l_zzie

5 ms·

1.
by l_zzie 10y ago
"it's rather trivial"? Have you done it?
2.
by l_zzie 10y ago
It's pretty hard with strcmp. On modern x86_64 strcmp is vectorised and the first N bytes are compared simultaneously. I have code samples + remote exploit code against nonvectorised strcmp; I can write this up if anyone thinks it woul
3.
by l_zzie 10y ago
I tried to get nrepl to accept http requests once and I couldn't make it validate anything. (But of course I'd love to see someone manage to do it...)
4.
by l_zzie 10y ago
I don't think this is the same vulnerability. You don't even need to rebind DNS to do it, I believe: just make an XmlHTTPRequest. Your GET is considered code. The browser will get back a request that doesn't have a cors heade
5.
by l_zzie 10y ago
It's not only a DNS rebind attack. I'm pretty sure in this case even a GET could get rce , so you don't even need to check the cors headers. You can just XHR.
6.
by l_zzie 10y ago
That could be nice. So, now the browser needs to understand routing tables?
7.
by l_zzie 10y ago
Emacs has this: org mode and Dita.
8.
by l_zzie 10y ago
Do you browse to html files on your attachment server? That's a pretty bad idea security-wise
9.
by l_zzie 10y ago
Some portion of the work could be comstant-time.
10.
by l_zzie 10y ago
Importantly, fetching DNS twice (once to check, another to download) is an incomplete solution, since DNS responses can change (cf "DNS rebinding").
11.
by l_zzie 10y ago
How does it get past aslr? You still need to find addresses of the movs, don't you?
12.
by l_zzie 10y ago
On iPhone, user-mode exploits remain sandboxed. On Android, on rooted devices, user mode code tends to be able to get root.
13.
by l_zzie 10y ago
fwiw, stateless light switches are nice in that you can have many light switches controlling the same light. Not saying they're perfect but they have advantages.
14.
by l_zzie 10y ago
I can't believe New Jersey would let someone brazenly advertise religiously-motivated cannibalism.
15.
by l_zzie 10y ago
"undefined" isn't the problem here, seq is.