zemnmez

17 ms·

121.
by zemnmez 7y ago
I agree with the gist of what you're saying, which is that it's not possible to fully 'solve' security in video games by good security architectural design – it's just that for 99% of games out there, there is not e
122.
by zemnmez 7y ago
as someone who works in the gaming industry, i think anti-cheat exists in part because of the culture of game development. every games company i have worked with has valued releasing the content they want to release above everything else –
123.
by zemnmez 7y ago
i'd wager the restrictions on leading dashes are to prevent command switch injection attacks on users
124.
by zemnmez 7y ago
i don't think this would 'explain' a logic gate to anyone who doesn't already understand a logic gate. this model doesn't convey any information that would help someone reason about a logic gate. If you didn't
125.
by zemnmez 7y ago
Critically, there's no information about whether reporters are allowed to disclose, which usually means that Apple is going to hide any seriously damaging vulnerabilities...
126.
by zemnmez 7y ago
it's probably Have I Been Pwned. Typically this constitutes a big pile of hashes
127.
by zemnmez 7y ago
> I suspect the victim here is the US (since the money should be going there instead of some tax haven) and not individual EU member states. "An unexpected conclusion from Hines-Rice was that: low foreign tax rates [from tax havens]
128.
by zemnmez 7y ago
I learned more about haskell reading this than I ever have from anything else
129.
by zemnmez 7y ago
this is just JSON RPC? The "constantly serialize and deserialize it" statement is totally untrue too... The frontend makes 6 XHR calls just to render a single page and they're all just JSON. The idea of the frontend 'jus
130.
by zemnmez 7y ago
I definitely saw something like this buying (of all things) underwear. calvin klein makes cotton underwear and the more expensive 'stretch cotton' underwear. The listing had a picture of the stretch cotton underwear, but I, and ab
131.
by zemnmez 7y ago
interesting ... I wonder how this is secured from attacks from the website itself redressing it and/or clickjacking attacks
132.
by zemnmez 7y ago
because there are way, way more ways of getting XSS than innerHTML. if innerHTML was the only way to get XSS, XSS would have been solved by React / Angular. Consider <a href=xx/> – if xx is `javascript:alert(1)` it executes
133.
by zemnmez 7y ago
if the idea is "limit the size of JSON" you already have http.MaxBytesReader or io.LimitReader
134.
by zemnmez 7y ago
what is a 'json threat'? What is the threat actor here? It seems like you do some depth / length checks on arrays and objects but it also 'validate's json somehow? https://github.com/ankur-anand&#x2F
135.
by zemnmez 7y ago
a classic of pious parenting is making the lives of your own children especially difficult to teach them some kind of life lesson. this one especially gets to me. though I didn't know it at the time, I grew up with adhd and depression.
136.
by zemnmez 7y ago
wow! this website looks so refreshingly ... 2010? somehow
137.
by zemnmez 7y ago
i'm honestly really surprised by this! a lot of people go more vegetarian for the health benefits
138.
by zemnmez 7y ago
it is ridiculously expensive to drive in Singapore. The saying is always that the license to drive a car in Singapore can cost twice what you paid for the car itself. As a result, driving is an absolute luxury. For its population of 5.6 m
139.
by zemnmez 7y ago
i cant find any hits for "origin" or "CDN" on the original RiskIQ article: https://www.riskiq.com/blog/labs/magecart-british-airways-br... the RiskIQ article identifies the location of the scri
140.
by zemnmez 7y ago
the URI: http://www.britishairways.com/cms/global/scripts/lib/moderni... doesn't look like its on a CDN
141.
by zemnmez 7y ago
> but tools like SRI and CSP stop these attacks dead in their tracks. this isn't... usually true. in the case of this attack, the Javascript was appended directly to a 'known good' library resource[1]. Typically CSP whitel
142.
by zemnmez 7y ago
kind of? i think this is more about live replication infrastructure than the video carrier itself. with youtube, you can set up some CDNs, but with livestreaming you need to be continually ingesting and spitting out content at the same time
143.
by zemnmez 7y ago
of course :) will be easier when I've relocated to sf
144.
by zemnmez 7y ago
miss you!
145.
by zemnmez 7y ago
> My big concern is at the bottom of that technology pyramid. The lowest common denominator of the Web. The foundation. The rhythm section. The ladyfingers in the Web trifle. It’s the HTML. This is perhaps an annoying pedantic answer, bu
146.
by zemnmez 8y ago
ADHD is a diagnosis based on a group of issues primarily owing to dopamine management. ADHD at the end of the day, is just a word. The way I see it, there's a spectrum of procrastination issues and those that are explosive enough to be
147.
by zemnmez 8y ago
rather unsurprising that a psychologist describes procrastination as a mismanagement of 'emotion' rather than a dysfunction of the dopaminergic reward systems. as someone taking ADHD medication, i can tell you that procrastination
148.
by zemnmez 8y ago
the weakest point in systems like this is usually the mechanism by which the local process communicates with the browser. it's very hard to secure such a mechanism properly as there's no official API for it this claims to use the
149.
On the security implications of locally hosted web services(medium.com)
4 points by zemnmez 8y ago|0 comments
150.
by zemnmez 8y ago
to put this in perspective, this is one-quarter of Google's global search traffic, in hack attempts. 'hack attempts' are always bullshit but this is especially impressive

More ›