wepple

48 ms·

571.
by wepple 6y ago
What is it that suggests that might be the case?
572.
by wepple 6y ago
The article appears to be complaining that free services don’t have good support, so the solution is to spend $55. Major providers do offer support plans. If google/Apple/Microsoft is so critical to your life and data, perhaps i
573.
by wepple 6y ago
For the folks who were saying that TLS-everywhere is an unnecessary burden recently: > During our follow-up research on cryptojacking, we discovered that 1.4M MikroTik routers were serving cryptojacking scripts as they were routing Web t
574.
by wepple 6y ago
> It’s been possible for decades and doesn’t end up being a common problem. https://news.ycombinator.com/item?id=3804608 This is far more common than you think. ISPs, hotels, cafes, mobile providers do this en masse far
575.
by wepple 6y ago
Website owners can decide: don’t use a cert. Users can decide: find a browser which doesn’t put importance on cert usage. You’ll find this hard to find because every browser manufacturer realizes that 99.9% of users cannot make sound securi
576.
by wepple 6y ago
I think the article was advocating more for not disclosing the vulnerabilities and silently patching them. So the vuln goes away but no fingers are pointed. Which is also a silly argument; enough security researchers will watch the updates&
577.
Sigstore: Free service to sign and verify software supply chain artifacts(sigstore.dev)
2 points by wepple 6y ago|0 comments
578.
by wepple 6y ago
At Starbucks I can inject arbitrary content into the browser of anyone who visits your site over HTTP and take control of their browser. Furthermore, congrats on your site but you’re 0.01% of sites like that. Should we keep an insecure web
579.
by wepple 6y ago
I’d love for someone to build an overIP bridge for this, so I can sit on the couch at home and fly through the Grand Canyon. I’d happily pay a reasonable sum for it. I wonder if it could be done using a Stadia controller and chrome cast?
580.
by wepple 6y ago
Does NPM offer cryptographic hash pinning of packages the way that PyPI does?* why is this not more widely used? * https://flawed.net.nz/2021/02/02/PyPI-Security-State/
581.
by wepple 6y ago
The article seems to use examples of undeniably bad things Facebook has done to extrapolate to google, without providing any concrete examples. Stating that FB/G use your data to provide targeted ads isn’t an inherently bad thing: it’s
582.
by wepple 7y ago
I think you’ve proven the point here? Poker does not hurt anyone else. Wall St does. See: 2008.
583.
by wepple 7y ago
Building a PoC to prove you can get reliable code execution is typically 10x harder than finding an issue and patching it. The modern approach is to assume that most types of memory corruption could be exploitable, and just patch. Especia
584.
by wepple 7y ago
I’ve done a few small IR jobs in my time, and also have a hobby of reading every breach report that comes out. It seems the vast majority of breach discovery amongst typical companies is an engineer going “hrmm that’s odd”: a router at 100%
585.
by wepple 7y ago
Instructing then how to power wash their chrome book and then simply login with their you okey again is achievable
586.
by wepple 8y ago
Security. My phone is the root of trust for my life. It has my password manager (I never use a PM on a full computer) and is my only truly trusted device. I wouldn’t trust your Motorola’s timely security updates or hardware trustzone implem
587.
by wepple 8y ago
+1 DrNuke, please reconsider what you’re doing here. 3 years is hardly enough to understand the cyber security problem space, let alone build useful products/solutions. At best, they’ll fleece some unaware VCs, sell rubbish to companie
588.
by wepple 8y ago
Yeah, RL are hoping to have weekly cadence. I suspect larger launch vehicles won’t be able to match that kind of regularity or response time for smaller payloads
589.
by wepple 8y ago
Can someone explain to me, did I miss the description of the actual bug here? I get there’s a copy, but why is there an under-allocation to start with? Or is that alloc somehow attacker-controlled? Was part of the copy func args controllabl
590.
by wepple 8y ago
Clydesdale bank has 38m gbp in assets, and they’re a relatively not-heard-of obscure bank operating in the UK. I think monzo could bring want consumers want globally. I was preaching it’s virtues here in the US until they disabled internati
591.
by wepple 8y ago
Somewhat tangentially, it’s actually a fairly smooth process to pull data off a MacBook when the keyboard/graphics/touchpad are dead. A friend dropped a drink through his and it looked very dead. Turns out with a thunderbolt cable
592.
by wepple 8y ago
It’s weird, they appear to be tec divers, yet you’re right.. the photographer (two off-camera strobes) goes ahead and ruins viz with a couple of kicks?
593.
by wepple 8y ago
If you’re making the statement in relation to this article; not at all. Very few people would be targeted by something like this. The cost to develop and maintain is too high to risk a leak. If I worked in a high-security environment, I wou
594.
by wepple 8y ago
I’m curious; why?
595.
by wepple 8y ago
Sure, you can wonder, but when I break it down, it’s either highly unlikely or highly clumsy. If I were to put a backdoor into this code, I’d want the following properties: - tricky to spot in code review - virtually undiscoverable via curr
596.
by wepple 8y ago
But it’s still there in plain sight. I’d hazard a guess that this may be the first time a solid code reviewer looked at the code, and spotted it straight away* If you wanted 10x better, you could throw in some code that exhibits undefined (
597.
by wepple 8y ago
I guess you could say that about absolutely any bug though? This isn’t particularly underhanded, and it’s more of a broad design flaw than a subtle change. If you wanted a “backdoor” you could absolutely do 10x better than this.
598.
by wepple 8y ago
The fix implements a basic state machine to ensure protocol state transitions are sane. Prior to this, attacker-supplied data was used in calculating the offset inside an array of callbacks. So you could just tell the server to call into th
599.
by wepple 8y ago
I tried to cancel my paid account so I could create a new paid account without FB login. It was so frustrating that I’m now a happy Apple Music user. Protip to companies: if your product is excellent, make account cancellation frictionless
600.
by wepple 8y ago
I too am originally from the rest of the world, but currently living in the US, and agree that flying in the US is absurdly and frustratingly poorly managed. My point about carry-on is that in other countries, you are strictly limited in wh

More ›