matthavener

15 ms·

91.
by matthavener 15y ago
This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and... )
92.
by matthavener 15y ago
I've done this with MS Word and the VS debugger. Word crashed while I was editing a huge document. I simply skipped a few instructions down, returned to Word, saved the document, and restarted Word. When your options are either 1) crash, or
93.
by matthavener 15y ago
Of course, assuming that unwanted space is there. With addr and len, you could split "helloworld" into "hello" and "world" by simply pointing to the two separate parts, each with len == 5. (This is actually really nice when parsing large st
94.
by matthavener 15y ago
| is bitwise OR ^ is bitwise XOR so, "result |= x ^ y" will change result to true if x and y are different. since its bitwise, the bits that are different between x and y will be set in result
95.
by matthavener 15y ago
Not that copy/paste is hard, its just much easier to click a link instead of highlighting it, switching to browser, new tab, paste
96.
by matthavener 15y ago
I always hated having to copy/paste URLs from PuTTY, so I started using PuTTY Tray ( http://haanstra.eu/putty/ ) It highlights URLs, reconnects on failure, and does a few other nice things
97.
by matthavener 15y ago
A lot of people will assume "hashed using SHA-1" means simply SHA1(salt + password) but in practice many password hashing libraries use SHA-1 with a work factor, similar to bcrypt. I think NIST currently requires at least 100,000 rounds of
98.
by matthavener 15y ago
A few others I use are -Wsign-compare and -Wformat-nonliteral. Sign compare warns on possible bugs/vulnerabilities due to comparing signed and unsigned values. Using nonliteral formats can lead to vulnerabilities (such as the famous attacks
99.
by matthavener 15y ago
Yup, it can also be much more serious than some garbled text. Google "canonicalization vulnerabilities" and see stuff like this: http://www.amarjit.info/2009/09/canonicalization-vulnerabili...
100.
by matthavener 15y ago
Lots of large database sites have long-running reports. I could imagine a site shutting down to freeze the database for a complicated report.
101.
by matthavener 15y ago
The idea is that you're a working machine. You think the terminator hangs photos in his house? Trick question, the terminator doesn't have a home. I bet this guy wouldn't either if he didn't need to. He lives to work
102.
by matthavener 15y ago
I've read Estonia has a pretty simple tax system.
103.
by matthavener 15y ago
Yup, most cities have people on staff that simply beg companies to move to their area. I'd be shock if Cupertino wasn't giving a few carrots to Apple..
104.
AES-hash proposal [pdf](csrc.nist.gov)
2 points by matthavener 15y ago|0 comments
105.
by matthavener 15y ago
Still, I wonder if this circumvents some of the law. If you can't prove I paid for some drugs, am I less likely to be prosecuted? If a random shipment of drugs showed up at my door with no transaction to match them with, am I even at fault?
106.
by matthavener 15y ago
http://preyproject.com/ has a little more information, plus you can try it for free.
107.
by matthavener 15y ago
I wonder if this is an indication that google is moving to clang for compiling (and not just diagnostic tools). If that's true, maybe this is another nail in the coffin for gcc? I see apple and google behind llvm/clang, who's behind gcc? No
108.
by matthavener 15y ago
What is "WAK"?
109.
by matthavener 15y ago
I think the real benchmark is still "which one is faster"? Typically, a faster program will use less memory. But, if Chrome is trading large memory usage for CPU cycles/cache coherency then its perfectly acceptable by me.. just don't slow m
110.
by matthavener 15y ago
I think so, but not for the reddit/EBS outage.
111.
by matthavener 15y ago
I'd be interested to see some kind of printer driver as a service. Email a PDF to "mysecretprinterid@myprintercomany.com" and it prints the page
112.
by matthavener 16y ago
How would that work? Non-sleeper's children are more likely to survive?
113.
by matthavener 16y ago
I wonder if he's returning to perl because its inherently a better language for parsing, or if he's just incredibly comfortable with the succinct regex and string parsing syntax in perl? I've found myself going back to perl, but usually bec
114.
by matthavener 16y ago
I agree. Long term, a society that values 100% employment over technological progress will be stomped by the society that allows its industries to automate themselves. There's probably some good stuff to be repeated from "End of Work" ( htt
115.
by matthavener 16y ago
Is it easier for mom and pop to compete because they already pay a higher wage? That is, mom and pop pay a higher cost of labor compared to the big boys?
116.
by matthavener 16y ago
I tend to complete forget about my comments
117.
by matthavener 16y ago
What crypto code uses floating point? DES and AES don't. I doubt most PRNGs do either..
118.
by matthavener 16y ago
Susan Combs is responsible and she's up for re-election Nov 2nd. ( http://www.sos.state.tx.us/elections/candidates/general/2010... ) I doubt this will last for long.
119.
IPhone factory tries to stop suicides by improving moral(apnews.myway.com)
1 points by matthavener 16y ago|0 comments
120.
by matthavener 16y ago
They'll probably want to ban cordless phones as well..

More ›