0x0

29 ms·

301.
by 0x0 6y ago
It looks like `--script` is just an arbitrary string, it is only executed because a real `<script>` tag retrieves the property and evals it through `(new Function())()? https://twitter.com/sansecio/status/133
302.
by 0x0 6y ago
Debian Testing doesn't really have much in the way of security support, see https://www.debian.org/security/faq#testing
303.
by 0x0 6y ago
You can also render man pages to pretty typeset postscript and pdf, for example: https://unix.stackexchange.com/questions/444767/export-a-man...
304.
by 0x0 6y ago
Pretty sure this is disabled at compilation time for debian based distros, at least.
305.
by 0x0 6y ago
The BIOS only loads a 512 byte sector, never a whole kernel. So if you want to directly boot a zImage, the first 512 bytes of the zImage would need to implement floppy sector reading loops to load the rest of the kernel block by block.
306.
by 0x0 6y ago
I still use HardwareGrowler all the time with Growl, and it is super useful for unobtrusive notifications about usb connects, IP address changes, battery levels, etc. Here's to hoping for a future for HardwareGrowler still.
307.
Pam 1.5.0 has a auth bypass under some conditions(openwall.com)
44 points by 0x0 6y ago|23 comments
308.
by 0x0 6y ago
Exposing drives directly with no virtualization layer - is there a risk that a malicious user might somehow flash a trojan firmware onto the drive, and then later the drive is used for a different customer? The classic Sprite Hard Drive mod
309.
by 0x0 6y ago
But could it run on Windows 3.11 using win32s/winG?
310.
by 0x0 6y ago
Could it run on Windows 3.11 (using win32s/winG) too?
311.
by 0x0 6y ago
Nowhere does this mention virtualizing x86 VMs. In fact, the virtualization framework does not seem to have anything to do with rosetta at all. Note that those are two different sentences, and they appear to be not related.
312.
by 0x0 6y ago
But that's for macOS binaries. Not for VMs.
313.
by 0x0 6y ago
Is there even a JVM available for darwin-armv8 ?
314.
by 0x0 6y ago
That's how android apks work. An app is signed with a public/private key combo, updates must match the same key. Surely something similar could be conceived. Keys could have an expiration date and someone would just need to post a
315.
by 0x0 6y ago
You could probably post a gpg-signed url to the blockchain, and scan the blockchain for new urls signed by a known gpg key. Or something like that.
316.
by 0x0 6y ago
Gitlab DOES let you compare different versions of changesets in a merge request: https://docs.gitlab.com/ee/user/project/merge_requests/versi...
317.
Hunting Ghost No. 1(celluloidjunkie.com)
12 points by 0x0 6y ago|4 comments
318.
by 0x0 6y ago
Already today, as a European iOS developer with your apple developer program contract counterparty being their European corp, you still have to deal with US export restrictions and self reporting paperwork if you make a single HTTPS call in
319.
by 0x0 6y ago
I clicked the "download on the app store" button, but ended up on a domain "app.adjust.com" showing a full screen "safari cannot open this page. The error was: the URL was blocked by a content blocker". Decepti
320.
Nova by Panic(nova.app)
1051 points by 0x0 6y ago|542 comments
321.
by 0x0 6y ago
Care to elaborate? Did Apple break backwards compatibility with apps built on the iOS 13 SDK with no way to work around it? Seems hard to believe that everyone upgrading to iOS 14 will end up with no functional third party apps today?
322.
by 0x0 6y ago
Well you can always ship updates with the old iOS 13 SDK toolchain (Xcode 11) the entire time. You could have tested on the iOS 14 betas, and if you found a crash, you could try to implement a workaround and resubmit in the weeks and months
323.
by 0x0 6y ago
Yes. https://github.com/frohoff/ysoserial https://github.com/pwntester/ysoserial.net
324.
by 0x0 6y ago
And it seems to contain hardcoded usernames and password for those STUN/TURN servers too...
325.
by 0x0 6y ago
It still needs a server to relay the webrtc peer discovery stuff, at least by looking at server.js ?
326.
by 0x0 6y ago
That's what XProtect is for
327.
by 0x0 6y ago
But you might have customized your PATH after your shell was executed? So this does not seem accurate.
328.
by 0x0 6y ago
nodeIntegration:true
329.
by 0x0 6y ago
I got burnt by an unfortunate combination of ActivePerl registering script execution as the default handler for .pl files, and some random file transfer application's "view file" dispatching to the Windows default file handle
330.
by 0x0 6y ago
Use a dot after the trailing slash and there is less confusion. "Blabla/." means "(everything) in the Blabla directory". Fairly self-explanatory/un-confusing and no need for "*"

More ›