justicz

18 ms·

151.
by justicz 7y ago
Hi HN! I was researching charities a while ago when I came across this excellent presentation by the founder of the Against Malaria Foundation, Rob Mather: https://www.youtube.com/watch?v=E5wr3u8Gjwg During the Q&A at t
152.
Show HN: A site I made to donate 10k mosquito nets to charity(giveanet.org)
3 points by justicz 7y ago|1 comments
153.
by justicz 7y ago
If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your o
154.
by justicz 7y ago
Maybe they mean CSRF? Then things make more sense since you can’t guess the field names cross-origin.
155.
by justicz 7y ago
I’m a little confused, which part of my comment would require persistence? I was suggesting a lulzy payload that would prevent the user from _actually_ restarting their device by changing the behavior of the power button. As a means of bypa
156.
by justicz 7y ago
Ha, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume do
157.
by justicz 7y ago
I’ve used this trick with a 64-bit block cipher (base-32 encoding the result) to generate short, unique public identifiers (to put in URLs) for entries in a database based on an integer primary key.
158.
by justicz 7y ago
It's not on master: https://github.com/Exim/exim/tree/exim-4.92.2%2Bfixes/doc/do...
159.
by justicz 7y ago
Yes! I’ve been having this issue for days but assumed it was just me. It is particularly frustrating for sites like Reddit where the AMP version is too aggressively cached and misses most of the recent comments.
160.
by justicz 8y ago
You are right to call out the difference between "control" in the sense of keys and "control" in the sense of a network adversary. I should have been more careful with my wording there. It is true that if 35% of the part
161.
by justicz 8y ago
In this case the Chinese government can kill the liveness of the network (preventing it from producing new blocks), but not the safety of the network (they can't fork the chain). Your question has changed into: "doesn't the s
162.
by justicz 8y ago
(I work for Algorand) This is false. The BFT protocol that Algorand uses guarantees that each round may have exactly one block (up to our security assumptions with regard to honest stake); this is one of the protocol’s “safety” guarantees.
163.
by justicz 8y ago
(I work for Algorand) The project will be open-sourced prior to the public launch of the network.
164.
by justicz 8y ago
The hash is done locally in the http worker process. I think you may be confusing headers in the HTTP response with headers in the internal protocol used to communicate with the worker process. The 201 response is not an HTTP response.
165.
by justicz 8y ago
Nope, I reported this bug several days ago. Funny coincidence though.
166.
Remote code execution vulnerability in apt/apt-get(justi.cz)
416 points by justicz 8y ago|160 comments
167.
Privilege Escalation in GVisor, Google's Container Sandbox(justi.cz)
4 points by justicz 8y ago|0 comments
168.
More curl bug bounty(daniel.haxx.se)
3 points by justicz 8y ago|0 comments
169.
by justicz 8y ago
In this case `apk` does a ton of processing on the package before checking that the hash matches the signed manifest, and the maintainers don't want to/can't change that behavior at this time. As a result, https would be a re
170.
by justicz 8y ago
Just to preempt some replies to this I can already picture: if you find more bugs, please report them to the maintainers I mentioned in the post and not via an HN comment!
171.
Remote Code Execution in Alpine Linux(justi.cz)
286 points by justicz 8y ago|106 comments
172.
Remote Code Execution on packagist.org(justi.cz)
19 points by justicz 8y ago|1 comments
173.
by justicz 8y ago
It’s even more wild when you consider that these companies are relying on all of these dependencies to be secure, and to lack intentional backdoors.
174.
by justicz 8y ago
Hi, apologies for not replying to this last week when you originally posted this! I think this is really good feedback, and I agree it would be very cool to build a community of hackers on BountyGraph. I'd really like to build a "
175.
by justicz 8y ago
> The article makes a good point that it's very hard for small projects, like the team running Homebrew, to fund their security, yet they are likely to be a target for quite high end attackers, given the access that can be gained by
176.
by justicz 8y ago
Thank you -- added to the to-do list :)
177.
Show HN: BountyGraph: Crowdfunded Bug Bounties and Security Audits(justi.cz)
23 points by justicz 8y ago|8 comments
178.
Compromising Thousands of Websites Through a CDN(justi.cz)
3 points by justicz 8y ago|0 comments
179.
by justicz 9y ago
I didn't mention it in the post, but npm was patched up before the update was publicly released. The CouchDB team coordinated with some of the bigger customers in advance (I also specifically requested that they do this in my original
180.
by justicz 9y ago
Here's CouchDB's official announcement of the vulnerabilities: https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-... I really appreciated the quick response of the CouchDB team and how the

More ›