mmsc

20 ms·

301.
by mmsc 2y ago
Mental note 3: Verify you can call international numbers?
302.
by mmsc 2y ago
I wrote a cynical take on "how it happened" at the time: https://joshua.hu/losing-sight-vision-mission-of-your-role I think it comes from the divorce of what people are hired to do versus what their work actually
303.
by mmsc 2y ago
People don't believe it's possible for software to be secure, and need a secondary defense to "protect them".
304.
by mmsc 2y ago
Had a travel insurance do this and when I was in hospital in Asia I couldn't start a claim and the hospital nearly kicked me out. I'm sure the sysadmins thought it was a great way to reduce hacking attempts by blocking Asia.
305.
by mmsc 2y ago
Yes, finding some PoC for account takeover or something that involves XSS is cool and whatnot, but I'm asking whether these theoretical chain of exploits have ever actually been documented as being exploited to a significant degree.
306.
by mmsc 2y ago
Other than I love Samy, are many real-world examples of XSS being exploited for massive takeover of some service? I can't say I remember any news of a "website/service totally taken over due to XSS."
307.
by mmsc 2y ago
It’s my understanding the Celtics have a “win song.” So, as a fellow sports fan, I hope they play “All I Do Is Win” by DJ Khaled in Boston at least four times between now and June 23. I would prefer Team America's America song.
308.
by mmsc 2y ago
It happens often. Here's a new one with a video https://www.cbsnews.com/amp/miami/news/tsa-agents-accused-of...
309.
by mmsc 2y ago
If you create a socket with PF_PACKET you can intercept all the traffic on a Linux system on all interfaces. Think of a low-tech version of tcpdump. Intercept all data on port 80, parse the http headers, do whatever you need with them, easy
310.
by mmsc 2y ago
That's just a requirement for the SEC filing. If it has interrupted business operation, it needs to be specified. Think if a hospital or a manufacturer has a breach.
311.
by mmsc 2y ago
People join the likes of the CIA because they know the name CIA and set it as a goal. No different from large companies. But as people set goals the work at a certain place, people lesser-qualified slowly join the ranks until the place is a
312.
Australian SIA calls for federal regulation of cyber security sector(thenightly.com.au)
1 points by mmsc 2y ago|0 comments
313.
by mmsc 2y ago
what makes this file such an interesting find, though, is that the shell has been present since at least december 2011 It's really easy to change the creation date of a file by changing the system clock for a millisecond, and c
314.
by mmsc 2y ago
Correct me if I'm wrong, but didn't a friend of mine fisted/fstd/Timo "solve" this game years ago and make a bot to raep the highscore? Not saying that this isn't a cool project and information, but my und
315.
by mmsc 2y ago
This is the basis of the book "The Repossession Mambo" [0] and the (slightly less good) film "Repo Men" [1]. They're about what happens when you can no longer pay for your artificial body parts (the repo man comes a
316.
by mmsc 2y ago
I really like the idea of having to recover code or variables for already-running scripts. I did something similar last year to recovery bash variables of a running script: https://joshua.hu/dumping-retrieving-bash-variables
317.
Ask HN: What was the story of the attempted addition of a backdoor in WebKit?
2 points by mmsc 2y ago|0 comments
318.
by mmsc 2y ago
>Re-encoding the image is a good idea to make it harder to distribute exploits. For example imaging the recent WebP vulnerability. And now your server which is doing re-encoding is pwned. Gotta segment the server doing that somehow, or u
319.
by mmsc 2y ago
Deportation is just the end result. Fines, blacklisting, even imprisonment is possible in many countries.
320.
by mmsc 2y ago
Sure (and I'm not sure if that's actually how it works), but the border control also physically stops someone from leaving after they've overstayed. If someone has overstayed, they just go to the airport and hop on a plane wi
321.
by mmsc 2y ago
Those in-Schengen checks for buses and so on are largely just "do you have a valid passport?" and I'm not aware of any real checks of visa status, overstay checks, etc. If you get caught without a passport, you get detained t
322.
by mmsc 2y ago
> they check both passports on the outbound travel to Russia, e.g. in Narva, Estonia Who is "they"? If "they" is the airline, then physically show them the Russian passport: they don't record this information, th
323.
by mmsc 2y ago
You would should both to the airline staff. "This is my ID I used, and this is my ID which allows me entry so you(the airline) won't have to bring me all the way back to my arrival point." Airline staff will not record this s
324.
by mmsc 2y ago
Of the ~50 countries I've been to in the past 10 years, The UK is the only one I remember which I did not need to show any ID when leaving. I thought it was strange because this is just one way countries catch overstays.
325.
by mmsc 2y ago
> In both cases, she used sophisticated tradecraft that sought to leave no trace in databases accessible to European authorities. For instance, she booked her trips and bought her plane tickets using her Czech passport, registering only
326.
by mmsc 2y ago
The airline only needs to be physically shown a passport which will get the person into the destination: they don’t record it. So you book with the Czech passport, go through border control with the Czech passport, then show the airline sta
327.
by mmsc 2y ago
Using a direct link to Google’s 2FA setup will allow a Yubikey to be setup as 2FA instead of a Passkey, too: https://joshua.hu/enrolling-hardware-keys-2fa-google-workspa...
328.
by mmsc 2y ago
No, it’s what I discovered was being used in the company at the time. They ended up moving (by hand) everything to Bitwarden. It’s an improvement but not a major one IMO. It doesn’t solve the rotation problem at all (you still need to rotat
329.
by mmsc 2y ago
My experience from working in a 1,000 person tech organisation is that the hundreds or thousands of different affiliate programs, ad networks, and so on, provide simple user/password combinations. The solution before I discovered this
330.
by mmsc 2y ago
This reminds me of a problem that I wanted to solve in the future, but I don’t have the expertise. The problem is when an organization has a single account on an external service which needs to be used by several people, and the organizatio

More ›