awirth

13 ms·

1.
by awirth 9mo ago
I have a 60L fish tank in my Tokyo apartment on around the 10th floor. It's sitting on stand that is not bolted to the wall. I have several friends with similar setups. In the last 6 years there have been two or three earthquakes that
2.
by awirth 1y ago
It's been a year. Has it been disclosed what tool had this misconfiguration?
3.
by awirth 1y ago
I also got a lot of value out of wanikani even without completing it. I tried and failed several times to get started with Anki before having success with Wanikani. The key diffentiator for me was the learning step. Anki is great for rememb
4.
by awirth 1y ago
These tokens never expire , and there is no way for organization administrators to get them to expire (or revoke them, only the user can do that), and they are also excluded from some audit logs. This applies not just to gh cli, but also s
5.
by awirth 1y ago
What you're describing is a specific case of a confused deputy problem: https://en.wikipedia.org/wiki/Confused_deputy_problem This is captured in the OWASP LLM Top 10 "LLM02:2025 Sensitive Information Disclos
6.
by awirth 4y ago
Now, I've done it by email! (although still using the convenience store for print/scan) Unfortunately, https://www.sec.state.ma.us/ is geo-blocked for all of Japan (and several other countries AFAICT) "due to
7.
by awirth 4y ago
That's interesting, I've always reveled in the absurdity, but perhaps I'll re-read it with an eye to take each chapter in as a discrete unit. Thanks!
8.
by awirth 4y ago
Cat's Cradle is one of my favorite books, but to be honest, I've never found it that funny - at least not in the sense that it makes me laugh much. What do you find so funny about it?
9.
by awirth 4y ago
If you can access the classloader that's pretty bad, it's likely people will find other gadgets. It's insane to me though that class.* isn't completely disallowed. What is the legitimate use case for deserializing allowi
10.
by awirth 5y ago
I've been able to vote abroad in state/presidential elections from my last address in the US. I do it by email. My only major hiccup is that the MA secretary of state's website www.sec.state.ma.us (which has the info about u
11.
by awirth 5y ago
Now that I live in Japan, I've come to learn that for Japanese Windows users, seeing the ¥ symbol as a path separator is normal , it isn't a quirk or a bug. In fact, IIRC the copy machine in the closest convenience store shows a
12.
by awirth 5y ago
I live in Japan and have the same problem with the Massachusetts department of state website (which contains voting information). I contacted my state representative (who does represent me, as I voted for him) and unfortunately he couldn&#x
13.
by awirth 6y ago
Years ago helped handle a support request from a man named "fread" who had a similar issue.
14.
Show HN: Don't Webpack Untrusted Code(gist.github.com)
1 points by awirth 6y ago|0 comments
15.
by awirth 6y ago
Yes. This is why running without `env_reset` is considered inherently insecure and the typo fix wasn't considered a security fix by the sudo maintainers. The list is still relevant to this discussion though as a nice "greatest hit
16.
by awirth 6y ago
See also the sudo bad environment variable list[1], which I recently found a 15 year old typo in.[2] [1]: https://github.com/sudo-project/sudo/blob/master/plugins/sud... [2]: https://www.
17.
by awirth 6y ago
Too late to edit, but out of curiosity I re-implemented this to use the PCRE JIT (in PHP) to see what kind of speedup it would provide: https://gist.github.com/allanlw/69df509519335b88db886d48503a... Timings for fred.c
18.
by awirth 6y ago
Is there a BEP to make this work for native torrents too? Also I don't understand the name "Web3torrent", is it intended to indicate a new version?
19.
by awirth 6y ago
Interesting, I wasn't aware of the history. Personally I make the distinction, but I've noticed many many people do not, hence the question.
20.
by awirth 6y ago
This reduction is really cool. I love reductions like this. Is there a general consensus to use "regular expression" to refer to the actual regular ones and "regex" to refer to the non-regular variants?
21.
by awirth 6y ago
Thanks! That's interesting!
22.
by awirth 6y ago
Note, this is about https://en.wikipedia.org/wiki/Lattice_(order) as in partially ordered sets, not https://en.wikipedia.org/wiki/Lattice_(group) as in geometry (and used by lattice cryptography)
23.
by awirth 6y ago
I assume you probably can't share the client, but can you share the general domain of the software?
24.
by awirth 6y ago
Depends on the type of security researcher -- some profit from it!
25.
by awirth 6y ago
>With GH now letting you create Organizations with private repositories I thought this was always the point of Organizations..?
26.
by awirth 6y ago
Some days I miss using prototype.js and script.aculo.us
27.
by awirth 6y ago
Is it possible to subscribe to a firehose of .COM NS record updates through one of those fancy things like dnsdb? If so, perhaps there's an opportunity here for exploiting that race condition en-masse for services that support direct N
28.
by awirth 6y ago
You would think so, but it turns out that this ("subdomain takeovers") is a very common mis-configuration for a lot of *aaS services. Enough so that some bug bounty programs won't pay out much for it or at all because it happ
29.
by awirth 6y ago
I'd be curious to hear your observations. I did BA/MS at BU in CS (CAS of course) and found the classes often hit or miss, but the ones that were good were really good. That being said, I did have an interest in theoretical CS whi
30.
by awirth 6y ago
From a security perspective, even assuming those operators already design to not trust the locations they're in, shipping servers to random end users seems like a bad idea.

More ›