kpcyrd

36 ms·

331.
by kpcyrd 11y ago
(SRI being backwards-compatible is true, though)
332.
by kpcyrd 11y ago
This was already proposed and got rejected because of cache poisoning issues. IF you're able to create a hash collision and IF you're able to deliver (for example) jquery first, your malicious version would be cached and injected
333.
by kpcyrd 12y ago
Best curses game I've ever played. I'd love to have this in the official debian repos.
334.
by kpcyrd 12y ago
Even if there's no unique ID, if you've installed a lot of plugins this combination can uniquely identify you. If you query addon updates daily, they could associate your IP of the day with your "I have installed these addons
335.
by kpcyrd 12y ago
https://www.google.com/maps/place/33%C2%B030%2752.5%22N+73%C...
336.
by kpcyrd 12y ago
There are some surprises if you go down that hole. The best argument I could find for "disable root login" was "the attacker has to guess the username, too", which doesn't align with Kerckhoffs's principle and
337.
by kpcyrd 12y ago
alias fix-permissions="chmod -R 777 /"
338.
by kpcyrd 12y ago
There's actually a crypto IP replacement out there: https://github.com/hyperboria/cjdns
339.
by kpcyrd 12y ago
This one looks interesting: https://wikileaks.org/sony/docs/05/docs/Anti-Piracy/IP%20Obf...
340.
by kpcyrd 12y ago
>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account. SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on li
341.
by kpcyrd 12y ago
It's kinda weird how hackers are pioneering the technology that's going to be the DRM of the next decade.
342.
by kpcyrd 12y ago
This was my attempt to this problem: https://tls.li/ . It's only a static page though. I've started it after ioerror stopped merging important PRs to duraconf.
343.
by kpcyrd 12y ago
They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.
344.
by kpcyrd 12y ago
Windows is able to get drivers itself over the network. Unless the ethernet driver is missing to, which happens most of the time.
345.
by kpcyrd 12y ago
The parent comment and some of the child comments are implying you need to be physically near the system, which doesn't seem to be true. You still need to find a way to execute code on the target system (also called "getting a she
346.
by kpcyrd 12y ago
If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.
347.
by kpcyrd 12y ago
Commenting itself wasn't the issue. I need a whitepaper or implementation that I can review to write anything useful.
348.
by kpcyrd 12y ago
So, there's nothing except a subscription page? I'd love to comment on the concept, but I couldn't find anything.
349.
by kpcyrd 12y ago
Why is this getting downvoted? I use a device with 1GB for development.
350.
by kpcyrd 12y ago
There is no such thing as "semi-illegal". It's either legal or illegal.
351.
by kpcyrd 12y ago
Password hashing is crypto, too. Don't roll your own crypto.
352.
Show HN: Onionjson.net – tor2web for json(onionjson.net)
1 points by kpcyrd 12y ago|0 comments
353.
by kpcyrd 12y ago
Be careful, this has no effect if you're using firefox/iceweasel. They bring their own set of trusted CAs and ignore all changes on the OS trust store.
354.
by kpcyrd 12y ago
>cm = !git add -A && git commit -m I think it's a better idea to use git add -p to review your changes before commiting them.
355.
by kpcyrd 12y ago
Here's the link to debian's wnpp bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754513
356.
by kpcyrd 12y ago
If a bunch of 'altruistic jerks' can drive you out of business in their spare time, maybe you didn't deserve that business in the first place.
357.
by kpcyrd 12y ago
>or force them to support this (not likely) Last time I've checked apple was an US company. https://en.wikipedia.org/wiki/Patriot_Act >If you distrust all software that isn't open source Sadly, this isn
358.
by kpcyrd 12y ago
hidden service connections are end-to-end encrypted. Also, there is no exit node in a hidden service circuit. I think it makes more sense that they're in fact referring to a guard node, like another comment has pointed out.
359.
by kpcyrd 12y ago
> Credit card numbers or passwords that are stored in an unsalted hash What's the purpose of hashing a credit card number? For passwords, please use a proper KDF instead of reinventing salted password hashing. While it's wide