clinta

48 ms·

181.
by clinta 11y ago
The browser could submit a special query to get the hash for victim.com/evil.js before running it. If victim.com returns the same hash, it's clean, if it doesn't respond, or responds with a different hash, fail in the same wa
182.
by clinta 11y ago
The hash would be correct. The JS file is the same. The key to the attack is: "the XSS attack is loading <script src=www.victim.com/evil.js hash=foo>". So victim.com was never hosting evil.js and never intended to serve
183.
by clinta 11y ago
The endpoints don't need to be in scope if they're not storing PII.
184.
by clinta 11y ago
I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is good and communication to the web app is encrypted, you do not have to secu
185.
by clinta 11y ago
From your description it sounds more like process changes were needed rather than hardware. If the sensitive data is all in a web app, you don't really need pre-boot authentication, and could even allow windows to automatically sign in
186.
by clinta 11y ago
Personally I think an interactive shell that works well with objects is incredibly valuable. I love working in PowerShell and I wish there was a good Python based shell that I could use to replace zsh. I spend a lot of time in iPython but i
187.
by clinta 11y ago
I ignore calls from some people, and I lazily answer texts. This works for most people, they get that if it's not important and time sensitive, they can email or text and I'll get around to responding. And if it is important they
188.
by clinta 11y ago
My only experience with MaxMind was the trouble we had when we got a new IPv4 assignment from ARIN. I filled out the form on their website the first week, our address was in the WhoIS records for our IPs, and our BGP announcements made our
189.
by clinta 11y ago
Don't use agent forwarding to any host you don't have exclusive root access to and are 100% sure isn't compromised. Anyone else who is root on a box you SSH to with agent forwarding can authenticate to other servers using you
190.
by clinta 11y ago
Josh Drake(the researcher who found the stage fright exploit) was interviewed on the last episode of the risky business podcast. His opinion is that iOS and Android are very similar in their level of security, but the barriers to entry in r
191.
by clinta 11y ago
I really wish that Microsoft and Apple would introduce tabbed windows for the entire OS with some good extensibility and customization options so that application developers aren't pressured into implementing window management as part
192.
by clinta 11y ago
This is part of the design of IPv6. There are (amost) never networks other than /64. This allows the possibility of generating addresses based on a mac address, and frequently changing addresses for privacy reasons. Most devices will n
193.
by clinta 11y ago
Why do you need to rewrite? If a pull request is not completed, you can continue to push it and the PR is updated to pull the latest commit.
194.
by clinta 11y ago
Does anyone know if the EU requirements for mandatory warranties on products affect free software and the ability to distribute them without warranty?
195.
by clinta 11y ago
A 3rd party logistics service can do the same thing. If my business is to connect customers with web developers, but one particular developer turns down nearly all the jobs I offer him, I'm going to stop wasting time sending him offers
196.
by clinta 11y ago
Not encrypting is better than not revoking a compromised certificate. A compromised certificate gives the user the impression that the connection is secure when it's security is compromised. A plaintext connection makes no false claims
197.
by clinta 11y ago
Automatic enrollment and renewal means that it's not a maintenance burden to have certificates that are valid for weeks rather than years. Short lived certificates reduce the cost of a certificate compromise and increase the security o
198.
by clinta 11y ago
No company should be incentivising companies to not revoke compromised certificates. Even if the cost is modest. It's more about not patronizing a company with such a bad business model than it is about the dollar cost.
199.
by clinta 11y ago
I disliked the part about setting up Vim on servers. Do you really want to be adding all the dependencies for your editor on every server? I'm an advocate of using the netrw plugin to edit over ssh directly and avoiding logging into se
200.
by clinta 11y ago
Go tells me that it's likely one self-contained portable executable. While wordpress and other php solutions can require quite a few dependencies. Saying it's 'easy to install' can be misleading. Some peoples definition
201.
by clinta 11y ago
Those tools require the users windows password to decrypt the encrypted blob. So yes, it does protect against offline reading of the files.
202.
by clinta 11y ago
The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against
203.
by clinta 11y ago
Agreed that if doing TCP, you either need to limit the PoPs, or be doing it with a an app that is highly resilient and capable of dealing with unexpected loss of a session and reconnections. The same is true of UDP. For stateless short burs
204.
by clinta 11y ago
First of all, I don't see how any of your comments are specific to TCP. Routing is all Layer 3, if you're going to have routing weirdness, or quirks that are specific to IPv4 and you don't have good cooperation with your upst
205.
by clinta 11y ago
The concepts of intellectual property and physical property are at odds and mutually exclusive. If physical property rights are respected and I own a pen and paper, or a hard drive, I have the right to arrange ink on the paper, or magnetic
206.
by clinta 11y ago
I'm so glad that you used a screenplay as an example, since Shakespeare created all his works without the benefit of copyright. What do you suppose was his economic incentive? Other examples of people creating great work without copyri
207.
by clinta 11y ago
As an ops guy, I'm going to remember this article and use it as a talking point for the benefits of static pages when devs want to put everything into their dynamic framework of choice.
208.
by clinta 11y ago
Some CDs are distorted because the mixers boost the volume until it clips. No doubt this could end up influencing a music style in the future. http://en.wikipedia.org/wiki/Loudness_war
209.
by clinta 11y ago
It's not just the trustworthyness of the browser vendor, but the scope. Any of the 177 delegates are trusted to sign for any domain on the internet. Further, those 177 delegates can mint CA=True certificates for anyone they like and ou
210.
by clinta 11y ago
I agree. In fact I think github is doing more to extend and extinguish. They are the ones who just introduced their own proprietary closed method of binary storage while git-annex was already there.

More ›