palant

15 ms·

121.
by palant 6y ago
According to some Mozilla people, this part is actually wrong and extension support is indeed not implemented completely. It's merely that I couldn't (and still cannot) find a list of outstanding issues, and everything I tried wor
122.
by palant 6y ago
I updated the article to address your objections among other things. This is the text I added, just so you don't need to re-read the article: https://pbs.twimg.com/media/EgzgXUAXgAEkp-y?format=png&name=...
123.
by palant 6y ago
I sincerely hope that you are right and I am wrong here, in a few months we'll see of course. I've been with the Mozilla project for 15 years myself, and I've grown more than a bit disillusioned. I know that these people are
124.
by palant 7y ago
No. It has a shell albeit a pretty limited one - it's pretty rudimentary, like pretty much all the applications available.
125.
by palant 7y ago
It's really fast, and it has a nice retro touch to it. But claiming that is has a web browser is clearly an exaggeration. It's a text-based browser, and for some websites it cannot even display the text (crashes). So as a consumer
126.
by palant 7y ago
It's complicated. Initially there was Mozilla Suite. Mozilla Suite consisted of a browser, a mail and an IRC client. Then Firefox came out as a simpler browser, without all that unnecessary stuff. And the mail component from Mozilla Su
127.
by palant 7y ago
No, nobody has to remember anything. You use prepared statements for your database, you use autoescaping templates for the output, and it just happens automatically. I wrote about this four years ago: https://palant.de/2016&
128.
by palant 7y ago
I've been saying the same for at least a decade, e.g. in https://palant.de/2016/03/02/why-you-should-go-with-secure-b... . It's ridiculous that somebody still has to explain it.
129.
by palant 7y ago
The article is actually rather generous, particularly when it says "could be possible to deanonymize certain users." Having done my own research on that [1], I would have formulated this as "allowed to deanonymize most users.
130.
Google Removes Avast, AVG Extensions from Chrome Web Store(ww.9to5google.com)
4 points by palant 7y ago|0 comments
131.
by palant 7y ago
It's complete bullshit, provably so. This is suggesting that the data is being stripped of anything related to your identify locally, before being sent to the server. But that's not the case, nothing is being removed, and anybody
132.
by palant 7y ago
Yes, people who paid for Avast/AVG should be very pissed now. Because the software doesn't care whether you paid.
133.
by palant 7y ago
Since I'm currently looking through Avast investor reports: no, Avast didn't sell Jumpshot. In fact, Jumpshot is one of their biggest growth areas. So they closed a strategic partnership with Ascential who should help Jumpshot&#x2
134.
by palant 7y ago
Yes, there is research about finding out the name behind pseudonymized browsing history data - they had success rates in the area of 90%, despite having far less detailed data than what Avast is collecting.
135.
by palant 7y ago
Yes, according to the Avast privacy policy the data is "anonymized or pseudonymized." As I already speculated in https://palant.de/2019/10/28/avast-online-security-and-avast... , they likely went for
136.
XSS vulnerability in Avast Antivirus via wireless network name(medium.com)
2 points by palant 7y ago|1 comments
137.
by palant 7y ago
That's an unrelated issue and linked from the article.
138.
by palant 7y ago
Yes, the data is being messed with locally. The article is about a well-intended security downgrade.
139.
by palant 8y ago
At least in case of LastPass you shouldn't buy the marketing statements. Not only isn't it really a binary blob that they are storing, they don't really care about protecting it from themselves either. https://pala
140.
by palant 8y ago
As mentioned in the article, I'm bad at reverse engineering. I merely point out the massive attack surface, and I'm pretty certain that this can be misused into infecting users with malware. But that's up to other people to p
141.
by palant 8y ago
Yes, bug bounty programs usually dislike being told about inherent architectural issues. So far I've only come across one where all security-relevant feedback is welcome: Mozilla. Which is exactly why I'm not submitting this via t
142.
by palant 8y ago
Not so much browser exploits, but the browser extensions often have issues. If your password manager is a separate binary, you usually don't have to worry about websites exploiting it. On the other hand, it won't protect you again
143.
by palant 8y ago
Yes, they use it because they don't know how to do the same things in JavaScript - without it you get very awkward import/export for example. Tavis Ormandy already demonstrated in the past that this binary allows turning an extens
144.
by palant 8y ago
It should be obvoius that hash table lookups are above O(1) as long as collisions exist. Tweaking the load factor can reduce the probability of collisions, but that's merely a constant factor to the lookup complexity. As to whether O(l
145.
by palant 8y ago
You are definitely right for most hash tables. Determining the right bucket is O(1) but there will be collisions. Open hashing solves it by creating a linked list within buckets which you will need to traverse. Closed hashing solves it by p
146.
by palant 8y ago
There are some options. For example, if the indexes are known to be within a certain range, a plain array will do better. For tables below a certain size, an array of key/value tuples might also perform better. An implementation could
147.
by palant 8y ago
> Could be they knew what they had to find... Or, more likely, you are simply looking at the result of extremely tedious trial & error, with the failed lines of investigation omitted from the final writeup.
148.
by palant 8y ago
Yes, it does. I just tried this, when I set a passphrase everything shows up as encrypted in the Google Dashboard. So maybe things changed since I wrote this, or maybe I misunderstood it initially. Either way, the default is not having a pa
149.
by palant 8y ago
Yes, Firefox could do better, but at least Sync there was designed with privacy in mind - Chrome Sync wasn't, and even if you set a passphrase it will only encrypt passwords and none of the other data such as your browsing history. Eit
150.
by palant 8y ago
Yes, the intention behind Chrome was very obvious pretty much from the start: it has to benefit Google by giving its web services an advantage over competition. I wrote about that seven years ago: https://adblockplus.org/blo

More ›