rvnx

18 ms·

421.
by rvnx 11mo ago
It is not as cool as the RPC exploit of React/Next.js where you could call any function on the server-side including “vm.sysexec” or whatever it was, but still not to be fully ignored
422.
by rvnx 11mo ago
detected: WAF caught or detected the attack and raised an alert, post-exploitation discovered: they audited or pentested themself and found out, preemptively I just mean that Coinbase didn’t see anything happening and didn’t take action tho
423.
by rvnx 11mo ago
I understand your perspective about the technical value of an exploit, but I disagree with the concept that technical value = market value. There are unorganized buyers who may be interested if they see potential to weaponize it. In reality
424.
by rvnx 11mo ago
You can also just be logged-in on Discord web, so everything is accessible too
425.
by rvnx 11mo ago
Well, llmslave2 is right. If discord.com executes javascript to conduct user actions, and you can execute javascript on discord.com, you are acting on the account as if you were discord.com
426.
by rvnx 11mo ago
Seems like none of these major websites detected anything, and they are supposed to be top-notch in the world. It's only because the researcher contacted them.
427.
by rvnx 11mo ago
True, I just considered that once you handle a PDF with so much care like if it was poisoned, it's perhaps better to send this poison to someone else to handle.
428.
by rvnx 11mo ago
For Coinbase docs, this is a disaster particularly
429.
by rvnx 11mo ago
There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.
430.
by rvnx 11mo ago
Do you want to execute actions as logged-in user on high-value website XXX ? If yes -> very useful
431.
by rvnx 11mo ago
Finally! Free material to ingest in our LLMs (while it violates copyright, it's good for the humanity as the reasoning of LLMs can lead to new discoveries and more widespread knowledge).
432.
by rvnx 11mo ago
I would not be that confident as you can see: on their first example, they show Discord and the XSS code is directly executed on Discord.com under the logged-in account (some people actually use web version of Discord to chat, or sign-in on
433.
by rvnx 11mo ago
Use the PDF to JPG online services, convenient and you still get your result without having to deal with any sandbox
434.
by rvnx 11mo ago
Why would that be the maximum damage ? This XSS is particularly dangerous because you are running your script on the same domain where the user is logged-in so you can pretty much do anything you want under his session. In addition this is
435.
by rvnx 11mo ago
You don't even have to go that far, in Europe, to use a large social network (50M users), and the definition is very broad (WhatsApp is a social network, Telegram, Signal, TEMU, Aliexpress, etc), all users will have to provide their ID
436.
by rvnx 11mo ago
Not many people know about it but the world is an illusion, it is believed to be based on PS1 triangles so you have to count the edges thrice. Prove me wrong.
437.
by rvnx 11mo ago
Ah, perfect! One question: is Ticketmaster rejecting non-"Big email providers" ? I suspect they do, due to bots (wouldn't it be the same with Tinder, etc ?)
438.
by rvnx 11mo ago
I agree with you, and I think your reasoning is totally understandable. Just that I see additional friction, and friction in a business world is risk :/ (side-note, with Jitsi, it feels like I have a fireplace log in the hands when I u
439.
by rvnx 11mo ago
Soon the cars are going to drive away on their own, so what's with the keys anyway ?
440.
by rvnx 11mo ago
In… 5 years, and the prejudice won’t accumulate because your claims will still be based on 5 years ago :/
441.
by rvnx 11mo ago
Well on a similar topic, next step you could look at crypto’s and casinos. What are the biggest players doing there.
442.
by rvnx 11mo ago
This. 100%. Local shops are taking huge margins, have limited selection and are slow because they need to order from… central warehouse
443.
by rvnx 11mo ago
But you don’t mind paying more and having a worse service IRL when you could just buy a cheap Pixel phone with GrapheneOS on the side ? Think of it like a car key. You wouldn’t have a crusade against car keys right ?
444.
by rvnx 11mo ago
Reality is that you are the one paying the price, you will spend 45 minutes extra at the office when you could have spent it with your family or friends or playing soccer. Time is the most precious thing in life, you’ll never be able to buy
445.
by rvnx 11mo ago
Banks 2FA are not SMS anymore, so no banking, and because no 2FA no online card payments and no limit adjustment. Some banks are even app-only. IRL events where you have to open the app at the gate. Probably no charging for your EV. No bus
446.
by rvnx 11mo ago
I wonder how many users are bots farming for karma nowadays. If you are launching a startup, it’s very worthy to push your product on the HN homepage.
447.
by rvnx 11mo ago
Little trick: You can also randomly insert dots in your email address, a bit more stealth and compatible with more sites :)
448.
by rvnx 11mo ago
Reminds me of a story: When Facebook was launched I created an account. Fast forward 10 years, account got permanently locked for suspicious activity. Unsuccessful appeal. So permanently lost contact with some of my childhood friends and no
449.
by rvnx 11mo ago
Depends, > Zion serves as a living space for humans who have chosen to be disconnected from the Matrix https://en.wikipedia.org/wiki/Zion_(The_Matrix)
450.
by rvnx 11mo ago
The main side-effect is the lack of trust and integration. For example, if you self-host your email (or more realistically push it on a VPS), then the moment you want to send an e-mail you are going to be marked as spam. To register on some

More ›