xorcist

9 ms·

151.
by xorcist 6mo ago
The proof of concept exploit is just that. It is meant to demonstrate one attack vector only. There are many others. If your goal is to prevent the conceptual exploit only then there are many easier ways to accomplish that, such as blacklis
152.
by xorcist 6mo ago
Just socialize losses and all is well. What could possibly go wrong?
153.
by xorcist 6mo ago
There is no way to do what you ask for without having a local CA. And once you have it, any existing caching proxy will work. Now you have moved all security to the proxy, but for some applications it is worth it.
154.
by xorcist 6mo ago
Your question is why we have http servers and http middleware at all. Running an application directly on an endpoint makes sense for embedded application, but for everything else you will end up with a separate http terminating layer for a
155.
by xorcist 6mo ago
The mystery is why uWSGI isn't more widely used. Perhaps the name does not help. It has little to do with WSGI just as FastCGI is unrelated to CGI. It is a tiny binary protocol, with frames just as FastCGI. The reference server works w
156.
by xorcist 6mo ago
I don't think that is how it happened. Yes, there was a SCGI/FastCGI chism, but it was mostly the Python ecosystem that used SCGI and the rest of the world was on FastCGI. Unless you were PHP, in which case you were on mod_php bec
157.
by xorcist 6mo ago
They had a product that interpolated untrusted data into trusted SQL strings, but being told about it (and many other vulnerabilities!) was all that was required to make them watertight . I would be very happy if you right about this.
158.
by xorcist 6mo ago
And every time some company got hacked and embarrassed, the same refrain is played out in the comments: "Those cheapskates, they invest too little in security!". Spend all you want. Buy the most advanced products, and then most ex
159.
by xorcist 6mo ago
That's not "math". That's a "wild guess", or baseless extrapolation at best.
160.
by xorcist 6mo ago
Is that a serious question? Providing for education possibilities, legislating against noncompete agreements to hinder workers to start out on their own, challenging illegal decisions, the list goes on.
161.
by xorcist 6mo ago
Those are inappropriate examples because they are all deterministic. The whole reason behind the AI movement is the move from deterministic processes, and exact descriptions, to handwavy descriptions and stochastic processes. Of course ther
162.
by xorcist 6mo ago
Software is blueprint. Can you really become a decent civil engineer if you never created a buleprint for anything? Will large scale construction projects ever be started with AI made blueprints? There's probably more to the whole engi
163.
by xorcist 6mo ago
So, spam?
164.
by xorcist 6mo ago
This is public data so the big guys could absoltely crawl it. But we should not underestimate the size of the PKI industry, several large actors make good living from the existing web PKI and they will not change unless their very existence
165.
by xorcist 6mo ago
> until an attacker gets access to DNS, stores a record with a TTL of 1 year, DNSSEC may have problems, but that's not how the trust model works. Also signing is separate from authoritative DNS, so you'd need to compromise the
166.
by xorcist 6mo ago
Do you not pay for you groceries? Then the store probably has a good idea about your identity. In any case, they payment processor knows exactly who you are, and the store and anyone else who cares can buy this information online, albeit in
167.
by xorcist 6mo ago
That's really not much better. No function is an island, as wise man almost once said.
168.
by xorcist 6mo ago
I can fully understand "bickering" about someone sprinkling their favourite data type over a codebase which consistently used a standard data type before. The argument that it might be multithreaded in the futurure does not hold i
169.
by xorcist 6mo ago
It's strange to see many non-software related "laws" here, such as the Dilbert Principle, but not Internet cornerstones such as Godwin's Law.
170.
by xorcist 6mo ago
While I appreciate a good rant just as much as the next person, most of these points have nothing to do with CSV. They are a general problem with underspecifying data, which is exactly what happens when you move data between systems. The am
171.
by xorcist 6mo ago
> I can message it "Play my X playlist" People do this? Or is it some sort of joke way above my head? In what bizarre world is it easier to ask a massive LLM to play a playlist rather than ... literally hitting the play key on
172.
by xorcist 6mo ago
Sure, but those masked thugs of yours can simply buy what they need from Facebook. They have deep pockets and it would not even be an inconvenience for them. In fact, for at least for political systems with checks and balances, subcontracti
173.
by xorcist 6mo ago
Well put! Have an upvote. The first one is free.
174.
by xorcist 6mo ago
> It's Trump's job to create positive outcomes For whom?
175.
by xorcist 6mo ago
A government agency, which might even have good use for the data, isn't the problem. The problem is sending your precise location to Facebook and a two dozen silly little games and a note app, which all sell this data to anyone and the
176.
by xorcist 6mo ago
> the code is there for you to look at and use or not Perhaps this is a matter of different perspectives? Every tool I use is an investment for me, it might be light if I only use it once, it might be heavy if I use it for years. That in
177.
by xorcist 6mo ago
They are not exactly equivalents, but that's not the point. I try to expand on this answer in the sibling comment. What's important to notice however, is that the oldest of these are from 2009. At no time in the intervening 15 yea
178.
by xorcist 6mo ago
That's the point I want to convey is that while there are tools like MSI on Windows, many years after Linux had dpkg, it's not the same thing. On Linux the package manager rules the filsystem and keeps a complete database of which
179.
by xorcist 6mo ago
Right, I see where you are coming from, I still want to make the stronger argument that we should not strive to re-work Linux in Windows' image. Most such initiatives, like gconf/dconf, have severely degraded the desktop experienc
180.
by xorcist 6mo ago
I don't know. What's the Windows equivalent of dpkg (from 1993) and ssh (from 1995)? Still nothing, three decades later. Not because Microsoft engineers couldn't do it, of course, but becasue they didn't want to. It does

More ›