nneonneo

59 ms·

841.
by nneonneo 5y ago
Most companies seem to maintain two APIs: a “private API” that they use to actually to deliver their website or service, and a second “developer API” for the exclusive use of third party services. If you’re just interested in putting togeth
842.
by nneonneo 5y ago
Nice write up. Some little tips: - you’re on 64-bit, so you probably want x/gx (or x/16gx, etc.) to print out 64-bit words (the g means “giant”). That’ll make the addresses on the stack more useful. (x/ax works too, and will
843.
by nneonneo 5y ago
I got WebTorrent running on iOS via play.js (Node, rather than Safari, so it supports native sockets etc.). Might be the first non-jailbroken torrent client for iOS :) Very nice project, and works extremely well!
844.
by nneonneo 5y ago
Well, the FTC is _trying_, at least. They took action against On Point Global ( https://www.ftc.gov/enforcement/cases-proceedings/x130054/po... ) which operated a big network of DMV-lookalike sites. If you trie
845.
by nneonneo 5y ago
Ugh. This ransomware crap doesn't stop until the money stops . At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworl
846.
by nneonneo 5y ago
Hmm, I don’t agree. If you pass a structure by value, that is supposed to make a copy. The callee is free to modify the copy any way it likes (unless you use const, and that’s not much protection in C). Doing as the author suggests, and p
847.
by nneonneo 5y ago
Oh hey, I did something like this for DEF CON CTF one year, with eight architectures all slammed together: https://www.robertxiao.ca/hacking/defcon2018-assembly-polygl... That was definitely fun to put together.
848.
by nneonneo 6y ago
Or, having been there, maybe they remembered them because they were interesting/weird tidbits that caused them to have to debug something for hours. Or perhaps they ran into those weird things last week. (I will never forget, for examp
849.
by nneonneo 6y ago
Both of these checks happen at runtime in Rust. Overflow checks in particular only happen in debug mode, not in release mode.
850.
by nneonneo 6y ago
Foreign governments don’t need to pay employees to install back doors. Highly-paid software engineers are perfectly capable of inserting security bugs into their own code without prompting. Writing secure code is insanely difficult and has
851.
by nneonneo 6y ago
For an even easier-to-remember alternative, there’s q: https://github.com/zestyping/q All you need is `import q`. q works like a function (q(x)), like a variable (q|x and q/x, so you get different operator precede
852.
by nneonneo 6y ago
Could you just pull the PR from the submitter’s machine? They could serve it via e.g. git http-backend and you could then point the CI there to pull.
853.
by nneonneo 6y ago
Or, just program in INTERCAL ( https://en.wikipedia.org/wiki/INTERCAL )! Integers are input in English (e.g. THREE FIVE NINE) and output in Roman numerals.
854.
by nneonneo 6y ago
Hang on, this isn't accidentally quadratic, this is accidentally exponential in the worst case. If you set the tree branching factor to one, then the running time of C++‘s std::less becomes 2^h, but there’s only h nodes. Demo: https
855.
by nneonneo 6y ago
The “US DoD” IP could simply be a mobile network operator’s internal IP address leaking via the XFF header. Mobile network operators are known to use public but unadvertised IP ranges such as 25.0.0.0/8 (UK MoD: https://blog
856.
by nneonneo 6y ago
Out of curiosity, why 1/5 2/6 3/7 4/8 and not something like 1/8 2/7 3/6 4/5 where you just flip the entire stack over at the midpoint and read from the end of the stack back to the front? That would
857.
by nneonneo 6y ago
I just have a setuid root sudo binary (compiled from sudo-touchid: https://github.com/mattrajca/sudo-touchid ) in my home folder ~/bin. This has worked a treat across OS updates, without hacking PAM stuff. It’s ext
858.
by nneonneo 6y ago
I got screwed in the opposite direction. I sold an online service with PayPal, delivered the goods (files to set up a web forum), only to have the client file a fraudulent chargeback claiming they never received the site files (they used th
859.
by nneonneo 6y ago
Oh gosh, they actually used the dogefox (firedoge?) logo for Nightly: https://www.mozilla.org/en-US/firefox/nightly/firstrun/
860.
by nneonneo 6y ago
Heh, up here in Canada the Loblaws grocery chain still sells the No Name generic brand. No Name products are about as simply presented as possible: black text on a yellow package, sometimes with a simple photo of the product. And yet they’r
861.
by nneonneo 6y ago
It's mostly just a mildly obfuscated way to write 49. It also happens to line up nicely with the index of the character being overwritten (index 1); ord('0') through ord('9') work likewise. ---- I'm personally
862.
by nneonneo 6y ago
I mean, who says Python strings are immutable? s = "asd" import ctypes ctypes.memmove(id(s) + ord('1'), b'X', 1) print(s) # prints aXd (Python 3.3+, 64-bit; this is a joke so please do not use this
863.
by nneonneo 6y ago
Not sure what you mean, but the accepted PEP does appear to be a statement. What was the alternative?
864.
by nneonneo 6y ago
As a Rust developer (not really), after getting sick and tired of hearing about C everywhere, I decided to do a bit of assessment in terms of code-size complexity. I heard of Linux, an amazing operating system kernel that beats Redox in the
865.
by nneonneo 6y ago
Hmmm... https://paint.wtf/ranking/7sAX/drZSMbNMv1avmID4M2XS 2 out of 291 for a solid green square. I feel like there might be a "complexity" metric missing in the model.
866.
by nneonneo 6y ago
Hey, I played in that CTF! Although, I ended up spending most of my time pwning QEMU instead. There was an easier challenge, aptly named Easy Escape, in which the organizers added a vulnerable memory-mapped device to QEMU. The device had th
867.
by nneonneo 6y ago
It was harder than expected! One of the big difficulties with releasing macOS challenges is that not everyone or every team has access to macOS (unlike, say, Linux which is freely available). In principle , contestants could have reversed
868.
by nneonneo 6y ago
"Run-only" AppleScript is compiled to a bytecode format that is very poorly documented. In 2017, I released a CTF reverse-engineering challenge called Scriptabble, in which contestants had to understand a compiled AppleScript file
869.
by nneonneo 6y ago
This looks basically like assembly code for practically any embedded system - reading/writing hardware registers to interact with UARTs. Nice job (& best of luck with the Asahi Linux project - very exciting!)
870.
by nneonneo 6y ago
Yeah, there's a bunch of stuff in AArch64 that takes getting used to - for example, fixed-length instructions (everything is a 32-bit instruction!), tons of sanely-named registers (X0~X30, W0~W30), shorter literals (all literals need t

More ›