daeken

267 ms·

1. 2251.▲
   by daeken 16y ago

   Sorry, I actually intended to reply to the parent of your comment -- reposted and deleted my response just after you commented. Parameterized queries aren't a panacea, but they seem to mitigate most of the issues. That said, a lot of peopl
2. 2252.▲
   by daeken 16y ago

   I think one key difference is in when the software was developed. If I had to guess, most software developed in the past 5 years (being conservative here) is most likely not vulnerable to SQL injection, simply because doing things the righ
3. 2253.▲
   by daeken 16y ago

   > It's not just SQL, either; I've used it to get XSS out of corrupted AES decryptions as well. How would you go about such a thing? My initial thought is to simply permute over the controllable bytes and see what comes out, looking for
4. 2254.▲
   by daeken 16y ago

   It's not the fact that you tried that's important. It's that if you try, you have at least some chance of success; if you don't try, then failure is implied.
5. 2255.▲
   by daeken 16y ago

   I've been too broke to do anything Christmas-wise for the past nearly 4 years, so I'm gonna be getting awesome gifts for family and friends, and finally getting myself a toy as well: a chapman stick ( http://stick.com/ ). Been wanting on
6. 2256.▲
   by daeken 16y ago

   > I like 'daeken (I work with him!), and I know and respect that he has a very different take on intellectual property than I do, but his take on this seems a bit breathless. Quite honestly, this was a post written in about 20 minutes s
7. 2257.▲
   by daeken 16y ago

   2009jerseys.com, 51607.com, amoyhy.com, b2corder.com, bishoe.com, borntrade.com, borntrade.net, boxedtvseries.com, boxset4less.com, boxsetseries.com, burberryoutletshop.com, cartoon77.com, cheapscarfshop.com, coachoutletfactory.com, dajaz1.
8. 2258.▲
   by daeken 16y ago

   > It's all a lost cause in my opinion. The People are corrupt and the Government is certainly corrupt. What can we do now? We just have to wait for the inevitable implosion. You know, you're probably right. In all likelihood, it's goin
9. 2259.▲
   Further Freedom Attacks(daeken.com)

   191 points by daeken 16y ago|64 comments
10. 2260.▲
    by daeken 16y ago

    Hardware USB analyzers are also essential when you're diagnosing problems with the USB stack itself.
11. 2261.▲
    by daeken 16y ago

    Wow. It's rare that I see an article completely and utterly without worth, but here we have one. The entire article is filled with empty statements like "If one person at Apple wants this to happen, it will. It’ll never happen for Android
12. 2262.▲
    by daeken 16y ago

    Do these set off metal detectors?
13. 2263.▲
    by daeken 16y ago

    I couldn't disagree more. Knowing more about your body is always a good thing -- the fact that many people won't know what to do with that information is inconsequential. It may not make sense for many (most) people to buy into 23andMe,
14. 2264.▲
    by daeken 16y ago

    No need for an exokernel here. A microkernel could enable the same thing, since your network stack would be Yet Another Service (TM). This could easily be implemented on the likes of L4.
15. 2265.▲
    by daeken 16y ago

    I think that the thing that bothers me most about this story is how plausible it all is. That said, it's one of my favorites of his (although none of the rest come close to Printcrime: http://craphound.com/?p=573 ).
16. 2266.▲
    by daeken 16y ago

    I'm also curious as to how this will interact with system memory and IO. Not many details, but I can't help but be insanely excited -- this opens up so many possibilities in terms of crypto... not to mention the demoscene! Edit: Just got
17. 2267.▲
    by daeken 16y ago

    I also have a five-figure rep on SO and haven't received any job offers. However, I was just on the hunt for a new job a few weeks ago, and I'm fairly confident that my rep did help me get in the door in certain situations. No way to actu
18. 2268.▲
    by daeken 16y ago

    Oh man, now I want to go pick up an iPad and spend a month writing a bunch of DSP code for CoreMIDI. Damn you Apple!
19. 2269.▲
    by daeken 16y ago

    CEGUI is really nice in terms of the flexibility and design, but the API is terrible. BUT, don't let that stop you from using it. Spend a day writing a wrapper around the API to CEGUI or whatever bindings you're using (e.g. the Python bin
20. 2270.▲
    by daeken 16y ago

    I have looked at Panda3D, but I haven't built anything with it, so I really can't compare the two very well. That said, Panda3D's goal is to be a game engine, rather than just a graphics engine, as with Ogre. I imagine between that and th
21. 2271.▲
    by daeken 16y ago

    Pygame is a great way to get started quickly. Once you move into the 3d world, though, I seriously recommend pyogre (and its bindings for Bullet and all that). You won't get the knowledge of how to write your own engine, but if you want t
22. 2272.▲
    by daeken 16y ago

    I'm more curious about this as a general trend. I always see people advising sphere-frustum tests for these situations, but I've never really understood how it works out better than box-frustum. I should really run some tests not just aga
23. 2273.▲
    by daeken 16y ago

    They don't need to open their analysis, they just need to open the interface for the device itself -- the work the community has already partially done. It'll happen eventually anyway (soon, most likely), so it has a minimal downside for t
24. 2274.▲
    by daeken 16y ago

    Yea, I know sphere-frustum checks in and of themselves are cheap, but when you consider the cost of false-positives for octree traversal and the cost of sending unnecessary data to the GPU, it doesn't seem like it makes a lot of sense to me
25. 2275.▲
    by daeken 16y ago

    This is a pretty damn cool article, but it's an odd choice of bounding spheres for frustum culling of octree nodes. Yes, it's cheaper in terms of CPU time than using the actual octree nodes (which are either cubes or boxes -- cubes in this
26. 2276.▲
    by daeken 16y ago

    I received a piece of advice from a businessman once: All businesses start in the grey. Is that a good thing? Not really. Is that a bad thing? Well... not necessarily.
27. 2277.▲
    by daeken 16y ago

    Sneakernet from internet-infected machines, via USB drives.
28. 2278.▲
    by daeken 16y ago

    Why do I feel like I'm being indirectly trolled? I mean, this woman can't be serious about this, right? Sad. Seriously, seriously sad...
29. 2279.▲
    by daeken 16y ago

    I really want to do this with the support of the manufacturer for a change; that's what actually makes it difficult to choose a target. I've hacked a lot of stuff in the past, but it's never been with the manufacturer's support, and I thin
30. 2280.▲
    by daeken 16y ago

    This is seriously awesome. While I've spent a lot of time reversing network protocols (and thus had a good foundation on which to pick up USB hacking (which I documented at http://daeken.com/hacking-the-belkin-network-usb-hub and, to a l