spankmeister posted:

It was bad

fritz posted:

florida lan

anatoliy pltkrvkay posted:

mods plz

BangersInMyKnickers posted:

Cybernetic Vermin posted:

free private repos can only have three collaborators, so it is pretty drat limited anyway

besides there is a bunch of enterprise features they still charge for, just microsofts modern realization that you want to rope in hobbyists with free tools to the extent possible, the real money is with cost-insensitive companies

CRIP EATIN BREAD posted:

Boiled Water posted:

in sec-gently caress fun: I saw a defcon video describing an interesting attack vector: Windows Defender. Turns out it scans almost anything you come into contact with in its own container, like if you view an email in gmail with an attachment it downloads it and scans and runs it in the container. You can escape this container, and its supposedly a good time.

haveblue posted:

three winters from now
fallen leaves under snow and
your cert expires

EMILY BLUNTS posted:

YOSPOS › Security Fuckup Megathread - v18.0 - the thread title says “security fuckups” not “insecurity fuckups”

Carbon dioxide posted:

Anyway, the hardcoded key is 1024-bit DSA.

BangersInMyKnickers posted:

lol ok symantec here we go again

they have this thing called a shared insight cache, which at its core is just a big memory lookup table of process hashes, the definition rev, and the number of clients that voted it clean. so when things are doing disk scans, they can call back to this server and get a verdict on the file without doing the full scanning poo poo locally and expending those cycles. they sell it as a vdi optimization thing, but really you could use it for any system so long as they have a low latency connection to the server and .5mbit network overhead to spare.

the documentation is garbo with some kind of cert-less TLS implementation they you can intercept and then creds being passed inside that tunnel, but I guess you can increase the vote threshold before a hash is marked clean to minimize the risk of cache tampering. there's not any scaling guidelines to speak of so I'm profiling this thing to figure it out what I have to throw at it and I see the client start spamming hundreds of new sockets against the cache instance. at one point in the scanning process, the client opens 100+ sockets to the cache listener, and it seems to happen at around the same point at the beginning of every scan, which means I can have 650 clients doing this at once before this stupid things starts running off the rails for a failure mode I'm sure they didn't validate for.

for a company that claims to be an enterprise security vendor they sure do loving suck at it

spankmeister posted:

Funny because the trail of bits guy CTF one was one of the very few sponsor interviews that I listened to and actively enjoyed. I usually skip them after a couple of minutes.

This one was absolutely great. It's because I like to play CTF's and it's cool to hear from someone who designs these absolutely insane challenges.

It's also nice that they used their sponsor spot to just tell a story about a cool CTF challenge, instead of actively trying to push some product.

spankmeister posted:

Funny because the trail of bits guy CTF one was one of the very few sponsor interviews that I listened to and actively enjoyed. I usually skip them after a couple of minutes.

This one was absolutely great. It's because I like to play CTF's and it's cool to hear from someone who designs these absolutely insane challenges.

It's also nice that they used their sponsor spot to just tell a story about a cool CTF challenge, instead of actively trying to push some product.

Blinkz0rz posted:

a product manager literally just asked me if i have any concerns about allowing paid users to upload selenium jars and exes which our product will process

trying to figure out a diplomatic way to say "absolutely not why would you think this is a good idea?"

EMILY BLUNTS posted:

8 dildos seems like a lot tho

Midjack posted:

ol dirty bastard lives!

Chris Knight posted:

heck of a thread
https://twitter.com/glytchtech/status/1089626118397849600

Cocoa Crispies posted:

*felix voice* the best part of waking up… is kashoggi got cut up

The Fool posted:

geonetix posted:

I have a feeling that investigation should be done by a third party instead

abigserve posted:

Security Fuckup Megathread: not so fast hot stuff

Proteus Jones posted:

Security Fuckup Megathread - v17.2 - your gender is broadcasting an IP address

flakeloaf posted:

i was a loving dismal interrogator but that part even i could get right

Krankenstyle posted:

e: nm, misread

haveblue posted:

BARRENS SHAPED CHARGES

D. Ebdrup posted:

In case you're using seemingly any of the ad-blockers but uBlock Origin (why would you?), you probably want to switch.

D. Ebdrup posted:

Very different, yes - that's pretty well-known by now, though. But I suppose someone might not know it?

MononcQc posted:

my employer produces those, among other things.

They're still expensive and require data access so many police forces have only a few car running with them at any given time.

flakeloaf posted:

wait so integrating xss into the desktop of an operating system (and probably into a process with god rights) is.... um... bad?