taviso

20 ms·

181.
by taviso 7y ago
This didn't happen, I have never DM'd you.
182.
by taviso 7y ago
This seems like a good time to mention my (ridiculous) project, a ctypes module for bash. https://github.com/taviso/ctypes.sh/wiki There are some little demos here: https://github.com/taviso/c
183.
by taviso 7y ago
> I have never once seen someone say that it's irresponsible for security engineers to point out flaws in software. I've got news for you, it happens all the time. I can't open my mouth without some Microsoft lackey shouti
184.
by taviso 7y ago
It's acceptable to cut corners and ship shoddy software to consumers, because if anyone points out the flaws, they're being "irresponsible". The responsibility to protect customers is therefore shifted away from the vend
185.
by taviso 7y ago
This is actually the subject of some debate, believe it or not, there is a good argument against it. Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss preventio
186.
by taviso 7y ago
I think you must be talking about CVE-2010-0232, it wasn't 90 days, it was more like 180. This was at a time when Microsoft refused to release kernel patches outside of service packs. I begged Microsoft at multiple in-person meetings a
187.
by taviso 7y ago
Funny story, there was actually a security vulnerability in that Win+Number feature! Here's how it worked, there's a Windows security feature called UIPI (User Interface Privilege Isolation) that prevents processes from sending me
188.
by taviso 8y ago
You could use uniq -u to avoid the awk.
189.
by taviso 8y ago
As far as I'm aware, legal experts agree there is no way to compel you to lie. Apple's general counsel has said on the record he doesn't know what Bloomberg are talking about, so how would they even verify this gag order was
190.
Halfempty: Fast, Parallel Testcase Minimization(github.com)
40 points by taviso 8y ago|2 comments
191.
by taviso 9y ago
That is not ignored, the article includes a simple architecture diagram that explains the standard solution to problems like this. In the diagram, you can see that there is a privileged process (labeled parent) and a sandboxed process (labe
192.
by taviso 10y ago
I believe you have to switch to the "beta" channel, because 3.3.x is deprecated. imho, you should do this urgently. https://addons.mozilla.org/en-Us/firefox/addon/lastpass-pass... https:/&#x2F
193.
LastPass release fix for DOM manipulation vulnerability(blog.lastpass.com)
158 points by taviso 10y ago|162 comments
194.
by taviso 10y ago
Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.as
195.
by taviso 10y ago
You have no idea.
196.
by taviso 10y ago
correct
197.
Automatically import native structures into bash(blog.cmpxchg8b.com)
2 points by taviso 10y ago|0 comments
198.
by taviso 11y ago
You expended a lot of effort on what could have been easily resolved by asking me. The XSS that you're concerned about was for illustrative purposes only, and could not be used in an attack due to mixed-content errors. I don't rea
199.
by taviso 11y ago
It's definitely a neat demonstration that he can produce a collision for these favourable "neutral-bit" IV's relatively cheaply. I suppose the next steps are to find two inputs that produce favourable IV's, then rep
200.
by taviso 11y ago
Making their software safer, that'll learn 'em.
201.
Ctypes.sh: A foreign function interface for bash(github.com)
3 points by taviso 11y ago|0 comments
202.
Project Zero: Analysis and Exploitation of an ESET Vulnerability(googleprojectzero.blogspot.com)
54 points by taviso 11y ago|9 comments
203.
Major Security Problems with Automatic Crash Analysis(openwall.com)
35 points by taviso 12y ago|0 comments
204.
by taviso 13y ago
I actually audited gpg in 2006 while studying, it was an interesting project. Here are some of the results: Remotely controllable function pointer http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/00024..
205.
Why Everyone Is Pissed Off About Google Chrome’s Sound Security(wired.com)
1 points by taviso 13y ago|1 comments
206.
by taviso 13y ago
Are you sure you read that second link? This is not a bug. Click on "Your address is similar but has more or fewer dots (.) or different capitalization." to expand the explanation. We had to add a link to this support document to
207.
A visualization of Stevens' 66 round SHA-1 collision(lock.cmpxchg8b.com)
1 points by taviso 14y ago|0 comments
208.
Exploiting MS13-005: Protected Mode (LI UIPI) Sandbox Escape(blog.cmpxchg8b.com)
1 points by taviso 14y ago|0 comments
209.
by taviso 14y ago
Related blog post http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-progr...
210.
Hacking WinRAR for fun and profit(github.com)
137 points by taviso 14y ago|47 comments

More ›