ontoillogical

14 ms·

91.
by ontoillogical 14y ago
> And in any event, bitcoin is never going to work as a global payments system. Not only does it suffer from having a slow-growing money supply and a metastasizing transactions file which has to live on every user’s computer, it also en
92.
by ontoillogical 14y ago
In general I think you're right, but in this case, most Rails devs can probably maintain a Sinatra codebase.
93.
by ontoillogical 14y ago
We're actually collaborating with him on the advisory database that gemcanary and bundler-audit both use. It's free and open for anyone to use. Check it out: https://github.com/rubysec/ruby-advisory-db
94.
by ontoillogical 14y ago
(I'm the other person responsible for gemcanary) Having a record of all the security vulnerabilities that affect the Ruby community is important. To that end, we help maintain https://github.com/rubysec/ruby-advisory-db/ which is free for
95.
YAML Vulnerability with Rails 2.3 and 3.0 (Remote Code Execution and DOS)(groups.google.com)
2 points by ontoillogical 14y ago|0 comments
96.
Denial of Service and Unsafe Object Creation Vulnerability in JSON Gem(groups.google.com)
72 points by ontoillogical 14y ago|18 comments
97.
by ontoillogical 14y ago
HD Moore (creator of metasploit) had a talk about doing something like this. He scanned all of IPv4 hitting common TCP and UDP ports, and collected data about the services running. He found a lot of cool stuff. For instance, there are app
98.
by ontoillogical 14y ago
Those three facts constitute a security vulnerability, and did so before we had working exploit code. Over the past few years people have developed technology to make it easier to exploit null pointer dereference bugs for instance. That do
99.
by ontoillogical 14y ago
I'm not sure I get what you're the analogy to. When I first read your blog post I got the impression that you were saying that the YAML vulnerability were found with some new code scanning technology that lets us find bugs in Rails faster.
100.
by ontoillogical 14y ago
> The recent bugs were, contrary to some reporting, not particularly trivial to spot. They’re being found at breakneck pace right now precisely because they required substantial new security technology to actually exploit, and that new
101.
by ontoillogical 14y ago
In the CTF's implementation, the 2nd piece of the password would only be checked if the first one was correct. You could figure out how many different requests were made by correlating TCP sequence numbers. If only 1 request was made, the
102.
by ontoillogical 14y ago
Hi scoates, I look forward to seeing your article. I haven't tested it too much, but I believe the dictionary is read at each turn not at start. I think you're right about the constraints for client validation, but it's probably possible to
103.
by ontoillogical 14y ago
I haven't looked into how Game Center "turn based games" work until now. It looks like you can cheat this way at any game with the concept of legal and illegal moves.
104.
by ontoillogical 14y ago
I'm glad you found it useful! Libimobiledevice does a lot of things, and as I mentioned in the post I've only implemented a subset so far. I'd like to make it more feature-complete soon. You should come help out in https://github.com/stat
105.
by ontoillogical 14y ago
Does Game Center not allow you to do certain kinds of server side validations?
106.
I built a tool to hack Letterpress(finite.state.io)
73 points by ontoillogical 14y ago|51 comments
107.
by ontoillogical 14y ago
More difficult than hotel locks? :)
108.
by ontoillogical 14y ago
"who doesn’t fancy uploading his soul to the cloud so that it can commingle with the soul of Steve Jobs?" is a great line
109.
by ontoillogical 14y ago
I love the part in the slide deck where he digs up a quote from the university's VP of IT talking up PeopleSoft's reliability. “According to Joel Hartman, Vice Provost for Information Technologies and Resources at UCF, Sun really delivers i
110.
by ontoillogical 14y ago
They're only hiring more people now then before. You should apply.
111.
by ontoillogical 14y ago
I've actually worked with iSEC people last year, and only realized they were part of NCC Group today. Totally independent shop.
112.
Matasano Security acquired for £8.4m ($13m) - Congrats tptacek(nccgroup.com)
439 points by ontoillogical 14y ago|111 comments
113.
by ontoillogical 14y ago
I think the 1 million minimum doesn't include the value of your primary residence.
114.
by ontoillogical 14y ago
I managed to snag one from there earlier today. I guess they ran out fast.
115.
by ontoillogical 14y ago
Can you point me to any papers about how this sort of attack would be done?
116.
by ontoillogical 14y ago
You'd be surprised to know how often it's just the username encoded in base64...
117.
by ontoillogical 14y ago
Thanks for the tip. I've just been looking at Learn You a Haskell, it's nice to have some specific usecases when learning a new language
118.
by ontoillogical 14y ago
When you say "we use ruby for automation" do you mean using something like buby with Burp, or something custom? I find myself writing a lot of custom fuzzers in python, and am looking to improve my toolkit.
119.
by ontoillogical 14y ago
Here: http://krebsonsecurity.com/2012/06/how-to-break-into-securit...
120.
by ontoillogical 14y ago
Can you give some more examples?

More ›