theboss

20 ms·

121.
by theboss 13y ago
It's so obvious when papers like this are released for publicity. "Instead of reporting small problems we find we should release a paper with a scary sounding title first"
122.
by theboss 13y ago
The very BEST slideshow about using Tor to stay anonymous. You'll see his mistake in it. http://www.slideshare.net/grugq/opsec-for-hackers
123.
by theboss 13y ago
Well his title started with the letter C. That's head honcho to me.
124.
by theboss 13y ago
I actually interviewed with them...if you can call it that. I saw some negative post on here about them and decided to submit my resume for the heck of it. They called me that day and I talked with HR and then we set up a ``technical'&
125.
by theboss 13y ago
If github is reading this, I would love to be able to explore by ``genre''. I'm not really interested in a lot of the popular repos on github that are flashy js libraries or whatever. It can be harder to find repos that are,
126.
by theboss 13y ago
Im very interested what advantages this has over gitignore?
127.
by theboss 13y ago
I actually purchased a few domain of erroneous domain names spellings for the purpose of experimentation and ended up with A LOT of traffic. Because I got so much traffic, I decided to make the sites useful, and I wrote a little php script
128.
by theboss 13y ago
Let me rephrase. Nobody will go to jail for the level of poking and prodding I expect Dave is trying. I'm 100% sure the CFAA won't send anyone to jail for alert(1) My 100% is a gut feeling. I'll quit computers if I'm wro
129.
by theboss 13y ago
I do test a lot of websites actually but I mis-understood what you meant. Like the other guy said this area is grey. If he accidentally finds a stored xss of the magnitude you suggest I'm 100% sure he still wouldn't go to jail. Wh
130.
by theboss 13y ago
It's not 100% for a nobody like theboss but I can 100% guarantee you the FBI isn't going to come after Dave of all people...an extremely well-respected, knowledgeable, former-NSA employee...
131.
by theboss 13y ago
Reflected XSS? Do you mean stored? If Dave is testing for reflected XSS he's going to be alert(1)'ing or using img tag....Which is not a persistent xss... For reflected xss to affect every user on the site he's going to have
132.
by theboss 13y ago
You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail. He's not performing a full pen-test on the site. He's not looking to get a shell. He's just checking out best practices.
133.
by theboss 13y ago
I have a question. Is BTC inherently crash resistant right now? Due to the difficulties of withdrawing large amounts of money at once from BTC, wouldn't that make the currency pretty resistant to a crash?
134.
by theboss 13y ago
Because Im a powerlifter. Powerlifters need calories and Soy milk + my protein powder tastes good but my protein powder with water tastes like gasoline (and soy milk has more calories too). I used to do soy protein + water and it was pretty
135.
by theboss 13y ago
exactly (T)his. i (k)new you would beat me to posting. even control + f'd (Two) see if y(o)u beat me to postin(G) I'm allergic to milk and have been taking soy protein, soy milk, etc. for years with no problems. My evidence is ane
136.
by theboss 13y ago
Web designers aren't free software......
137.
by theboss 13y ago
Seems to me this guy is going about it all wrong. Why not keep your mouth shut and sue. If he never got paid and never signed anything then it's a clear case of copyright infringement since the images are being used in commerce. Lawyer
138.
by theboss 13y ago
I think you could offer 1million but it has to be a competition where the teams that enter solve a single problem. That way accurate scoring metrics can be developed and used. It doesn't make sense to say "Hackathon, 1 million dol
139.
by theboss 13y ago
Is it? I "interviewed" at one YC funded startup in particular and they asked me to build a trivially small and simple js application (even though I applied for a DevOps position, but I guess devops is different for everyone...). T
140.
by theboss 13y ago
A great resources to for no-equipment workouts is /r/bodyweightfitness. An excellent set of resources (written by nerds who I know read HN) who happen to be really into fitness. An important part of fitness is being on a program.
141.
by theboss 13y ago
Yeah you can force it if you call shellcode as a function but other than that, libc functions, if the elf is dynamically linked, will be mapped in using the procedure linkage table before main runs but...this is because printf != the write
142.
by theboss 13y ago
United857 is right. This totally gives a false impression that regular C code I write will use syscall instead of functions that exist in libc that are dynamically mapped in using the plt. My C code will never say int 0x80 Otherwise this I&
143.
by theboss 13y ago
They don't build it themselves they have contractors. The contractors make mistakes and there isn't enough resources to find/fix them all. Much of the technical mistakes made by the contractors aren't due to poor enginee
144.
by theboss 13y ago
You say it like you're blaming them. Do you realize the sheer number of assets they have to protect? The government knows it will always have a soft exterior due to it's size. This is why they have air-gaps and such strict policie
145.
by theboss 13y ago
I wonder how much legacy code can be pushed malware using one of these.
146.
by theboss 13y ago
I mean. Google is so large it will always be making mistakes like this. A lot of people look at Google as a whole like it is the greatest set of technical minds in any room on the planet. Sure they have lots of smart people etc.etc but with
147.
by theboss 13y ago
No. I'm only saying that if your goal is to prevent the NSA from working against you then this isn't the way to prevent that. People seem to be a bit upset that I think so also. If there are whole countries that are angry and the
148.
by theboss 13y ago
Hahah. If you refuse to go the legal route there is nothing you can do but live with the surveillance and protect yourself. It's the only route that could possibly work. I laugh because the legal route is the route people are supposed
149.
by theboss 13y ago
Let's say every mathematician agreed to no longer talk to NSA at all. NSA would just hire Computer Scientists and dump loads of money into security research. Or they would hire computer scientists to work as insiders at M$, Apple, Cisc
150.
by theboss 13y ago
You have to play by DC's rules which means you have to go the legal route. Just saying "Sorry we won't play with you anymore" won't work because there are a lot of other smart kids with PhDs on the playground.

More ›