pfg

62 ms·

601.
by pfg 10y ago
Seems like a lot of effort for an edge case. Now you've added a dependency on some network service you need to access (and from WhatsApp's POV: maintain) before placing outgoing calls. If you use GPS instead, you're dependent
602.
by pfg 10y ago
New(ish) projects using popular PHP frameworks typically have all their code stored somewhere outside of the web server's document root - there's usually just a single PHP file in the document root that's responsible for inst
603.
by pfg 10y ago
Small addition re: Coder: It's not necessary for the module to be enabled in order to be exploitable, it just has to be somewhere in your document root[1]. If you share the same code base between dev and production, you might be vuln
604.
by pfg 10y ago
The way I understand it, this only affects apps, not Chrome for Android. Chrome on desktop follows the HPKP RFC on this matter[1]. Failing pins that chain up to local CAs would break many deployments. On mobile, apps that implement certific
605.
by pfg 10y ago
Sounds about right. With €100k/y, you're definitely in senior management territory in Austria. In comparison to other countries like Germany, salaries are generally lower for software-related jobs (despite the GDP per capita being
606.
by pfg 10y ago
I'm quite skeptical about "independent" AV test sites like these, especially when they come to the conclusion that solutions that would essentially make the AV industry obsolete are inferior ("AV industry" meaning t
607.
Breaking into the KeyStore: A Practical Forgery Attack Against Android KeyStore(eprint.iacr.org)
4 points by pfg 10y ago|0 comments
608.
by pfg 10y ago
My understanding is that user scripts allow you to match based on the URL. It would still be a predefined set of URLs (or URL patterns) with a binary option for the user (install and accept everything, or don't). That's essentiall
609.
by pfg 10y ago
That's a great idea. The implementation could look similar to how Firefox handles plugins today, offering the option to "Always activate", "Ask to activate", and a way to say "Always allow for this domain"
610.
by pfg 10y ago
The base and turbo frequency is different as well. Seems to amount to about a 10% difference in most CPU benchmarks, prior to overclocking.
611.
by pfg 10y ago
The article does make a good point regarding warning fatigue, which was one of the main reasons why Android is moving towards a permission system similar to what iOS does, i.e. ask for permission only when needed, and degrade gracefully if
612.
by pfg 10y ago
Whenever this pops up, I keep wondering if there's any precedent for antitrust rulings against companies in industries where they don't exactly hold a monopoly, but have essentially created their own market-like structure while al
613.
by pfg 10y ago
> How was this attack carried out? The malvertisers used a technique called “domain shadowing”. Attackers who have gained the ability to create subdomains under a legitimate domain do so, but the created subdomain leads to a server under
614.
by pfg 10y ago
Slightly simplified: Each and every CA that's trusted by your browser is capable of issuing a certificate for every single domain on the internet. A certificate is basically nothing more than a document saying "StartSSL has veri
615.
by pfg 10y ago
It's unlikely that they'll suffer any consequences. The CA death penalty (i.e. root removal) is usually only used in cases of massive breaches, like in the case of DigiNotar. Sometimes, root programs force CAs to adopt things like
616.
by pfg 10y ago
I can't believe that they not only decided not to implement ACME (the protocol behind Let's Encrypt), but also not to at least reuse large portions of ACME, like the way HTTP ownership validation was implemented. It's simply
617.
by pfg 10y ago
This vulnerability does not make FDE pointless per se. It means that your security depends completely on the complexity of your passphrase (like the iPhone prior to the introduction of Secure Enclave). Which is still fairly bad given the ty
618.
by pfg 10y ago
I think you're missing my point. I'm not saying either is better in that respect (like zyx321 claims for Windows), I'm just saying they're both just as vulnerable despite the existence of sandboxed apps.
619.
by pfg 10y ago
I'm making a comparison to Windows, and my point was that it's no different there today despite the fact that Metro apps exist (just like Flatpak/Snap exists on Linux). Walled gardens such as iOS are definitely superior in th
620.
by pfg 10y ago
That still seems like an odd trade-off. The same logic should apply to things like YouTube and Google+, but they don't have a ccTLD redirect for those sites.
621.
by pfg 10y ago
I believe Flatpak/Snap (Fedora/Ubuntu's new app packaging formats) makes this possible quite easily. It'll take quite some time until these initiatives really take off, but then again things aren't all that differen
622.
by pfg 10y ago
I'm having difficulties understanding this. If Google receives a request to remove content from some specific country, I would assume they are doing this based on Geo-IP rather than based on the domain users enter. It wouldn't rea
623.
by pfg 10y ago
> I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent.
624.
by pfg 10y ago
The first tool I run on new Macs is osxlockdown[1] (use [2] if you want a UI). It disables a bunch of features and enables things like the firewall. Make sure you don't disable things you're actually using, though. I don't ru
625.
by pfg 10y ago
If this gets implemented in a way that's clearly visible to the user, the effects on the CA are almost indistinguishable from the death sentence. The vast majority of customers would switch to some competitor that's not affected.
626.
by pfg 10y ago
I'm afraid this did actually happen[1]. [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=82...
627.
by pfg 10y ago
Blogspot, for reasons that defy logic, redirects visitors to "localized" domains (I assume via Geo-IP). OP is probably from Malaysia. Not only is it incredibly annoying and breaks things like URL deduplication, it also leaks your
628.
by pfg 10y ago
Being able to decrypt messages should certainly not be the benchmark you use when evaluating crypto, especially when it comes to rather new protocols. History has shown that severe theoretical issues that cryptographers have been warning ag
629.
by pfg 10y ago
My numbers are based on VEP as well[1]. 2012 was a presidential election year, not a midterm election. [1]: http://www.electproject.org/national-1789-present
630.
by pfg 10y ago
> Unfortunately, every time the EU has an opportunity to change, the answer the Eurocrats give is the same: "Let's keep pretending everything is fine." But is it really the Eurocrats who are blocking progress? It seems to

More ›