homakov

82 ms·

871.
by homakov 13y ago
Google is wrong IMO: there is no need to have such workaround. In rails we had similar problem https://community.rapid7.com/community/metasploit/blog/2013/... and fixed it by adding request.xhr? check on
872.
12 Days of HaXmas: Exploiting (and Fixing) RJS Rails Info Leaks(community.rapid7.com)
3 points by homakov 13y ago|0 comments
873.
Regexp Groups Overflow in Firefox(homakov.blogspot.com)
2 points by homakov 13y ago|0 comments
874.
Regexp Groups "Overflow" in Firefox(homakov.blogspot.com)
4 points by homakov 13y ago|0 comments
875.
by homakov 13y ago
Matasano is known crypto company, why would they volonterouly spend their working time fixing telegram for you? Hire them formfew days to see them in action.
876.
by homakov 13y ago
I am not trying to hide my real name. If you need my ID just ask.
877.
by homakov 13y ago
everything is possible. Furthermore, in Russia where i used to live, they don't need any charges, they can make them up from nothing.
878.
by homakov 13y ago
Never tried it but obviously it wont work. It is easier to start with actions than with dialog here.
879.
by homakov 13y ago
Taking into account this bug and twitter's response - they don't differ DMs from tweets much. Privateness of DM doesn't mean it to them what it means to us.
880.
by homakov 13y ago
So twitter should replace R&W DM to just R DM permission, because W DM comes automatically with R&W Tweets. Isn't it.. so wrong?
881.
by homakov 13y ago
Hm, are you sure cracking password and writing about a bug which you didn't exploit on other users are the same thing?
882.
by homakov 13y ago
i would replace "company" with "huge company with resources". If it wasn't twitter but e.g. some startup, sure I'd report it like everyone does. But twitter is like saying "back off, we are huge and we don
883.
How to send DM on Twitter w/o permission(homakov.blogspot.com)
19 points by homakov 13y ago|1 comments
884.
by homakov 13y ago
Since we are on the same page, could you help me in this discussion with nzkoz? https://github.com/rails/rails/issues/11509 we're talking about different things
885.
by homakov 13y ago
So what
886.
by homakov 13y ago
What is the point of hacking some random sites? Leave it to indian haxors.
887.
by homakov 13y ago
you definitely exaggerate your problem
888.
by homakov 13y ago
You're mostly right, but along with working scanner people should hire an auditor to fix real bugs. Or it is just useless, spending a lot of money annually for scanner forgetting about real vulns.
889.
by homakov 13y ago
Automated security audits are useless until we have some fancy AI
890.
by homakov 13y ago
I committed for a different reason, to fix long waiting issue in rails. Not to fix it on Github.
891.
by homakov 13y ago
Good job lol
892.
by homakov 13y ago
Haha i practised pull request fixing zero days for a while. Ppl asked me to stop
893.
by homakov 13y ago
Not perfect though. Intranet leaks
894.
by homakov 13y ago
Yes
895.
by homakov 13y ago
>An obvious fix would be to send that JavaScript with a content type other than "application/javascript" or "text/javascript"... but considering some browsers execute JS sent with the wrong content type I wo
896.
by homakov 13y ago
someone with admin session must visit this page. Are you admin? you check it on demo spree installation
897.
by homakov 13y ago
Relevant, but out of date. It was a bug in browsers, not in the apps anyway
898.
by homakov 13y ago
In my post RJS implies JS responders. RJS doesnt exist anymore
899.
by homakov 13y ago
this is slightly different vulnerability (JSON->JSONP upgrade) but it's really severe. Good find!
900.
by homakov 13y ago
you make logged in user to visit specially crafted page, where you attack him with cross site <script> tag. and leak the data.

More ›