dgl

11 ms·

31.
by dgl 1y ago
Cool! For the bad apple one; I tried something like that, it works if you're directly querying the authoritative DNS server, but if a cache is involved the records will be re-ordered by randomisation (even in some cases with TTL=0). Th
32.
by dgl 1y ago
I put a link to[1] in the article, which was previously discussed here[2] with a correction to that article. Basically there's a 2 byte length header on TCP DNS responses, limiting the payload (i.e. the DNS message inside) to 64 KiB.
33.
Images over DNS(dgl.cx)
201 points by dgl 1y ago|50 comments
34.
by dgl 1y ago
> A former colleague suggested this idea in 2014 and I haven't been able to stop thinking about it. - I am maybe having a midlife crisis and this is cheaper than a sports car. I love the honesty.
35.
by dgl 1y ago
Just looking for "const _0x112" as an IOC seems a bit false positive prone: https://github.com/search?q=%2Fconst+_0x112%2F+lang%3Ajs&typ... (most of that code is pretty dodgy obviously, but it's not uniqu
36.
by dgl 1y ago
It's not; the git format defines it as a positive integer, see git help commit: DATE FORMATS The GIT_AUTHOR_DATE and GIT_COMMITTER_DATE environment variables support the following date formats: Git internal format
37.
by dgl 1y ago
Chrome can also import/export in this format, chrome://bookmarks, dots menu at the top right, export bookmarks. The file it generates has: <!DOCTYPE NETSCAPE-Bookmark-file-1>
38.
by dgl 1y ago
Not exactly, but close, the BBC made Micro Men (2009) which covers the whole era, in a relatively accurate way... https://en.wikipedia.org/wiki/Micro_Men
39.
by dgl 1y ago
I don’t really want to give it credit by linking to it, but this seems to refer to putty[.]org which is using its search ranking to push things unrelated to PuTTY.
40.
by dgl 1y ago
> […] isn't any particular risk in a world of letsencrypt where an attacker (who gained access to that box) could simply request a new SSL certificate You can use CAA records with validationmethods and accounturi to limit issuance,
41.
by dgl 1y ago
Unless you're using ECH (encrypted client helo) the endpoint is obscured (known keys), not concealed. PS: HAProxy definitely can do this too, something using req.ssl_sni like this: frontend tcp-https-plain mode tcp t
42.
by dgl 1y ago
Clients supporting QUIC usually also support HTTPS DNS records, so you can use a lower priority record as a failover, letting the client potentially take care of it. (See for example: host -t https dgl.cx.) That's the theory anyway. Yo
43.
by dgl 1y ago
https://github.com/vet-run/vet/pull/22
44.
by dgl 1y ago
Here's an example of a phish actually using it: https://abyssdomain.expert/@filippo/114868224898553428 (also note "cat" is potentially another antipattern, less -U or cat -v is what you want).
45.
by dgl 1y ago
https://radar.cloudflare.com/routing might be of interest for aggregated data that doesn't require a complete understanding of the internet. The global looking glass that bgp.tools has is pretty powerful too, but it g
46.
by dgl 1y ago
Except it is sourced from /etc/rc, and that’s a shell script which obviously depends on the shell and some other pieces. If you want an immutable base you kind of need to make the whole (base) system immutable (and that is possibl
47.
by dgl 1y ago
Same. I used to read a bunch of things offline using Instapaper, but that was when I commuted on the tube (no signal, then), now I hardly commute. I still save things (in a text file) but try to save them with grepable keywords, so I can fi
48.
by dgl 1y ago
I'm not privy to the exact communications that happened, but per the Ubuntu changelog they prepared a patch a week ago[1] (which is about the normal timeline for notification per[2]). Homebrew is not on the distros list, so likely woul
49.
by dgl 1y ago
I've adjusted that paragraph to make it more clear how writing a file can lead to code execution.
50.
by dgl 1y ago
Submodules can be any URL (and recursive), so for GitHub to block this totally would require them to crawl other forges (and some URLs could be private URLs, but GitHub likely can't tell that apart from an attacker who is just blocking
51.
Breaking Git with a carriage return and cloning RCE(dgl.cx)
373 points by dgl 1y ago|162 comments
52.
by dgl 1y ago
With make allnoconfig it also takes <30s on a recent-ish Intel CPU (12th gen; i7 12700). As low as 20s if it's cached and with make -j20.
53.
by dgl 1y ago
ChromeOS has a quite interesting design to do this: https://www.chromium.org/chromium-os/chromiumos-design-docs/... Essentially: keep some minimum values for time. Then do a single HTTPS request, ignore the valida
54.
by dgl 1y ago
The ChromeOS terminal (hterm[1]) is actually a pretty good terminal, so even a terminal might justify a browser context. Blink[2] on iOS for example uses it. [1]: https://hterm.org/ (although in the way they do Google seems
55.
Can your terminal do emojis? How big?(dgl.cx)
178 points by dgl 1y ago|161 comments
56.
Blink and you'll miss it – a URL handler surprise(dgl.cx)
3 points by dgl 1y ago|0 comments
57.
by dgl 1y ago
Sorry, you have been blocked You are unable to access daviey.com Looks like Cloudflare has decided the whole thing is dodgy. Or doesn't like my IP address...
58.
by dgl 1y ago
Don't use Docker, use podman (which has a registries.conf for this, with many settings). You can then use podman-docker to have command line Docker compatibility. Podman is more secure than Docker too, by default it runs as a user, rat
59.
by dgl 2y ago
Unfortunately this makes a mistake by using a short commit ID: "(e.g. a5b3abf)" That's not a full commit ID, so it can still result in a mutable reference if either someone can find a clash[1] or if they can push a tag with t
60.
by dgl 2y ago
Getting the tree (at the root) is only a few requests (get the refs or HEAD, get the relevant commit, get the tree ID from that). If pack files aren't involved then that's literally 3 requests. Pack files make this more complex, b

More ›