kpcyrd

17 ms·

151.
VirtualBox E1000 Guest-to-Host Escape(github.com)
577 points by kpcyrd 8y ago|108 comments
152.
by kpcyrd 8y ago
If I had that kind of exploit I surely wouldn't post it on stackoverflow.
153.
by kpcyrd 8y ago
For anybody else wondering about the reply to that tweet: mosh is using AES-OCB, but seems to be using OCB3 from what I can tell: https://github.com/mobile-shell/mosh/blob/944fd6c796338235c4...
154.
by kpcyrd 8y ago
While there are a lot of really nice things in this release, the progress bar is what got me the most excited. Given the long compile time of some of my projects this is much appreciated.
155.
by kpcyrd 8y ago
I disagree on the 2nd point. Flags prevent globbing by the shell and make the help text less clear. Consider a usage line like this: prog <user> [password] This tells you which argument is mandatory and which argument is opti
156.
by kpcyrd 8y ago
The problem is that the original concept of websecurity doesn't apply to the current time anymore, but it's very hard to change anything because you have to be backwards compatible to literally the whole internet. It's amazin
157.
by kpcyrd 8y ago
Since he was pointing out scammers buying popular extensions: I would like to mention that this is a chrome specific problem. Something like this isn't common with firefox addons.
158.
by kpcyrd 8y ago
If you are able to load kernel drivers you could just nop out the kill syscall though.
159.
by kpcyrd 8y ago
You can rephrase this sentence: > it really doesn't necessarily lead to any kind of true decentralized <data storage> unless someone else has decided to <store your data> You might have an overly romantic idea of decentr
160.
by kpcyrd 8y ago
On freenet other people are sending you files to store, on ipfs you only store your own files, files pinned (basically seeding) and files from your cache. Freenet is built for anonymity, while ipfs is built for performance.
161.
by kpcyrd 8y ago
I really didn't expect this to happen, congrats to the ipfs team! A demo link over here: https://cloudflare-ipfs.com/ipfs/QmS4ustL54uo8FzR9455qaxZwuM...
162.
by kpcyrd 8y ago
I was about to say this. Computers are not getting slower over time, the programs get worse over time.
163.
by kpcyrd 8y ago
I would like to emphasize that php is notorious for these sorts of issues because every single function to execute an external program is based on ["/bin/sh", "-c", $cmd] If we would just stop telling
164.
by kpcyrd 8y ago
>There are still many holes As somebody who licenses software as AGPL, could you please list those?
165.
by kpcyrd 8y ago
So apparently you have bigger problems with the users now.
166.
by kpcyrd 8y ago
They get their own namespace, they can't overwrite random existing images.
167.
by kpcyrd 8y ago
>>> True = 0 >>> False = -1 >>> if False: print('oh no') False is now truthy and True is falsey. Note this only works in python2.
168.
by kpcyrd 8y ago
In case anybody is wondering, this is the attack vector that was used for the equifax hack and is also used in a fair number of remote code execution exploits for java servers.
169.
by kpcyrd 8y ago
I don't think this is about regular load balancing. DDoS is coming from a large number of infected machines, but they can't control how their traffic is routed. By using anycast you're splitting the machines that are used to
170.
by kpcyrd 8y ago
Firefox addons are reviewed. That's why malicious firefox addons are a lot less common than malicious chrome extensions.
171.
by kpcyrd 8y ago
It mentions the keyring is able to handle ed25519. Was this fixed in gnome-keyring recently? Do they use something different? Edit: it seems fixed: https://bugzilla.gnome.org/show_bug.cgi?id=723274
172.
Rust reimplementation of lambdash, deploys a rust binary to aws lambda(github.com)
4 points by kpcyrd 9y ago|0 comments
173.
Scriptable network authentication cracker in rust(github.com)
3 points by kpcyrd 9y ago|0 comments
174.
by kpcyrd 9y ago
If you deploy enough machines that corrupted memory becomes a common problem you should look at your healthchecks instead of static linking.
175.
by kpcyrd 9y ago
tls isn't magic, you can still observe the encrypted stream and make assumptions based on bytes sent/received on the wire, protocol patterns and timing. See the crime and breach attack.
176.
by kpcyrd 9y ago
Decentralization is mostly about power distribution, it doesn't imply privacy. There are a couple of decentralized projects that are worse for privacy (for the sake of decentralization) and ended up being used for OSINT.
177.
TCP connection hijacking in rust(github.com)
4 points by kpcyrd 9y ago|0 comments
178.
Building from source is a waste of electricity(github.com)
1 points by kpcyrd 9y ago|0 comments
179.
by kpcyrd 9y ago
An overdue step would be an interface to execve that isn't based on a single string, but uses actual lists. I recall the python docs have a big red warning box that you can enable shell-style-single-string mode instead of a list, but i
180.
by kpcyrd 9y ago
In this case the file is served by a javascript implementation of ipfs running inside the browser over websockets. I'm not sure if the server is pinning the files as well.

More ›