wepple

66 ms·

871.
by wepple 10y ago
Hackers & Masters of Doom are two of my favourite books. And I'm not even really a gamer.
872.
by wepple 10y ago
I really enjoyed and got value from books about companies/people I admire; Hatching twitter, In the Plex, Elon Musk, etc. More specific topics, however: * "what every body is saying" - how to read/understand body languag
873.
by wepple 10y ago
I feel like a lot of these systems would be very interesting to fingerprint. Especially/only when they're all automated tech stacks, it wouldn't appear that hard to feed them with varying inputs and use feedback to establish
874.
by wepple 10y ago
Rowhammer itself has been around a while, and is only 50% of this attack that has been posted. The other bit is the newer idea (well, old idea, newer actual implementation); memory deduplication by your hypervisor leads to a very minor timi
875.
by wepple 10y ago
without being an expert in this area; my gut feel is that the fix to this problem is likely going to be funded by the end user. Given that competition continues to drive prices down, would 'secure ram' be viable? would you pay mor
876.
by wepple 10y ago
> Yes, it move the single point of failure to the user's email account This isn't even that greater of a concern; it currently is in 99% of cases the method for password reset anyhow.
877.
by wepple 10y ago
plus everyone behind a single NAT IP will get the message and freak out.
878.
by wepple 10y ago
did dropbox ever write up the details of how they were compromised and what else the attackers may have taken? If not, there's nothing to suggest they didn't take other things.
879.
by wepple 10y ago
You can keep 1pass on an iOS device, and auth using fingerprint. Ultimately you're still going to need/want to know the actual underlying passwords to both iOS and 1pass, however.
880.
by wepple 10y ago
I love and use 1password, but to be honest I can't see any 'pro' features that I need/want: https://support.1password.com/pro-features/
881.
by wepple 10y ago
>given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Actually, by nature of being Open source there's 100% increased likeliness they&#x2
882.
by wepple 10y ago
I definitely agree with your premise, that OSS can more easily be reviewed. In reality, do you think/know that happens? (I'm genuinely intrigued). I know almost all major software shops generally have some kind of formalized proce
883.
by wepple 10y ago
The NSA would have a cache of remote code exec exploits in PFSense if they actually cared about exploiting. But they don't.
884.
by wepple 10y ago
>The affected systems are ones that I had told others were likely insecure (by virtue of being closed source), but no one listened to me. If you care about network security, then you should use a properly configured software firewall&#x2
885.
by wepple 10y ago
yeah, I'm wondering if it's re-exploit on boot or actual subversion of the OS though
886.
by wepple 10y ago
The attacker could find a way to be in the kernel, or insert a shim between the app and OS if everything was sufficiently obfuscated.
887.
by wepple 10y ago
it likely doesn't have persistence due to secure boot chain, so it could get worse. or attacks against Secure Enclave.
888.
by wepple 10y ago
yeah, the title is a bit misleading. 'military robots' != 'autonomous vehicle'
889.
by wepple 10y ago
> Other silicon accelerators include a SQL coprocessor in each core. Entire SELECT statements now run at silicon speeds. seriously? love to see how/why that was put in the die
890.
by wepple 10y ago
Other people have given good, specific answers. Let me generalize from a security perspective: Having a port listening on the internet means you've exposed (usually) tens or hundreds of thousands of lines of code to anyone with an inte
891.
by wepple 10y ago
absolutely; however I confess to not actually be able to successfully implement that control. I know of quite a few people who will actually exit their email app so no notifications can come in and they won't be tempted - suggesting th
892.
by wepple 10y ago
my understanding was that at least one of the attacks from a while back only gave the oracle due to different actual error descriptions in the response, whereas had there been custom error pages defined for all errors, there was no oracle t
893.
by wepple 10y ago
Actually this is kind of a sad situation; I have seen some SNMP publicly exposed, and a lot internally even when its' not actually being used and with default community. It's one of those issues where a CISSP will evaluate the I
894.
by wepple 10y ago
it's not that common to monitor your network infra from the internet, is it? surely you're piping SNMP over local interfaces?
895.
by wepple 10y ago
Their adversaries likely won't make use of the tools for anything serious. They know the NSA already have detection capabilities for their own 0days, and using these tools is a dead giveaway to the NSA that they've been made. An a
896.
by wepple 10y ago
have you read Countdown to zero day: https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?... ? It is ultimately penned for the masses, but even if you're technical you'll likely enjoy it. And the
897.
by wepple 10y ago
I think people fear the rather nasty experience of embedded webview when you click a link. It seems to be a bit of a barrier to entry.
898.
by wepple 10y ago
if we're lucky, twitter will do what they did with the hashtag and other things when they realised their users needs were 'inventing' new features. The 1/n 2/n n/n tweets is a huge indicator of a feature need.
899.
by wepple 10y ago
or they have sufficient empathy to know that what they're doing might be painful but will ultimately save your life or increase your quality of life, and thus is absolutely worth doing.
900.
Compiler explorer: compile C snippets across multitude of arch/compiler(gcc.godbolt.org)
2 points by wepple 10y ago|0 comments

More ›