jagracey

5 ms·

1.
by jagracey 7y ago
Commented above, but to follow up from yesterday, here is the next post. "Hacking GitHub with Unicode" https://news.ycombinator.com/item?id=21693550
2.
by jagracey 7y ago
Just posted another Unicode article to HN. "Hacking GitHub with Unicode" https://news.ycombinator.com/item?id=21693550
3.
by jagracey 7y ago
211 of the top 500 domains ( https://moz.com/top500 ) contain the letter 'i' within them. It may be worth checking out if they are also susceptible to the Turkish dotless 'i' problem.
4.
by jagracey 7y ago
I agree. I'll be releasing an article about this tomorrow. There are in-fact many security ramifications that have not been solved in practice.
5.
by jagracey 7y ago
Static Version: https://wisdom.engineering/awesome-unicode/amp/
6.
by jagracey 7y ago
Thanks for catching. It's a fairly complex subject matter- and particularly hard get extra eye balls willing to check for typos. - String length is typically measured in code units. - Funny enough, with Unicode normalization, multiple
7.
by jagracey 7y ago
For exploration, additionally I'd recommend http://shapecatcher.com/ It allows you to draw the shape you are looking for, and with some form of ML, sorts by similarity. It has come in handy a few times for finding the
8.
by jagracey 7y ago
Just a quick and scrappy "Ghost" blog running on a $5 Digital Ocean droplet with the usual analytics.
9.
by jagracey 7y ago
The Emoji emoji modifiers are pretty cool. - Skin color modifiers - Character combiners: - man [ZWJ] woman [ZWJ] boy [ZWJ] girl === family of 4
10.
by jagracey 7y ago
Unicode reverse character: 'hello \u{202e} world'; 'hello dlrow' // Visual equivalent
11.
Unicode Is Awesome(wisdom.engineering)
147 points by jagracey 7y ago|152 comments
12.
JavaScript – Putting Up the Christmas Decorators(jslogs.dev)
4 points by jagracey 7y ago|0 comments
13.
Ask HN: Any Performance Auditing *Firms* for JS Libraries?
1 points by jagracey 8y ago|0 comments
14.
by jagracey 8y ago
I got one about bypassing GitHub's authentication using Unicode on the company blog: https://blog.getwisdom.io/hacking-github/ I've wanted to write a deep dive on JS defense for a while now. Lots of cool stuf
15.
by jagracey 8y ago
I might be alone on this one, but I feel the Freedom-to-Tinker report was unfair to the analytics providers. I know the folks in the industry work really hard towards privacy and security. They go out of their way to make it clear that not
16.
by jagracey 8y ago
Great work yz-yu. Hope you've learned a lot- I've personally found the session replay space to be incredibly rewarding. However, as a session replay industry competitor and a former security researcher for most industry players, I
17.
by jagracey 10y ago
Don't forget to redefine numbers!
18.
Variable identifiers can effectively include whitespace(github.com)
19 points by jagracey 10y ago|3 comments
19.
by jagracey 12y ago
Approximately 3/4 of the top 30 status code checking tools are all vulnerable against basic XSS. Thought I'd share this rather fun method. Checkout "netcat security.gracey.ca 1500" for details.
20.
HTTP Status Code XSS(tools.seobook.com)
11 points by jagracey 12y ago|2 comments