r1ch

56 ms·

631.
by r1ch 12y ago
Are regular bug bounty programs simply not paying enough whereby researchers decide to hold onto exploits for high paying events like Pwn2Own? How much would these kind of exploits go for on the black market?
632.
by r1ch 12y ago
I still don't see many arguments about advertising when it comes to TLS. I can't deploy TLS across my sites without losing a huge amount of ad inventory due to cross-site request policies (no HTTP content from HTTPS domains). AFAI
633.
by r1ch 12y ago
Until ad networks make a serious effort to enable https on their networks and CDNs, I can't run https on any of my sites. Mixed content security means no http ads and thus no revenue.
634.
by r1ch 12y ago
Unfortunately even the simple HTML 5 image ads (rendered using canvas) can have malicious scripts in them. The only way to stop the bad ads would be to only use text ads from Google which would likely lead to unsustainable revenue loss.
635.
by r1ch 12y ago
Adwords is becoming increasingly bad with these kind of ads lately. Yahoo are lucky that they don't have the automatic redirecting version that simply takes visitors away from your site onto these fake landing pages. Most of them seem
636.
by r1ch 12y ago
I would recommend adding a warning for Hartz products - they are notoriously toxic and kill pets. http://www.hartzvictims.org/
637.
by r1ch 12y ago
Hmm, it's been a while since I last touched cPanel (almost 10 years), but I recall it automatically included aliases for cgi scripts into each vhost. Try /cgi-sys/guestbook.cgi on any cPanel website for example (a random Goog
638.
by r1ch 12y ago
cPanel is probably the most popular reseller hosting software for shared web hosting and it relies on CGI in all kinds of places. That alone provides a huge amount of exploitable hosts - I tried to Shodan it (port 2082) but it seems down ri
639.
by r1ch 12y ago
That sounds great, I'll shoot you an email tomorrow. Thanks!
640.
Ask HN: Where do you get your code signing certificates?
3 points by r1ch 12y ago|4 comments
641.
by r1ch 12y ago
IPNs were unaffected for us. This probably only affected a small segment of customers.
642.
by r1ch 12y ago
Some users block the big CDNs for privacy reasons, so local is a safe fallback.
643.
by r1ch 12y ago
Google's malware scanning service also generates false positives and provides no contact info for submitting an appeal. A little too automated for my liking.
644.
by r1ch 12y ago
You'd probably end up paying a lot more than $5/mo for a VPN that is actually able to keep up with gigabit internet speeds and downloading habits.
645.
by r1ch 13y ago
For me, their 2FA is essentially unusable. It uses a UK SMS gateway (no Authy / Google Authenticator support) and out of the 20 or so times I've tried to set it up, only once has the code actually come through to my phone. I'