homakov

65 ms·

721.
Facebook profile detector(sakurity.com)
2 points by homakov 12y ago|0 comments
722.
by homakov 12y ago
Which one is profitable there?
723.
by homakov 12y ago
They pay ten times less
724.
by homakov 12y ago
I don't know any program except FB with such bounties for bugs in web apps. If you want to hack for money, focus on FB forget about others.
725.
by homakov 12y ago
I spent a while in Mui Ne near Phantiet. And a little bit in Dalat. From my experience Dalat is incredibly nice place
726.
by homakov 12y ago
There's entire movement of perpetual travelers and laws clearly state it's legal.
727.
by homakov 12y ago
It is easy, just not all people know about it. Rule is simple - not be tax resident and spend < 6 months in your home country. Other proofs aren't enforced afaik. It's how it works in Russia.
728.
by homakov 12y ago
> or prove that you no longer have any lasting connection to Sweden (no partner or children there, no house or apartment and no ownership in any companies). Which is not hard at all: Don't have kids there, house or ownership. And yo
729.
by homakov 12y ago
It works in all countries afaik. "you stay in Canada for less than 183 days in the tax year." makes you non-resident.
730.
by homakov 12y ago
The US company may be required to pay extra tax, but i just add it on top of my consulting rate coz i don't care about other people's taxes. On my side i don't owe the US anything
731.
by homakov 12y ago
FYI if you are perpetual traveler and stay less than 3/6 months in every country, you won't be tax resident anywhere which means no taxes at all. Doesn't work for US citizens. (I'm Russian who travels for last 3 years an
732.
by homakov 12y ago
That's right tourist visas can't help forever. But "permanent residency in Thailand seems to require a degree" cannot be true, rather working visa requires it. Other migration ways such as investment visas are not so str
733.
by homakov 12y ago
I was born in Russia, and i drop out of engineering univ. myself being 18. Life is awesome now, you can make much more money doing consulting, and you can get tourist visa for Europe/USA to make sure those countries suck (I was in pret
734.
by homakov 12y ago
i was in Sao Paulo few days ago, well, comparing to Singapore it's like 100 times more dangerous
735.
by homakov 12y ago
True, but if your budget <$5k month, it's pretty sweet. If more, why live in 3rd world country when you can stay in much sweeter Hong Kong.
736.
by homakov 12y ago
+1, wouldn't recommend Brazil if you love your life
737.
by homakov 12y ago
You should also add "Visa" field. E.g. any american can live in Europe up to 3 months, but in Thailand it's just 1 m. I lived in Bangkok for about a year, thought I love that city, now their visa policy got stupid, and I woul
738.
by homakov 12y ago
1) extra random is not going to help, in long term any "noise" disappears and signal can be seen. 2) such attacks are infeasible most of the time, so we don't need to worry
739.
by homakov 12y ago
It has nothing to do with passwords and hashes. API keys are not hashed normally. And all kinds of signatures. It's about way you compare strings from params with secret strings
740.
by homakov 12y ago
In theory it works like a charm, but did anyone actually attacked for months? Speaking of web apps, locally it can work fine but in reality the more people are requesting the server the longer it will take to process our request. Days turn
741.
by homakov 12y ago
Thanks for the link, I truly agree attack is very difficult to exploit, most of the time just impossible. I did some tests locally long time ago https://gist.github.com/homakov/4953145 and signal was extremely weak.
742.
by homakov 12y ago
I didn't mean to claim "it will work just great" I claimed "it is supposed to be 6% more efficient of what we have now". In theory, this particular comparison attack is entirely based on amount of operations, and by
743.
"Trackify" security puzzle(sakurity.com)
2 points by homakov 12y ago|0 comments
744.
by homakov 12y ago
Yeah as people mentioned since I wrote about it back in Jan http://homakov.blogspot.com/2014/01/using-content-security-p... there was a massive discussion how to mitigate it. They decided to allow paths which co
745.
by homakov 12y ago
Idea of CAPTCHA is to differ a human from a bot. By making bot's job harder you don't stop them.
746.
by homakov 12y ago
This is another reason why OAuth should be on a separate subdomain. (First reason is XSS on facebook.com which can grant any permissions to any app.)
747.
by homakov 12y ago
What about other asians who speak same language? it's more fun to hang out with your nationals, mentality etc.
748.
by homakov 12y ago
In fact it is a security issue but IMO you also should have emphasized: 1) amazon sucks at fixing bugs 2) clickjacking can be a serious issue
749.
by homakov 12y ago
Most frameworks/servers don't do that. It's bad design of web specs, not a bug actually. Developers don't have to remember about it... And yeah, I added default_headers to Rails a while ago.
750.
by homakov 12y ago
"Security hole" is a loud title. Is it worth a blog post at all? meh

More ›