XMPPwocky

51 ms·

481.
by XMPPwocky 10y ago
The point of a linker is sort of to "inject code into a binary", and the point of a library is sort of to be code that gets injected into a binary. How does any of this relate to malware?
482.
by XMPPwocky 11y ago
But then, if I'm MITMing you, I can just silently keep you on www, without SSL, without caring about HSTS or anything.
483.
by XMPPwocky 11y ago
Right, but mosh uses ssh for initial key setup. I suspect it is possible to exploit that. (As an occasional Windows user who's using the Mosh Chrome extension, I have no idea how much risk I'm at; can't edit ssh_config, it&#x
484.
by XMPPwocky 11y ago
U2F or UAF? Firefox is working on adding U2F support, and there's a third-party plugin ( https://addons.mozilla.org/en-GB/firefox/addon/u2f-support-a... ). Not sure if anything supports UAF yet; doesn&#x
485.
by XMPPwocky 11y ago
UAF, from the folks behind U2F, does basically this: https://www.ietf.org/proceedings/92/slides/slides-92-tokbind... As far as usability, at least U2F is amazingly frictionless; enrollment is 'put the do
486.
by XMPPwocky 11y ago
Another interesting thing about iOS- they enforce code signing on the page level. You cannot create a RW page, write new code (from the network) into it, and then remap it as RX; every instruction needs to be approved by Apple. So changing
487.
by XMPPwocky 11y ago
Email security@valvesoftware.com; I've reported loads of things there (some serious, some pretty trivial), and they're actually very good about responding to things these days. Steam Support is totally useless, though.
488.
by XMPPwocky 11y ago
Yes. An attacker could send you a URL with a random query parameter, which would be ignored by Steam. But the response would be cached- with that query parameter. The attacker could then visit the URL themselves, and see private information
489.
by XMPPwocky 11y ago
So is there any plausible reason for using Dual_EC besides "the NSA is paying us off" and "we heard its security is based on the ECDLP so it maybe is harder to break"? From what I understand, it's slower and gives p
490.
by XMPPwocky 11y ago
Isn't that instruction timing data assuming a L1 cache hit?
491.
by XMPPwocky 11y ago
Another issue: lag. I have yet to see a wi-fi connection without occasional periods of enormous latency, packet loss, or both. Cellular data is even worse. RTSs and MOBAs both seriously suffer under those conditions. Who's going to plu
492.
by XMPPwocky 11y ago
No, "-v Bruce" did (forcing the use of the "Bruce" voice, which is in English).
493.
by XMPPwocky 11y ago
So you can bail out cleanly and go around for another run if the infoleak fails, yeah? Or do bad things happen up in kernelspace?
494.
by XMPPwocky 11y ago
>>I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem >Uh ... You don't think that percentage will increase if you offer bounties? And if it doesn
495.
by XMPPwocky 11y ago
Their webapp is (AFAIK) all PHP; not sure what the backend looks like.
496.
by XMPPwocky 11y ago
And that includes security issues; there's one notable vuln where a malicious server or custom map can execute arbitary code on clients. Reported that a few months ago, it's fixed in CS:GO and TF2, but other Valve games apparently
497.
by XMPPwocky 11y ago
They don't seem to have any automated or manual testing before deployment (or at least, extremely little)- for example, one recent bug was that all the prices on the store disappeared, and nobody could buy anything.
498.
by XMPPwocky 11y ago
By the way- for security issues, their security@valvesoftware.com address gets /very/ fast, human replies. For example- when Steam Curators rolled out, you could use javascript: URIs for links to "read full review". 5 mi