Eridrus

1002 ms·

2791.
by Eridrus 12y ago
I am surprised to hear you say that Chrome's antixss auditor is a good enough solution. I havent examined it myself, but my understanding was that there were quite a few bypasses and the chrome team isn't super interested in makin
2792.
by Eridrus 12y ago
How do you plan to deal with self-xss? It sounds like you could xss yourself and bypass any of the protections. To me this sounds a lot like previous solutions that 'solved' security by adding hmac tokens to every link. This sound
2793.
by Eridrus 12y ago
I read about half of "The Score Takes Care Of Itself" by Bill Walsh on a flight a few weeks back, and it makes me question your reasoning. It sounded like the team that Bill Walsh coached was playing an (at the time) similarly unl
2794.
by Eridrus 12y ago
> How viable is this in the real world? Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java. Here's a video looking at actually implementing such attacks over LAN and in
2795.
by Eridrus 12y ago
Not sure where I was reading this the other day, but types have two advantages: abstraction and checking. You can add a third one to that list: safety. C has types in the sense that it allows you to do abstraction, and type checking, but it
2796.
by Eridrus 12y ago
People have known about the potential for much longer than a year: http://www.slideshare.net/guest2821a2/web-browsers-and-other... http://www.slideshare.net/guest2821a2/web-browsers-and-other... A
2797.
by Eridrus 12y ago
The issue I've always had with this & dakarand are that they might not be easily predictable, but it is probably possible to influence their output into something you can more easily predict.
2798.
by Eridrus 12y ago
It doesn't actually seem like the Urdu Times is really "thriving". It manages to employ one person, and keeps all the writers as freelancers. This is one of the symptoms cited of the decline of traditional print media.
2799.
by Eridrus 12y ago
> Passing through exceptions means not trying to fool anyone into thinking they can work with the high-level abstraction without understanding anything about what's going on underneath. Except this is not what happens in reality, ve
2800.
by Eridrus 12y ago
On one hand, I'm happy you found something more productive. On the other, I've spent a good chunk of time just reading other people's code, and I've come to appreciate really straight forward verbose code. So I am a bi
2801.
by Eridrus 12y ago
> "Exposing implementation" is a non-counterargument - the component failed because its implementation preconditions were violated, you need to address those implementation preconditions to fix the problem! I don't think t
2802.
by Eridrus 12y ago
People are saying the future of advertising is mobile, not because it presents a good platform for showing ads, but because increasingly that is how people are spending their time, so there is an expectation that advertising dollars will fo
2803.
by Eridrus 12y ago
I think the issue is now more one of language philosophy than language implementation now. In my mind languages tend to have an optimal code size where they work well, and what works at <1000 lines often does poorly at even 10k lines.
2804.
by Eridrus 12y ago
This has nothing to do with heartbleed. This means you can just generate certs on your own machine that a lot of software will simply accept.
2805.
by Eridrus 12y ago
I'm not sure why Java is taking a bullet on this. The default in other languages is often to not do any certificate validation. That seems like the worse approach since no-one can tell their code is insecure. Maybe fine for a scripting
2806.
by Eridrus 12y ago
I think this is worth hammering home. People want analytics information, and the only way we can do this now is by adding things like this. (Not strictly true, but ease of deployment, etc). Unless you shut down the only way to do something,
2807.
by Eridrus 12y ago
I'm a man, but I am very much a clothes horse, so I feel like I am part of the demographic you want to reach. Here is a roughly sorted wishlist for a shopping app: - Track prices on arbitrary sites with something akin to Web Slices wh
2808.
by Eridrus 12y ago
> Many developers would be happy if their game pulled down $10K. That seems unlikely.
2809.
by Eridrus 13y ago
Coverity also has a free trial you can do online with your own code: http://softwareintegrity.coverity.com/free-trial-coverity.ht...