landr0id

16 ms·

181.
by landr0id 7y ago
Anyone can (and people are) just scan the internet for hosts on port 80/443 and unless your site uses virtual hosts and has no HTTPS certificates issued to one of your domains, it's going to be discovered and probed exactly like t
182.
by landr0id 7y ago
Why not run in release mode then to really show capabilities? Poor choice.
183.
by landr0id 8y ago
All of the CVEs give credit to "Chris Coulson of Canonical Ltd.". Nice job Chris. Looks like they've probably developed a fuzzer targeting client packet handling. I wouldn't be surprised if we see more bugs pop up as a r
184.
by landr0id 8y ago
It's been used consistently to get initial code execution on the PlayStation 4, iOS (for attacks involving just following a web link), and probably used pretty consistently other nation-state attacks but I have no real data to back thi
185.
by landr0id 8y ago
Even with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".
186.
by landr0id 8y ago
Yesterday my teammate published a blog post on getting started with fuzzing para-virtualized devices in Hyper-V as well: https://blogs.technet.microsoft.com/srd/2019/01/28/fuzzing-p... Alex's blog p
187.
by landr0id 8y ago
Pretty short page but solid background.
188.
by landr0id 8y ago
ssdeep is also used https://www.forensicswiki.org/wiki/Ssdeep
189.
by landr0id 8y ago
If they got information from an insider, it could potentially be insider trading. Something somewhat similar happened when MedSec shorted St. Jude before publishing some security research about some hardware: https://arstechnica.
190.
by landr0id 8y ago
You're correct -- I was referring to the table that was easiest to quickly reference which is the changelog , not ALL current prices. The periodic table is more accurate. I'll update my post.
191.
by landr0id 8y ago
Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: https://zerodium.com/program.html
192.
by landr0id 8y ago
Serving large amounts of content over HTTPS is expensive. When the data is signed anyways you gain nothing by using TLS other than privacy.
193.
by landr0id 9y ago
I'm going to go ahead and plug a script I made to do something similar (if you were to put it on a cron job I suppose): https://github.com/landaire/detweet
194.
by landr0id 9y ago
I use virtualenv so I can just easily `pip freeze > requirements.txt` for individual projects.
195.
by landr0id 9y ago
This is the first I've read of the JSON Lines format. What problem does this solve? *answered my question shortly after posting by re-reading the blog post: "enables incremental writing and reading of the recording." So it ma
196.
by landr0id 9y ago
So what's this API do? Allow you to ditch vimscript for lua or something else?
197.
by landr0id 9y ago
The last time I ordered from Postmates I got $75 worth of Chinese food for a big group (5 entrees, 2 sides of rice). When the food arrived I got 3 entrees, one of which was sweet and sour chicken without the sauce, and no sides. I contacted
198.
by landr0id 9y ago
Well in fairness, the link points to the Windows blog. The actual marketing page should probably be the link: https://www.microsoft.com/en-us/surface/devices/surface-book...
199.
by landr0id 9y ago
Snipping tool doesn't exist on hospital PCs?
200.
by landr0id 10y ago
Looks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++" https://github.com/notepad-plus-plus/notepad-plus-plus/commi...
201.
by landr0id 10y ago
I work in security and yes, it definitely helps in some cases with preventing lateral movement. Since servers aren't rebooted often, if I choose to run mimikatz to dump creds off of the server and steal a user's password, that pas
202.
by landr0id 10y ago
IDA is the de facto standard tool for reverse engineering. It supports a wide array of processors and executable formats, but the hex-rays decompiler (what generated the code in this screenshot on the page you linked: http://www.
203.
by landr0id 10y ago
This change isn't to thwart cheaters... not sure where the article got that. It's a side affect of legacy code that was used to thwart cheaters that hasn't worked very well since Reddit has grown. Some additional info about i
204.
by landr0id 10y ago
http://archive.is/in4n1
205.
by landr0id 10y ago
At least they didn't try to make it some node/electron application and just let you use your browser. Using Python/HTML/JS greatly lowers the barrier to entry for contributions when compared to C. Hopefully it means bett
206.
by landr0id 10y ago
Assuming this is a serious question, yes, the camera and MacBooks both have changed a lot since 2008. This is probably why they did the study on 2008 MacBooks as opposed to later models. They wouldn't get the results they wanted otherw
207.
by landr0id 10y ago
> It was definitely possible a couple years back Yeah, a few years back studying MacBooks from 2008 .
208.
by landr0id 10y ago
I tried to use Numbers for some biology work when I was in school and found it frustratingly difficult to use. I'd type something in to a cell, it'd autocomplete, I'd cancel the autocompletion, but it still did not give me fu
209.
by landr0id 10y ago
The first time I saw the email I believed that Dropbox was taking it as a preventative measure because they thought they were breached -- not that they were breached. This information as hidden behind the link to more information in the
210.
by landr0id 10y ago
lol downvotes, ok hn. My initial reaction was "this is crazy Spotify found something like this", which was why I commented.

More ›