antocv

54 ms·

511.
by antocv 12y ago
Can we get a package manager for package managers? There is so many already, its hard to keep track what names come from what repositories of what package managers. It used to be so simple, yourDistroPackageManager install whatever, now the
512.
by antocv 12y ago
> or call system() to gzip something Are you serious, who the hell does that!? Any half-assed language has a zip implementation, use that. Any non-boring language has image-magick binding to that library. This bug affects complete idiot
513.
by antocv 12y ago
> All you're doing is hiding the call to system/execve behind deeper layers of abstraction. Thats the point, layers where environment variables do not pass - since they in that abstraction do not make sense. > Plus if people
514.
by antocv 12y ago
Execve, but even that is stretching it, if I write something in Python and someone would tell me "hey use system() or subprocess" I tell them, no thanks, I would rather not do it - then go look for python-way of doing it, if its a
515.
by antocv 12y ago
Which has not been standard security practice for last 20 years - Do Not Use System or Execve or any other stuff from your php/web-scripts. Not. Ever. This bug only affects people who dont care about security.
516.
by antocv 12y ago
That patch doesnt fix the whole issue. The fix right now is to mv bash ohhellnobarsh && ln -s dash sh Or such.
517.
by antocv 12y ago
> wget shells out to bash Why oh why would this ever happen? This hole bug is way overblown. Not every small program on the planet "shells out to bash", and if they do, thats one seriously messed up program.
518.
by antocv 12y ago
Where is the kernel exploit in this? Whats so kernel about some script which probably just replaces nginx with a malwared one?
519.
by antocv 12y ago
Ive seen 89....125 as well, bastard. Lets all ping 198...138!
520.
by antocv 12y ago
http://seclists.org/oss-sec/2014/q3/672 Still vulnerable. env X='() { (lol)=>\' bash -c "echo id"; cat echo
521.
by antocv 12y ago
Funny, this works even after bash fix / upgrade env X='() { (a)=>\' sh -c "echo date"; cat e From http://seclists.org/oss-sec/2014/q3/672
522.
by antocv 12y ago
The trick is to keep up with the updates, do pacman -Syu every two weeks or so, and not wait months.
523.
by antocv 12y ago
Maybe the bash is invoked on some other request path, not just / which you are scanning. I would go with /login and such, or write a crawler to parse out where the login/logout URLs are and try those.
524.
by antocv 12y ago
Who the hell writes CGI scripts in 2014? There is a reason PHP is to be kept away and not touched with a ten meter stick, it seems to spawn a shell for weird reasons, I dont think python or groovy apps do that. They're safe, unless you
525.
by antocv 12y ago
Dont use google analytics or ads, dont rat out your neighbours to Stassi - modern form, dont snitch out your users habit to private nsa.
526.
by antocv 12y ago
Did webdevelopers think otherwise any time? Serves them right, noone should be using CDNs for code.
527.
by antocv 12y ago
I was a Java Web Gui developer, typical stuff, so the architect of the project asked me to implement better security by reversing SHA512. Specifically SHA512 he said, dont use SHA1 or SHA256 thats not good enough. And he explained several t
528.
by antocv 12y ago
Its not your web-browser that is asking you for that cookie shit, its the websites themselves implementing shit with javascript, css and html. They do this because the EU put out a directive ordering basically every website which operates i
529.
by antocv 12y ago
Except it may flash your bios or reflash any of your PCI cards and persist there.
530.
by antocv 12y ago
Yes, exactly, we can make translations of symbols so that it is actually easier for human readers to decode the meaning and message of the symbols. Perhaps we could even reuse previous symbols and meanings to convey what we want to convey i
531.
by antocv 12y ago
Security.
532.
by antocv 12y ago
Yes, I think thats a miss python made. But python at least doesnt have the goal it seems to make abbrevations and allow misconceptions about what the language is saying.
533.
by antocv 12y ago
I dont read code aloud, but when reading it I have to make the sounds in my head. Makes sense? fn calculate() does not lead my brain/mind to discover everything there is it already knows that is function and what it means in this spe
534.
by antocv 12y ago
Well yeah, it should be poetry. Instead of, what, cryptic symbols to decipher? You dont read symbols?
535.
by antocv 12y ago
Please Rust-lang, why, oh why, do you choose to name function 'fn' and module 'mod', dont you expect to read any of the programs you write!? How is anyone supposed to read fn main(). Fun main? Fen main? F of N? Is it rel
536.
by antocv 12y ago
Well yeah, I knew that, but seriously. If you gonna go that road, then use netcat echo and loops for a web server too.
537.
by antocv 12y ago
There is no money in hosting. Call it cloud, thats where the money is.
538.
by antocv 12y ago
Productivity depends on your previous experience and the domain you're in. Sometimes Im way more productive in Bash than in Python, sometimes its other way around, and sometimes Im most productive in Java. You cant do web development w
539.
by antocv 12y ago
Whats wrong with HTTP? How would you improve it? Its a Text Transfer Protocol, you can even build applications with text only clients and servers. One only needs echo, bash and netcat to make a server and client.
540.
by antocv 12y ago
Read books on various design patterns and architectures, until you start seeing patterns whenever you look at code. Just try to see which context the stuff is supposed to execute under, what problems it solves - from there the code is easy.

More ›