maxdamantus

15 ms·

91.
by maxdamantus 5y ago
The sample in the in post is log4j1 ("org.apache.log4j" rather than "org.apache.logging.log4j"), which is why it's using: > log.info("foo: " + bar); rather than: > log.info("foo: {}", bar);
92.
by maxdamantus 5y ago
Thanks, didn't realise that. So the issue is deeper than misuse of user input (I've edited my post).
93.
by maxdamantus 5y ago
I'm not aware of that feature, but I guess it would mitigate this issue, since the problematic code: > logger.info("Data: {}"); would effectively turn into something safe: > logger.info("{}", "Data: {}&qu
94.
by maxdamantus 5y ago
The string that is vulnerable is actually not meant to be user input, but a formatting string. EDIT: nevermind, the issue apparently arises outside of formatting strings—though it would have been nice if the example had demonstrated this. T
95.
by maxdamantus 5y ago
Personally, I make use of this all the time. My home network uses the 10.0/8 subnet, so I'll naturally use 10.137 in commands like ping, ssh, curl, ifconfig. Other than web browsers and the `ip` command, virtually everything that
96.
by maxdamantus 5y ago
Probably worth pointing out that docker has had a "userns-remap" option for quite a while, which causes all containers to run in a separate user namespace where UID 0 inside remaps to something else outside, so theoretically a use
97.
by maxdamantus 5y ago
> 1. Add types to the Nix expression language Interestingly, this was one of the first issues that Edolstra (creator of Nix) raised himself, but unfortunately he closed it again as unrealistic a number of years later [0]. [0] https:&#x2
98.
by maxdamantus 5y ago
Thanks, I wasn't aware of that. I guess I'd feel a bit more comfortable installing a CA with those constraints, though I'd wonder how many administrators actually know to do it—seems like a feature that's not currently w
99.
by maxdamantus 5y ago
As far as I know, X.509 doesn't currently have such a concept, and web browsers don't have it either. If you install a certificate as a CA, it is a CA for any domain. If a CA signs another certificate with the "Certificate Si
100.
by maxdamantus 5y ago
I don't like this solution, mainly because installing custom CA certificates increases the chance of a MITM attack involving other services. Any trusted "intermediate" certificate in X.509 is allowed to be a CA, so it can be
101.
by maxdamantus 7y ago
Like this: https://en.wikipedia.org/wiki/Astronomical_year_numbering
102.
by maxdamantus 7y ago
> Counting from 0, 2019 would still be the 19th year of the 21st century. I think you meant to say the "20th" year (off-by-one error!), since 2000 would be the "1st" year under your grammatical assumptions. I think it
103.
by maxdamantus 7y ago
> Depends on whether you're measuring or counting. You run into issues when using 1-based counting as well as measuring. Our calendar years use 1-based counting, which results in things like "2020" being the "20th yea
104.
by maxdamantus 7y ago
> A monad is a data type (e.g. int) that encapsulates some control flow (e.g. try/catch). Ignoring the fact that `int` itself doesn't have much to do with monads (it's presumably just giving an example of a type), I'v
105.
by maxdamantus 7y ago
> I mean, they already demonstrated incompetency. Finding more vulnerabilities at this point is very much expected. You mean they've demonstrated that their security model is non-traditional? The point is that the CSRF login is prob
106.
by maxdamantus 7y ago
The advantage of this is that they don't even see your password in memory as you log in. They only see their randomly generated one. Forcing users to use unique passwords (that is, not allowing the user to pick one) seems like a pr
107.
by maxdamantus 7y ago
> The SECOND reason is so that the attacker can't now login as the user and impersonate them. Impersonate them on a service that has a compromised database? Maybe. I think in this particular case, users don't even really lose a
108.
by maxdamantus 7y ago
Fundamentally, I don't see anything wrong with this. People are already encouraged to use "password managers", which is essentially a workaround for the fact that most sites should not be using traditional password authentica
109.
by maxdamantus 7y ago
Actually, it kind of can: https://tryidris.herokuapp.com/compile#YWRkIDogSW50IC0+IElud... The above link refers to the following Idris code: add : Int -> Int -> Int add a b = a - b addTest : add 4 5 = 9 add
110.
by maxdamantus 7y ago
These are things that kernel developers are surely mindful of when coming up with and implementing eBPF functionality. Regardless, I'm sure I've run this same test years ago and seen the system call count still in the same order (
111.
by maxdamantus 7y ago
There shouldn't really be any significant filesystem code involved, since once `dd` has opened the files, it should have handlers for those devices more-or-less directly in its descriptor table. Once you have a descriptor to a pipe or
112.
by maxdamantus 7y ago
I think it's more to do with avoiding overheads typically associated with system calls (presumably involving some interrupt and disabling/enabling/changing paging behaviour). Here's an example of a syscall-heavy command
113.
by maxdamantus 7y ago
I feel like it should really be emphasised that the reason this occurs is due to a mismatch between binary exponentiation and decimal exponentiation. 0.1 = 1 × 10^-1 , but there is no integer significand s and integer exponent e such t
114.
by maxdamantus 7y ago
Unless you have a floating point model that supports arbitrary bases, you're always going to have the issue. Binary floats are unable to represent 1/10 just as decimal floats are unable to represent 1/3. And in case anyone&#x
115.
by maxdamantus 7y ago
Because they get to sell that power (advertising space) to others.
116.
by maxdamantus 7y ago
IO in Haskell (and presumably Lwt in OCaml, though I'm less familiar with it) doesn't have much to do with fibers. An IO value is just something that the Haskell runtime is able to invoke somehow. Haskell functions can not direc
117.
by maxdamantus 7y ago
Intuitively, `a -> b` is normally interpreted as "from `a`, I can get `b`". A function of type `Int -> String` allows you to get a `String` from an `Int`. The proposition `A -> B` (`A` implies `B`) means that `A` being tr
118.
by maxdamantus 7y ago
> Instead of rendering all the strings in each column, we can split the strings into their corresponding graphemes and render them individually. This allows us to cache the pixel length of each grapheme we encounter. I wonder if they&#x2
119.
by maxdamantus 7y ago
An arc on AC is more likely to be extinguished since the current drops to zero many times every second (so eg, on 50 Hz AC, an arc is not likely to last more than 1/100 of a second). DC switches and circuit breakers are designed with g
120.
by maxdamantus 7y ago
If you're using DC to transmit the same amount of power, you'll probably be using similar voltages (otherwise you're going to need thicker cables). I suspect DC is probably a greater fire risk in this case due to arcing. An a

More ›