
you almost always need to recompile the program/libraries to make use of them, yeah. for example, you can't move stuff around in memory (for aslr) if the program is just going to read from 0x020000 and expect to find some particular data there - you can only really do aslr if the compiled program supports being moved to somewhere else in memory. same with stuff like making the stack non-executable - you can't exactly enable it if the program (as part of its normal function) copies bits of code to the stack and then executes it. basically, patch your poo poo
|
|
#
¿
Feb 13, 2017 15:31
|
|
|
people could have seen my posts 
|
|
#
¿
Feb 24, 2017 02:30
|
|
|
pr0zac posted:are there seriously people in this thread that think a prominent password manager company would have an implementation that would involve sending plaintext passwords over http to cloudflare? no, i don't think anyone does. people think they send them over https through cloudflare, and also have cloudflare do ssl termination so it can actually do the load-shedding and stuff. people think this because it's literally called out in the bug as information that was seen in the leaked data.
|
|
#
¿
Feb 24, 2017 16:17
|
|
|
not all the time, anyway
|
|
#
¿
Feb 25, 2017 07:10
|
|
|
spankmeister posted:I don't think it quite works like that. that's not how this attack works. the file size is the same, there is just a pair of blocks somewhere in the middle that differs between a and b.
|
|
#
¿
Feb 25, 2017 15:07
|
|
|
Powaqoatse posted:that could be done with salted+hashed rolling 4-char substrings of the old password, but i guess those are easier to crack in a leak By "easier" you mean "trivial", right?
|
|
#
¿
Mar 3, 2017 08:35
|
|
|
"you have to say if you're a cop", but instead we figure it out based on us spying on you
|
|
#
¿
Mar 4, 2017 05:02
|
|
|
it was behind the picture. remain exactly where you are.
|
|
#
¿
Mar 7, 2017 14:41
|
|
|
i don't think the cia is actually going to cut you a check though
|
|
#
¿
Mar 7, 2017 15:26
|
|
|
remember that slashdot is entirely populated by people who never moved on from it. e: kinda like sa now that i think about it
|
|
#
¿
Mar 9, 2017 13:46
|
|
|
OSI bean dip posted:i managed to get 2nd place in a ctf today using the powers of google Unsalted md5s?
|
|
#
¿
Mar 14, 2017 00:27
|
|
|
the vulnerability isn't "tricking" lastpass into auto-filling something - it'll autofill anything that looks like a password, that's the whole point. the vulnerability is tricking lastpass into thinking bankofamerica.evil.com is a good place to autofill your bank password
|
|
#
¿
Mar 17, 2017 05:39
|
|
|
cheese-cube posted:send them to me and i will check them 4 u 192.168.1.1
|
|
#
¿
Mar 23, 2017 04:33
|
|
|
Truga posted:wait, so who's getting hit by the symantec thing? i know thawte is owned by symantec, are they gonna get removed too? i have a client that has their cert. every symantec cert, regardless of what brand name they use for that particular root key e: the exception is things under certain trusted intermediates, since those were all properly vetted and easily distinguishable from the ones that were only validated by random people that were paying symantec bucketloads of money Jabor fucked around with this message at 14:29 on Mar 28, 2017 |
|
#
¿
Mar 28, 2017 14:26
|
|
|
Pretty sure it's the positive numbers > 2 so that n^2 + n - 1 and n^2 - n + 1 are both prime. So it's 15.
|
|
#
¿
Apr 4, 2017 13:29
|
|
|
Hmm yes, I'm sure a clandestine surveillance device is going to instantaneously do something that makes it really obvious you've been targeted. That definitely sounds like something it would do.
|
|
#
¿
Apr 11, 2017 04:29
|
|
|
ErIog posted:It just means a lawyer wrote the EULA and, surprise surprise, they wrote it to be maximally beneficial to Bose because that's what they're paid to do. And that makes it not a bad thing because
|
|
#
¿
Apr 21, 2017 01:41
|
|
|
Calling out overly-broad eulas and privacy policies is a good thing. It doesn't really matter if they're not doing <bad thing> right at this moment, if at any point they want in the future they could start doing it without your knowledge or consent.
|
|
#
¿
Apr 21, 2017 01:48
|
|
|
Shaggar posted:if there are banned APIs then those APIs should not be accessible at runtime, but I don't think that's whats going on here. I think its probably a policy issue where the API is ok to access but what you do with the results has policy restrictions like "you can query this api to get the device id and here is a list of things you should or should not use it for" i'd more assume that the api is used by apple's libraries to do things that are Allowed, so closing the security hole would require redoing those library functions to do the device-id-related stuff in the core os instead of on the app side. and then you've got to do something about all the apps using the old library versions that expect to call the private api.
|
|
#
¿
Apr 24, 2017 17:01
|
|
|
Shaggar posted:apple apps should be running in a different sandbox config that allows those api actions. or if they're system applications, not running in the sandbox at all. sometimes libraries intended for application developers use "private" system calls that aren't meant to be used directly. since the library code is embedded in the app, the app's security context has to have access to the api, but the app code itself is not supposed to use it directly. if the library is well designed, then the "private" api doesn't actually provide anything that the app couldn't already do by calling the officially supported library. but sometimes that's not the case, and it can be hard to lock it down if you don't want to break apps compiled against the badly-designed version of the library.
|
|
#
¿
Apr 24, 2017 17:28
|
|
|
So it's another "antivirus is loving stupid" thing?
|
|
#
¿
May 9, 2017 02:04
|
|
|
|
| # ¿ May 17, 2024 02:33 |
|
|
usually they just have a short timeout where they go "we ran it for x ms and it didn't do anything bad, so it's probably okay" so you know, even if the whole setup did do anything beneficial w.r.t catching stuff it's trivially defeated by counting to a large number in a loop at the very start of your malware
|
|
#
¿
May 9, 2017 04:12
|
|