ejcx

35 ms·

481.
by ejcx 11y ago
Ahh that is a use case I hadn't considered. I guess it would be pretty useful if some type of basic webserver was required.
482.
by ejcx 11y ago
This looks pretty neat actually. A ton of effort clearly went into it and it looks like the code is really well written with pretty well thought out interfaces "Its main goals are security.." Is it actually? I also don't real
483.
by ejcx 11y ago
This article mentions Schuyler Towne at the end. I've watched Schuyler talk[0][1] at RVASec (a small richmond va security conference) the last couple years. If you find locks even almost remotely interesting, Schuyler is the guy who wi
484.
by ejcx 11y ago
One awesome thing I found recently was the golang exec package. I do a lot of security things and I attempted to write vulnerable code that shells out to do some purpose with some user provided data concatenation in. I.... Couldn't fig
485.
by ejcx 11y ago
I don't think all companies interview like that. In my honest opinion, the interviewing game is changing if you don't interview at any of the giants. You can also ask about what the on-site interviews are like before you commit to
486.
by ejcx 11y ago
I think this is a good example of a hack. She used the say command as a practical joke. That's pretty good to me. I don't like when people start trying to pick when this word is appropriate to use. The word is really old and has b
487.
by ejcx 11y ago
Obviously within reason. Being 24, I don't currently worry about things like 'heart health'. Maybe I will in the future, but for now I'm just trying to take care of the big things like regular exercise and healthy life-l
488.
by ejcx 11y ago
Powerlifting - It allows me to eat what I want whenever I want because my body burns more calories at rest. It also is a good outlet for stress and rewarding when you hit goals that you worked towards. Calligraphy - Cheap to get in. Bought
489.
by ejcx 11y ago
I like the project. You integrated a lot of well known and standard packages that people writing Go-WebApps would want, and didn't make the project super heavyweight. Very useful and still very light. I will definitely be using it, sin
490.
by ejcx 11y ago
Usually you don't check your own code for security vulnerabilities. It's kind of like reviewing your own writing for grammatical errors, which can be difficult. It can be done but if you don't have experience to know what you
491.
by ejcx 11y ago
There are a TON of different CSRF schemes and once you have billions of requests per day, storing and distributing each CSRF token for each user can be a large burden. Most advanced CSRF schemes use some crypto primitives in a manner like c
492.
by ejcx 11y ago
One thing to note. The md5 and sha1 interfaces have a second param which prevents this bug. Instead of returning a string it will return binary data which won't get coerced to a float. For example: <?php if (md5('2406
493.
by ejcx 11y ago
When projects I have fail I am generally pretty proud to talk about them. Usually it means that I have some new weird subset of knowledge that very few other people have. This is crazy cool. People, technical and non-technical, generally lo
494.
by ejcx 11y ago
If you haven't played with AFL I recommend spinning it up for a night and trying it out. My experience was pretty fun. The setup wasn't that difficult if you RTFM. I rebuilt OpenSSL from source the way AFL wanted and started throw
495.
by ejcx 12y ago
That's crazy interesting and now I have some reading to do. I still view the grading scale as a something that should not change, however. I'm not surprised a syllabus is not a contract but I do think that most universities, when
496.
by ejcx 12y ago
If this college class operates like the ones I had then I think the professor is in the wrong. On the first day I would be given a syllabus that clearly outlined the grading scale and how the grade was calculated. I look at that like a cont
497.
by ejcx 12y ago
Username enumeration is a valid concern. Requests on the login form (and some other places) are throtted. If you get too many emails wrong you will start only getting errors.
498.
by ejcx 12y ago
I do a lot of App Sec related things and I actually use mostly Chrome dev tools and command line instead of burp and other tools. The way I reproduced the bug when it was reported was by using the "Copy to curl" feature in Chrome,
499.
by ejcx 12y ago
Oh okay I was mistaken then. I believe the race condition is on the rise in terms of severity and importance. Developers are aware of common OWASP bugs, but this type of race condition is often overlooked and developers are going to NEED to
500.
by ejcx 12y ago
I actually fixed the issue that was reported to LastPass. I could be mistaken but I believe he reported the security issue through our regular support channel which is why it took three days to see (instead of our security channel). From th
501.
by ejcx 12y ago
I really like writing hack and haven't tried PHP7. It makes a huge difference having types. If you have a function function dowork(@?string $w) You can allow execution to continue but still log the error. It's made me awa