NicolaiS

8 ms·

31.
by NicolaiS 4y ago
There is nothing called "VARCHAR(n)" in SQLite. It is mapped to `CHAR(ACTER) => TEXT` which is limited to 2^31 - 1 characters. [1] https://www.sqlite.org/datatype3.html#3.1.1 [2] https://www.sqlite.o
32.
by NicolaiS 4y ago
You are missing the steps to install, setup, cronjob, for certbot. What about HTTP->HTTPS redirection, etc? Same for secure cipher selection. All of that Caddy gives you in 1 line of config (i.e. domain name)
33.
by NicolaiS 4y ago
In case Bitcoin needed to upgrade e.g. secp256k1, then a logical/easy way to avoid this problem is with a simple commitment scheme.
34.
by NicolaiS 4y ago
The issue has been publicly known for years. The more focus we can get the better - hopefully NPM will add MFA at some point...
35.
by NicolaiS 5y ago
That seems like a bad reason. With a good enough connection and `masscan` you can "scan the whole internet" (single port) in 5 min. Security through obscurity on IPv4 make no sense.
36.
by NicolaiS 5y ago
Satoshi was maybe an above-average coder nor cryptographer, but not genius. Reminder: bitcoin v0.1 was made to run only on Windows, the code was fairly ugly and had a bunch of common crypto mistakes/weirdness [0]. Don't get me wro
37.
Argv Silliness(ryiron.wordpress.com)
2 points by NicolaiS 5y ago|0 comments
38.
by NicolaiS 5y ago
"Log4j2 versions 2.0-beta7 through 2.17.0 are vulnerable to a remote code execution attack if an attacker with permission to modify the logging configuration file can construct a malicious configuration"
39.
by NicolaiS 5y ago
that's all they found Besides the trivial MITM in MTProto 1.0? Telegram protocol defeated. Authors are going to modify crypto-algorithm: https://news.ycombinator.com/item?id=6948742
40.
by NicolaiS 5y ago
Indeed, and as others have stated it is really hard to allow `[-1]` without breaking old code. Also: `[1, NaN, "hi"].indexOf(NaN)` is -1 but `.includes(NaN)` returns true as expected.
41.
by NicolaiS 5y ago
I'm super excited about Cactus Comments! I integrated it on my own static site in two lines of HTML/JS. What I would love to see is an OAuth-like way of authenticating with my own homeserver, but I think work is in progress (MSC29
42.
by NicolaiS 5y ago
Imagine you have a game with attacker controlled (x, y): var { x, y } = JSON.parse(input); board[x][y] = true; // ... if (user.admin) ... If the attacker puts: {x: "__proto__", y: "admin&quot
43.
by NicolaiS 6y ago
You can use the "Analyse APK" feature, but you probably rather want to use tools like jadx or apktool that provides fairly good decompilation.
44.
by NicolaiS 6y ago
That is incorrect. Brew will do random upgrades when running `brew install` unless you set the non-default `HOMEBREW_NO_AUTO_UPDATE=1` [1] so every now and then when you brew install something it will e.g. upgrade the python binary from 3.x
45.
Sudo Exploit Writeup (CVE-2021-3156)(kalmarunionen.dk)
8 points by NicolaiS 6y ago|0 comments
46.
by NicolaiS 6y ago
It is possible using a "Certification Authority Authorization" (CAA) DNS record to specify which CA is allowed to sign certs for your domain and using DNSSEC you get a separate channel of trust. However CAA (and DNSSEC) is rarely
47.
Apktool v2.5.0 Released(connortumbleson.com)
2 points by NicolaiS 6y ago|0 comments
48.
by NicolaiS 6y ago
> distributing binaries on Linux is an enormous pain. It doesn't have to. Packaging using FPM [0] allows many targets (deb, rpm, etc) and using ELF2deb [1] (shameless plug) allows packaging any files to a .deb with no effort. [0] h
49.
by NicolaiS 6y ago
Google can turn Safetynet validation up or down w/o updating your Droid. Currently it is possible to bypass SafetyNet, but they did turn it up a notch lately, and if they require strong "Key Attention" then neither Magisk nor
50.
by NicolaiS 7y ago
`mitmproxy` is also a really nice tool for MITM'ing your connections. It's free and open source, has a nice TUI, scripting in python, intercept and modify requests/responses, etc https://mitmproxy.org/
51.
by NicolaiS 7y ago
You can see the version and update it using their (deprecated) website: https://update.solokeys.com/
52.
by NicolaiS 7y ago
Due to shared hosting you can't map every IP to a hostname, and encrypted SNI is a thing.
53.
by NicolaiS 7y ago
No.
54.
Show HN: ELF2deb – easily package any executable as a deb
3 points by NicolaiS 7y ago|0 comments
55.
by NicolaiS 9y ago
Some work is being done: http://vitalik.ca/general/2017/06/09/sales.html but tl;dr no perfect models for ICO's exists.
56.
by NicolaiS 9y ago
Craig Wright is NOT Satoshi.
57.
by NicolaiS 9y ago
The 't' vs 'T' has _nothing_ to do with checksums. `Transfer` and `transfer` are two different functions, one creating an "event" (think a signal on the blockchain) and the other actually transfering tokens. Th
58.
by NicolaiS 9y ago
Race-condition exploit ? RCE is almost always an abbreviation for Remote Code Execution , lets keep it that way.
59.
by NicolaiS 9y ago
Not if they all was stored in cleartext from the beginning - which, unfortunately, a lot are.
60.
by NicolaiS 10y ago
More detailed changelog: https://github.com/antlr/antlr4/releases/tag/4.6

More ›