kpcyrd

29 ms·

271.
by kpcyrd 11y ago
xml is so complex and poorly understood, even big companies like google and facebook have failed to implement xml parsing securely, see xxe attacks. If you didn't know it's possible to configure the xml parser insecurely you might
272.
by kpcyrd 11y ago
The page you've linked links to https://github.com/DrKLO/Telegram for the android client.
273.
by kpcyrd 11y ago
The commit that introduced this: https://github.com/DrKLO/Telegram/commit/a93d2994842ef694442... > Showing 208 changed files with 5,479 additions and 1,841 deletions. It looks like they squash all their co
274.
by kpcyrd 11y ago
So they know about vulnerabilities in all those products and keep them private for profit? Good thing the secret services have no access to those exploits. Fun times we live in. Edit: /s was omitted as an exercise for the reader.
275.
by kpcyrd 11y ago
ipfs is way easier to use compared to libtorrent.
276.
by kpcyrd 11y ago
Persona works by proofing you "are" that email. Your email provider needs to adopt this. If you run your own mail server you can do it yourself, if you don't, you can register with mozilla as a fallback.
277.
by kpcyrd 11y ago
Have you had a look at the code? I found a remote code execution 15min after waking up: https://github.com/ipfspics/server/issues/10
278.
by kpcyrd 11y ago
weakdh can be mitigated client side. The website[0] itself has a test for it, which works by requesting this file[1]. [0]: https://weakdh.org/ [1]: https://dhe512.zmap.io/dhe512test.js
279.
by kpcyrd 11y ago
I think it's amazing that there are so many security conscious people that are very sensitive about passwords and storing them as plaintext is worse then hitler, but nobody questions how we're still stuck with plain shared secrets
280.
by kpcyrd 11y ago
Did you just refer to your own website in third person?
281.
by kpcyrd 11y ago
Also a cool way for a spammer to verify if somebody is receiving those mails.
282.
Symantec caught issuing rogue Google.com certificates(boingboing.net)
2 points by kpcyrd 11y ago|0 comments
283.
S/party/hack/ like it's 1999 – Terminal escape sequences(openwall.com)
1 points by kpcyrd 11y ago|0 comments
284.
by kpcyrd 11y ago
Obligatory: http://craphound.com/spamsolutions.txt
285.
by kpcyrd 11y ago
disclaimer: no crypto expert. There's a concept of authenticated encryption, so your connection isn't just confident, you're also making sure nobody tampered with the content. There are multiple ways to assure that. There is
286.
by kpcyrd 11y ago
Certification is tld agnostic. The only plausible reason to revoke certs by tld would be an error in the dns root for .pw, which would be bad for a company that verifies domain ownership as a business.
287.
by kpcyrd 11y ago
How do you tell your trusted minifier has no exploitable bugs?
288.
by kpcyrd 11y ago
The quoted link discusses backdooring js by writing legit code that turns malicious through minifier bugs. The only way to be sure is not minifying the source.
289.
by kpcyrd 11y ago
Agreed. I was refering to the ambiguous name of the project. We're going to have a very hard time talking about end-to-end crypto to consumers without at least one person confusing this with googles addon. (Thanks google)
290.
by kpcyrd 11y ago
> end-to-end is NOT production ready This sounds wrong, given that "end-to-end encryption" as a concept is very much production ready.
291.
by kpcyrd 11y ago
Ubuntu in comparison: https://fixubuntu.com/
292.
by kpcyrd 11y ago
How much do you pay for your hackernews account?
293.
by kpcyrd 11y ago
Actually, it's their effort to prevent AMO from ending up as malware riddled as the Chrome Store. Addons are running in the chrome context and are thus pretty powerful. It's trival to compromise the whole computer if they aren&#x2
294.
by kpcyrd 11y ago
I don't think this is ready for a mass deployment yet, but have a look at namecoin[1] and cjdns[2]. cjdns generates a keypair and maps the fingerprint of the public key to an ipv6 address, so the ip address can be used to verify the se
295.
by kpcyrd 11y ago
The comment isn't sent to the server during the authentication
296.
by kpcyrd 11y ago
http://ascii.textfiles.com/archives/1011
297.
by kpcyrd 11y ago
The parent mentioned QA, it would work for that. For antispam you could add a filter for emails to the direct address without suffix. Personally I prefer aliases, but I think they are very rare on freemailers.
298.
by kpcyrd 11y ago
For updates: http://istdasverfahrengegennetzpolitikschoneingestel.lt/ (is the case against netzpolitik already dropped) Nein -> No Ja -> Yes
299.
by kpcyrd 11y ago
This isn't the case anymore. Since CORS was introduced, you can send xhr GET Requests to arbitrary domains. The browser then checks if the appropriate CORS headers are set. If they are, you can access the response. If they aren't,
300.
by kpcyrd 11y ago
If you scroll to the download section you can see that the captcha check is completly client side. The bot won't even notice there's a captcha unless they're executing js.

More ›