nbpoole

25 ms·

181.
by nbpoole 15y ago
Something like this, I assume: http://www.bitcoinminer.com/post/5328668205/deepbit-50-perce...
182.
by nbpoole 15y ago
http://mxr.mozilla.org/mozilla-central/source/netwerk/dns/ef... .cz.cc is not on that list, nor should it be. This is a free "domain" generator using subdomains of cz.cc. Hence, all of the subdomains are grouped together. I don't see anyt
183.
by nbpoole 15y ago
http://www.knittingparadise.com/t-13211-1.html http://www.sheffieldforum.co.uk/showthread.php?p=7720333 Apparently if you log in there's a notice telling you they were hacked.
184.
by nbpoole 15y ago
" When I release an open-source program, I want to guarantee something very simple. The program and its source code can be distributed and used by anyone for any purpose, and all modifications to the program must be released as open-source
185.
by nbpoole 15y ago
The example they gave ( $description = strip_tags($_POST['description']); ) would trigger copy-on-write, unless I'm mistaken. And the SQL example isn't meant to be copy/pasted: it's a demonstration of a fairly common anti-pattern that has n
186.
by nbpoole 15y ago
http://news.ycombinator.com/user?id=xnerdr It appears his old username is/was.
187.
by nbpoole 15y ago
Those comments appear to be based on an older version of the page. The current page doesn't have most of those "optimizations." Edit: And confirmed. See http://web.archive.org/web/20090628004019/http://code.google...
188.
by nbpoole 15y ago
From earlier today (since it's related, especially the HN comments): http://news.ycombinator.com/item?id=2612245 Personally, I would be wary of using any contract written by someone who isn't a lawyer. Telling people that you feel "there
189.
by nbpoole 15y ago
As you pointed out, it's a gray area. http://answers.onstartups.com/questions/19422/if-im-working-... " Not related to your employer's line of work. Um, wait. What's the definition of related? If my employer is Microsoft, they do everythi
190.
by nbpoole 15y ago
Actually, djbdns does not have a perfect record: http://article.gmane.org/gmane.network.djbdns/13864
191.
by nbpoole 15y ago
" If this attack involves "simply sniffing TCP 445" why not just MITM the whole session? " Because it doesn't. The attack involves using a bug in IE (an iframe will render cookie data from the local computer) with clickjacking to steal cook
192.
by nbpoole 15y ago
PHP was my very first language, which in hindsight was probably a good choice for a couple reasons: 1. It's used in a ton of web applications. It's slightly less popular than in the past due to the influx of frameworks like Rails and Django
193.
by nbpoole 15y ago
It's not a big secret at all ;) tptacek has a list of books on Amazon, linked to from his news.yc profile, which cover a wide range of application security topics ( http://amzn.to/cthr46 ). I own The Art of Software Security Assessment and
194.
by nbpoole 15y ago
Agreed. This IE bug does seem to have some interesting behavior though: https://twitter.com/#!/superevr/status/73920079921815552
195.
by nbpoole 15y ago
http://forum.developers.facebook.net/viewtopic.php?id=60571 http://bugs.developers.facebook.net/show_bug.cgi?id=9777#c66 So, the problem is framebusting code not playing well with iframes. ;-)
196.
by nbpoole 15y ago
" If you've disabled FTP for security reason updating becomes a manual process. " The automatic update process will also work if the webserver has write permissions on the files (which is a bad idea in the first place). But if it doesn't an
197.
by nbpoole 15y ago
That hasn't been my experience. I run Chrome on 10.6 and when a new version comes out, I have to manually close/reopen Chrome to install it (usually by clicking the "Update and Restart" button shown in that screenshot).
198.
by nbpoole 15y ago
Why do people assume that this is some kind of giant Facebook conspiracy? From the article: " According to Grubb, security expert Christian Heinrich demonstrated in front of the delegates how he had managed to acquire privacy-protected phot
199.
by nbpoole 15y ago
Out of curiosity, what does your include_path look like? Is ./ the first element, the last, or somewhere in the middle?
200.
by nbpoole 15y ago
Yes, you're right. I actually did move the line in my testing, but for it to work properly, you would want to duplicate it. I'll update my comment. :) I should also mention that merely allowing uploads via php.ini is not an issue: you need
201.
by nbpoole 15y ago
That configuration contains a major security vulnerability, at least if your site allows file uploads (I tested it on my server to be sure). I've written about this issue before: https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-an
202.
by nbpoole 15y ago
As the blog post points out, this does look to be a consequence of "IfIsEvil" ( http://wiki.nginx.org/IfIsEvil ). The behavior of calling the script, not rendering it, and displaying the actual file is very strange though, especially since
203.
by nbpoole 15y ago
Indeed. You get the same error in Chrome and a slightly different one in Firefox. That isn't valid JavaScript on its own.
204.
by nbpoole 15y ago
I assume it means that's where temptemptemp13 found the link.
205.
by nbpoole 15y ago
I just tried the following HTML: <input type="text" value=`asdf` /> In IE, the input box contained the string asdf. In other browsers, it contained the string `asdf`
206.
by nbpoole 15y ago
` can be used in place of single or double quotes around attribute values in IE.
207.
by nbpoole 15y ago
...except when there isn't. ;-) PHP's htmlspecialchars function, which is called out specifically in this post, is actually fine for most use-cases. If you write code like this: <input type="text" name="foo" value="<?php echo
208.
by nbpoole 15y ago
I'd argue that in order to trust what's in your address bar, you have to have "verification": if you're not sure who's on the other end, you can't trust the address bar. Whether that knowledge comes from a PKI system like browsers use now o
209.
by nbpoole 15y ago
There was a great discussion about this a month or so ago ( http://news.ycombinator.com/item?id=2376431 ). I'd highly encourage you to read the comments that were made. As Lanzaa pointed out here, encryption without identity validation is w
210.
by nbpoole 15y ago
You don't need a username and password for shell access if the application has a vulnerability that allows for arbitrary code execution. Your code just executes as the same user as the application. To elevate your privileges, you would need

More ›