buildzr

16 ms·

121.
by buildzr 7y ago
Yup, unless you're a seriously security or stability focused company you don't even use basic stuff like static analysis, let alone fuzzing. Tools for these are often either expensive, hard to use or both.
122.
by buildzr 7y ago
> Then we moved on to restoring the WAF functionality. Because of the sensitivity of the situation we performed both negative tests (asking ourselves “was it really that particular change that caused the problem?”) and positive tests (ve
123.
by buildzr 7y ago
> Not when you don't have access to their home directory and all your file accesses are via XDG portals. > Modifying system-wide desktop files is a privileged operation and flatpak's filesystem namespacing prevents applicati
124.
by buildzr 7y ago
No, we aren't, there's still so so many more! - Even if you use the kernel switch you can still ptrace an application on startup, do you read the code for every .desktop composing your launchers? - You can trivial add say, a modif
125.
by buildzr 7y ago
Running on a server doesn't change anything, you'd need to be running on a server where you routinely give people who shouldn't have root access, access to an account with sudo privileges with a password. And be relying on yo
126.
by buildzr 7y ago
That threat model essentially prohibits "tmux attach", which allows an attacker running as your user to connect to your terminal session, so I don't think it's a particularly useful threat model here. That's basic
127.
by buildzr 7y ago
Isolation is always key. Remember, sudo can also be used to de-escalate priviledges to a different user account where it's harm is more limited. Or better, if you wanna run malware for fun, run a VM with an isolated network connection
128.
by buildzr 7y ago
Do we consider it a vulnerability to put "alias sudo=sudo rm -rf /" in your shell config too? How about ptrace(), depending on how your system is configured, an attacker running under your own user account could do similar da
129.
by buildzr 7y ago
So basically, bundle economics work if you ignore the existence of the market for those games. Yeah, that sounds about right. You would never cut a software developer slack for putting "no reverse engineering, no exploitation" in
130.
by buildzr 7y ago
Imagine if they sent you each game on a separate CD and told you "but don't sell the ones you don't want", you'd think that was ridiculous, right? That's exactly how stupid this idea is. I own the products I pu
131.
by buildzr 7y ago
If I bought that key in a bundle, I own it fair and square and I'll do what I want with it. If resellers are helping with that, I view that as a positive.
132.
by buildzr 7y ago
The responsibility for that one lies solely on the developer deciding to put the game in a bundle. Indeed I'd say that was a bad decision on their part.
133.
by buildzr 7y ago
Many of those codes are readily available via legitimate means - indie games often get published in bundles and the codes get resold, GPU makers and developers often do giveaways with free game keys, etc. There are many cases in which the k
134.
by buildzr 7y ago
G2A is mainly useful for things like multiplayer games where piracy isn't an option. That's the main reason I use it at least and I pirate everything else.
135.
by buildzr 7y ago
Interesting, I buy keys from G2A regularly and haven't lost access to any titles yet. If this was a significant problem I'd expect to at least have a few lost titles out of dozens I've bought personally and for friends.
136.
by buildzr 7y ago
Honestly, I think your time would be better spent learning about different cryptographic primitives, - Hash functions - Key derivation functions - Public key cryptography - Block ciphers - Stream ciphers - CSPRNGs Understanding these primit
137.
by buildzr 7y ago
I do support work for my small business via email, I need to know if a network is having problems, when a server goes down, if any users are having payment issues and jump in to fix these immediately if not sooner. A console ding as an emai
138.
by buildzr 7y ago
If you use the codes for your most common items this gets quick, some stores even post a sheet with a list of common produce codes, with stuff like apples and bananas they're often labeled even.
139.
by buildzr 7y ago
> Doing nothing takes us from having "a less than ideal solution" to having "no solution at all". No, doing nothing takes us from having a completely harmful and destructive solution that's very difficult to chan
140.
by buildzr 7y ago
Not everything has an ideal solution. We can't just magically apply regulation, technology or markets and fix every problem. Sometimes solutions create direct tradeoffs between freedom and security and we need to understand the valuing
141.
by buildzr 7y ago
Have you considered the much cheaper MH-Z19 or even the CCS811? Doubt they're as capable or accurate but I'd be interested in hearing the reasons behind going with the pricier sensor if you've got time to share.
142.
by buildzr 7y ago
False positives in the case of server monitoring are extremely rare and easy to detect when they do happen. Can you imagine if your server monitoring runs once per minute and randomly fails 1/100 times? You'd be getting panic-indu
143.
by buildzr 7y ago
Interesting, I wonder if this is something TurboTax itself is doing or if it's something the banks are going and TurboTax is making you bypass it in order to scrape it.
144.
by buildzr 7y ago
> Signal uses E2E encryption, so your attack vector doesn't work. End-to-end encryption is just that. That Firebase library is running on the client phone (aka, an end), if Google put code into the library allowing it to download
145.
by buildzr 7y ago
Signal has sworn by GCM the entire time they've been running on Android, it took a lot of whining from the community to get them to allow anything else.
146.
by buildzr 7y ago
I'm not so sure - if it's easy enough for you to adjust your schedule as a "night owl", it's possibly something worth considering. Personally I'm mainly on a night owl schedule because I feel like I get less en
147.
by buildzr 7y ago
> traditional phone, which has better audio Now, I'm not sure what video chat tool you're referring to, but POTS audio is awful, even the more modern stuff available for cell-to-cell isn't great unless you happen to have V
148.
by buildzr 7y ago
You wouldn't think it's really a niche market - most TVs made in the past several years are 4k, prices have become quite cheap, if you're buying a new mid or high end TV today chances are it's a 4k panel. It's just
149.
by buildzr 7y ago
I'd kill for 60fps 4k on anything. Sitting fairly close to a 65" TV it makes a big difference. But no console can even deliver that, I doubt they're going to deliver 8k gaming at any reasonable framerate in a modern AAA game,
150.
by buildzr 7y ago
Absolutely nothing: the problem cryptocurrencies solve is allowing mutually distrusting parties to engage in transactions. The only potential advantage of such a system over an RDBMS is the inability to reverse transactions without people t

More ›