homakov

67 ms·

751.
by homakov 12y ago
It is a bit of surprise to hear that. Of course delivering good reports is highly important but ability to sell it to a huge company at decent price plus explain why they need it, that is as hard as delivery, imo. Like with WAFs and anit vi
752.
by homakov 12y ago
> so the only asset we really have is our team Theoretically yes, but I assume at least 40% is getting the brand and your long term contracts (=guaranteed revenue for few years). In startup's acquihire the acquirer often gets rid of
753.
by homakov 12y ago
Oh also it's easy to check if you're logged in on Service1 using CSP. No user interaction, same results
754.
by homakov 12y ago
Do you still work for the company you sold because you have to or mostly because you like it?
755.
by homakov 12y ago
There are much more effective tricks to use in production. You can leak user's FB token for some huge client, and you get his email/name/bio.
756.
by homakov 12y ago
This exact "implementation" of socialism doesn't prove it does better job than capitalism would. FYI I'm Russian and you can imagine what communism was (it was hell). No need to remove socialism completely, just keep tax
757.
by homakov 12y ago
Lets set 40 hours as max and 10 hours as min. Now it is flexible enough.
758.
by homakov 12y ago
This is so senseless i dont know how to respond. It is like saying legal guns will increase the crime rate because they can kill. Companies compete to get specialists (look at how many perks average startup or google offers). Low skilled jo
759.
by homakov 12y ago
I love regular capitalism and hate all forms of socialism.
760.
by homakov 12y ago
I'd quit. I'm a specialist and will easily find another job.
761.
by homakov 12y ago
I love capitalism, I hate socialism.
762.
by homakov 12y ago
How exactly will it help? Employers are not stupid, they will pay the same money eventually, destroying the perks.
763.
by homakov 12y ago
Why does government set N hours at all ? It's must be up to business! E.g., if I have a software company, I want my employees to work 20 hours a week. Isn't it obviously better way for everyone?
764.
by homakov 12y ago
This is an issue - private friends should not have you as "public" friend in their friend list. It makes it not private.
765.
by homakov 12y ago
I proposed two techniques, putting all headers in Accept (works now) and allowing CORS-* headers by default (just a proposal)
766.
by homakov 12y ago
Not sure you made the right choice. This is how to use CORS without Preflights: http://homakov.blogspot.com/2014/01/how-to-use-cors-without-... And this is why JSONP is almost always a bad idea (for sensitive data
767.
by homakov 12y ago
This is another kind of threat but yes, MITM is game over for oauth2
768.
by homakov 12y ago
Yes but i serve it with sinatra
769.
by homakov 12y ago
I think just an external link will be great, because I don't want to remove the sakurity logo :)
770.
by homakov 12y ago
It's using free plan on heroku, so if it will be down repo is available at https://github.com/homakov/oauthsecurity
771.
OAuth Security Cheatsheet(oauthsecurity.com)
125 points by homakov 12y ago|15 comments
772.
by homakov 12y ago
/\host.com
773.
by homakov 12y ago
Redirects are hard to get right. Bypass 1 - //host.com. Even if you will use URI library Bypass 2 - ///host.com
774.
by homakov 12y ago
So rare that I'm not sure why this got any attention. There are more interesting bugs to look at, which i do see in the wild a lot (e.g. redirect_to params[:return_url])
775.
by homakov 12y ago
Oh, among those 17 results only 3 have "*action" and none of them is relevant. Now it will hit the front page and everyone will rant how vulnerable rails is not reading the details. Same happened with "oauth covert redirect&q
776.
by homakov 12y ago
:action is not vulnerable to this particular bug. Although that legacy code is completely vulnerable to GET-based CSRF.
777.
by homakov 12y ago
Another vulnerability, both seem to me just as Rafael said - extremely unlikely to be exploitable. *action? Why? 17 results https://github.com/search?l=Ruby&q=routes+%2Aaction&ref=sear...
778.
by homakov 13y ago
My 2 pennies http://homakov.blogspot.com/2014/05/covert-redirect-faq.html
779.
Covert Redirect FAQ(homakov.blogspot.com)
12 points by homakov 13y ago|0 comments
780.
by homakov 13y ago
Not different at all.

More ›