cjbprime

51 ms·

1. 691.▲
   by cjbprime 6y ago

   mitmproxy is great! I wish there was a way to conveniently look at non-HTTP TLS traffic, though. I saw a few documented "TCP mode" options but they don't seem to get me access to plaintext. Any ideas?
2. 692.▲
   by cjbprime 6y ago

   Yes. You can see that this bug was marked wontfix. Ultimately, it seems that browsers have decided that breaking DNS rebinding breaks an unacceptable number of legitimate use cases. You can still fix it at your own router/DNS server, t
3. 693.▲
   by cjbprime 6y ago

   Thanks. So the most likely scenario where it's worth the extra effort here would be to contact a non-HTTP TCP service on the victim's machine.
4. 694.▲
   by cjbprime 6y ago

   This looks neat, but it seems like DNS Rebinding is likely more powerful here -- that would get you access to servers on the entire local network (not just the victim's own machine) without having to know the local browser's own I
5. 695.▲
   by cjbprime 6y ago

   That's actually not secure either, for a different reason -- DNS Rebinding exposes localhost-only servers to the outside world through your web browser. See e.g. https://bugs.chromium.org/p/project-zero/issues
6. 696.▲
   by cjbprime 6y ago

   I suppose there's even a fourth option: People who are more likely to be hospitalized are also more likely to be deficient in vitamin D. The control group seemed to be a healthy population sample, but hospitals are not a pool of health
7. 697.▲
   by cjbprime 6y ago

   Hi! I'm the GitTorrent author. It feels strange to have it show up on the front page whenever GitHub does something bad, more than five years later. Bitcoin and BitTorrent v1 were plausible substrates in 2015, but no longer. I think Ra
8. 698.▲
   by cjbprime 6y ago

   There's the Tex Yoda and other Tex keyboards -- I suppose if nothing else there's buying one of those keyboards and repurposing the TrackPoint and its PCB if necessary?
9. 699.▲
   by cjbprime 6y ago

   Thanks for the gallery! I'm surprised there aren't more integrated pointing devices (like TrackPoints).
10. 700.▲
    by cjbprime 6y ago

    Does Arch have an official package manager yet? Was extremely weird to try it out last year and want to install some AUR packages, and every package getting tool seemed to describe itself as deprecated or unsupported.
11. 701.▲
    by cjbprime 6y ago

    https://twitter.com/EveForster/status/1309096676158836737?s=... It is rarely worth it to read individual studies in a field you aren't expert in. Most claimed findings are false. If something works there&#x27
12. 702.▲
    by cjbprime 6y ago

    Bonus challenge: Use WebRTC to find the internal IP of the connecting device, then use DNS rebinding to port scan the device itself and report those open ports :)
13. 703.▲
    by cjbprime 6y ago

    It's not mentioned in the post, but it seemed like you also get access to past and future trip itineraries. Seems like a big deal for a past head of state to me.
14. 704.▲
    by cjbprime 6y ago

    Extremely surprised to see AGPLv3 used instead of GPLv3, given that this looks like binaries that you install on a device rather than a network service you connect to. Anyone know what's up with that?
15. 705.▲
    by cjbprime 6y ago

    It's not that clear. The sense I picked up from reading accounts of people who've met him in scientific contexts is that he would ask nonsensical questions, exhibiting an unwillingness to put in the effort to understand the basics
16. 706.▲
    by cjbprime 6y ago

    No-one is arguing that humans can't be complicated enough to have separate and complex facets to their lives. We're arguing that, in this case, the facets weren't actually separate. Here is a quote from a New York Magazine wr
17. 707.▲
    by cjbprime 6y ago

    That's not the opposite of my point -- you're just rephrasing it. If I can buy a cheap roof for $2k but have to replace it every year, or an expensive roof for $15k that will last 50 years, then LONG TERM the cheap roof is the mor
18. 708.▲
    by cjbprime 6y ago

    The way I see it: if you had infinite time and money then you would build a native app for each platform you care about, and when you choose e.g. Electron instead you're making a tradeoff because of your available resources. When peopl
19. 709.▲
    by cjbprime 6y ago

    Not a lawyer, but the AI training part doesn't seem relevant to this question. You can already take photos of restaurants and electronics, and after doing so you can use the photos because you took them and you're therefore the co
20. 710.▲
    by cjbprime 6y ago

    I'm responding to: > The chance of "filecoin" or whatever else existing 12 months into the future is astonishingly low. I actually think the chance of Filecoin existing in a year is close to 1. It's not due to a predi
21. 711.▲
    by cjbprime 6y ago

    I can generally agree about random ICOs, but for what it's worth the Filecoin team is world-class distributed systems talent. I wouldn't say this about any other ICO. (I don't own Filecoin tokens and have nothing to gain by t
22. 712.▲
    by cjbprime 6y ago

    Does this mean they actually did (do now) have funding for all those laid off employees?
23. 713.▲
    by cjbprime 6y ago

    Not sure exactly how to ask this, but since $125k is well above US market rate in low cost of living areas: have you considered the possibility that they asked for more because other aspects of the work seemed extremely unattractive?
24. 714.▲
    by cjbprime 6y ago

    It's really hard to take a positive story away from the FBI interaction. Accidentally ending up in an FBI interview without a lawyer present or briefing you on how to avoid perjury is the stuff of nightmares.
25. 715.▲
    by cjbprime 6y ago

    You'd have to completely reproduce the research in the blog post.
26. 716.▲
    by cjbprime 6y ago

    Yeah, I think it's actually the reverse: the SCTP is being tunneled inside UDP anyway, and adding in SCTP allows for a reliable channel to be built on top of the unreliable primitive. i.e. SCTP is used by DataChannels to add the opt
27. 717.▲
    by cjbprime 6y ago

    It's especially odd since WebRTC DataChannels actually use SCTP-tunneled-inside-UDP, rather than router-level SCTP datagrams.
28. 718.▲
    by cjbprime 6y ago

    And what's a "transaction"?
29. 719.▲
    by cjbprime 6y ago

    I got it on my Mac laptop. I have an Android phone, but it's running Android 10, which isn't vulnerable. I wonder what the actual vulnerability was. The article links to an entire bulletin of fixes.
30. 720.▲
    by cjbprime 6y ago

    I'm not sure there are many attractive targets left who are uncontactable by email and SMS for three continuous days.