antsar

16 ms·

121.
by antsar 7y ago
Getting caught abusing a side-channel like that is an easy way to get booted from the App Store. FTFY. Also, it's Facebook. Surely they have some strategic/political strings they can pull?
122.
by antsar 7y ago
> I'm assuming rotation is better because that is what Mozilla is apparently recommending. I'm (cynically) assuming something different. Was "monthly" chosen by accident, or is that just enough time for advertisers to
123.
by antsar 7y ago
Correct, assuming they haven't found some side-channel to bypass the permission system.
124.
by antsar 7y ago
Isn't that easily solved by rewriting the From header and re-signing the email? Send it from: Some List on behalf of John Sender <list@example.com> ... instead of ... John Sender <john@other-example.com> And now the list so
125.
by antsar 7y ago
Maybe the portal software was priced by user count?
126.
by antsar 7y ago
> Descent 2 custom level reviews You weren't kidding about the tangents.
127.
by antsar 7y ago
Step 4) Friendly chats with FBI & SEC?
128.
by antsar 7y ago
(Off-topic) That link is localized "nl", and I'm in the US, but for some reason it's trying to access google.cn. ಠ_ಠ https://i.paste.pics/1d51475b28fe67095693ca871c7fdc5f.png
129.
by antsar 7y ago
> But the question is, from an adversary perspective, does your victim have it disabled? Does it even matter? Extrapolating from that quote: a submitted sample could make abusive network requests against the victim (from MSFT's netw
130.
by antsar 7y ago
> not one that's a threat to Microsoft Until the medical software company sues Microsoft for damages to recoup the HIPAA fine. This is probably buried in some clickwrap contract though. (IANAL; not sure how enforceable such a contra
131.
by antsar 7y ago
He includes this screenshot[0], addressing the "send" part. The "run" part seems evident from the network traffic coming from MSFT. [0] https://miro.medium.com/max/334/0*g_3L3SxR4IYoBAxD
132.
by antsar 7y ago
Seems like a good time to plug my favorite FOSS alternative, Snapcast. https://github.com/badaix/snapcast#Snapcast https://www.home-assistant.io/blog/2016/02/18/multi-room-aud... I
133.
by antsar 7y ago
(Off-topic) It's sometimes (always?) possible to reply despite the missing "reply" button. Click the timestamp of the post to see it on its own page. That page seems to have a reply button even when the thread does not.
134.
by antsar 7y ago
From TFA: > To test what would happen if Chipotle’s form used these standards, I opened my browser’s developer tools and edited the expiration year field: > Video of autofill on the Chipotle order form after `maxlength=”2″` has been
135.
by antsar 7y ago
Worse, > 02/27: Attended conference call with Blackboard and NTNU to explain exploit > Blackboard stopped responding to our e-mails 02/28.
136.
by antsar 7y ago
It's an internal domain. The user-facing stuff uses vanity domains (google, youtube, etc) but the servers' "true" hostnames reside in 1e100.net. https://support.google.com/faqs/answer/174717?hl=
137.
by antsar 7y ago
Maybe they could optimize by turning off (and not paying for) cellular when WiFi is available. Seems disgustingly plausible, tbh.
138.
by antsar 7y ago
TOTP is one thing. Having your backup TOTP key locked in a safe effectively stops it from being abused. SMS 2FA, on the other hand, has real security issues[0][1]. In my experience, SMS 2FA is most commonly the required type of 2FA, before
139.
by antsar 7y ago
Yeah, for "free wifi", the incentive is definitely to not connect you. You don't consume bandwidth, so the handful of people who do connect won't complain about shitty speeds. For paid wifi, on the other hand, wouldn
140.
by antsar 7y ago
Perhaps the folks running these networks lack the incentive to care about technical correctness? OTOH, one would think a better system would lead to a higher conversion rate (i.e. more people are actually able to pay you).
141.
by antsar 7y ago
"example.com" has been my go-to. Impossible to forget. On the other hand, they don't guarantee that they won't implement an HTTPS redirect someday. Seems like that's the major selling point here. I wonder how this s
142.
by antsar 7y ago
That would seem like a solid reason to avoid Namecheap. Edit: Wait, do they use Cloudflare? $ dig namecheap.com +short 198.54.117.250 whois: CIDR: 198.54.112.0/20 NetName: NAMEC-4 Organization: Nam
143.
by antsar 7y ago
To be fair, its not super-hard to follow the incentives there...
144.
by antsar 7y ago
Its not the prettiest, but here's a flight sim with (more than) a handful of planes that lets you fly everywhere in the world without dollar signs appearing anywhere (it's FOSS). https://www.flightgear.org/
145.
by antsar 7y ago
FlightGear has that, and is open-source. https://www.flightgear.org/
146.
by antsar 7y ago
Or you missed the "some people use the headphones and fall asleep" part. In that case, cranking up the volume still makes sense.
147.
by antsar 7y ago
I think 'rasz is suggesting that a well-designed higher layer should cross-check its various inputs before doing stupid things. If GPS says we moved but tire rotation says we didn't, well, maybe don't blindly trust the GPS?
148.
by antsar 7y ago
That design, in this context, seems bad for security...
149.
by antsar 7y ago
(IANAEE) 120 and 240 are a bit more painful when mistakes happen. And 9 seems too low (normal USB voltage is 5, so 9 might be within safety margins).
150.
by antsar 7y ago
Some people use laptops, and want to move around with those laptops. Keeping an external drive connected kinda gets in the way :)

More ›