dnet

6 ms·

1.
Unauthenticated RCE as Qsecofr via IBM i Management Central(blog.silentsignal.eu)
2 points by dnet 4mo ago|0 comments
2.
by dnet 6mo ago
In newer versions, it's disabled by default and you have to do something like this to enable in ~/.ssh/config: Host * EnableEscapeCommandline yes
3.
by dnet 9mo ago
See https://doctorow.medium.com/como-is-infosec-307f87004563 > This is the same failure mode of all security-through-obscurity. Secrecy means that bad guys are privy to defects in systems, while the people who those syst
4.
by dnet 1y ago
I assume the scanner is a separate library/service that receives the contents and returns a boolean safe/malicious result, and the implementation using MD5 to avoid expensive re-scans is an internal detail hidden from the caller.
5.
by dnet 1y ago
While the default is indeed to lock the entire database, it has been an option for 15 years to avoid this: https://www.sqlite.org/wal.html
6.
by dnet 4y ago
> After several lawsuits and years of backlash Paypal has stopped seizing people's money illegally. Flipper Zero project might disagree: https://nitter.lacontrevoie.fr/flipper_zero/status/156719464... htt
7.
Hungary's top weather experts fired after wrong forecast on national holiday(telex.hu)
4 points by dnet 4y ago|0 comments
8.
by dnet 4y ago
I made my own CA for this because nothing else could provide transparency regarding certificate issuance (whether an attacker issued a "spare" backdoor certificate) - source code: https://github.com/silentsignal&#x
9.
by dnet 4y ago
Why do you mention AVR? AVR-GCC has C++ support, that's what made the original Arduino (before they switched to ARM) approachable to beginners.
10.
by dnet 5y ago
> I'm not even sure it's working in the EU yet? It's called PSD2 and it applies EU-wide since September 2019. Banks have to make _some_ form of API available to third parties. However, these third parties must meet certain
11.
by dnet 5y ago
Not sure about VLC, but ffmpeg has great support for Blackmagic, you just have to download the Blackmagic SDK, compile ffmpeg with Blackmagic support (and the SDK in path) and then you'll have a separate input/output device availa
12.
Our new tool for enumerating hidden Log4Shell-affected hosts(blog.silentsignal.eu)
22 points by dnet 5y ago|3 comments
13.
by dnet 5y ago
Erlang supports hot reloading by design with no limitations. There can even be some threads using the old and some using the new version simultaneously. It was designed for phone exchanges where they aimed for 9 nines of availability. You c
14.
by dnet 5y ago
Not necessarily -- there can be a number of reasons one can access localhost over the loopback interface that does _not_ imply root access: SSRF, misconfigured tunnels, or just a plain unpriviliged account where the attacker couldn't p
15.
by dnet 6y ago
Yet we've had people argue that they wouldn't give us the public part of their JWT RSA signing keypair, because "they wouldn't publish that anyway", hence this post.
16.
Abusing JWT public keys without the public key(blog.silentsignal.eu)
2 points by dnet 6y ago|2 comments
17.
by dnet 6y ago
Tresorit comes from Hungary, they just made a business entity in Switzerland to look better from security/privacy perspective. See https://en.wikipedia.org/wiki/Tresorit#History
18.
by dnet 6y ago
Regular SSH won't work if your IP address changes since it uses TCP where sessions are tied to (IP address, port) tuples. However mosh uses UDP and its own session management scheme, so you can "roam" between IP addresses and
19.
by dnet 6y ago
That wouldn't work for HTTP(S) or anything else that works over TCP since the reply would go towards the fake source IP address, thus the attacker couldn't even get past the 3-way TCP handshake.
20.
by dnet 6y ago
But those wouldn't take most of the world's public git repos down all at once just because of a single issue. Single points of failure have a bad reputation for a reason.
21.
Cipherli.st certificate expired a week ago(cipherli.st)
1 points by dnet 6y ago|0 comments
22.
Decrypting and analyzing HTTPS traffic without MITM(blog.silentsignal.eu)
2 points by dnet 6y ago|0 comments
23.
Unix-style approach to web application testing(blog.silentsignal.eu)
2 points by dnet 6y ago|0 comments
24.
Wide open banking: PSD2 and us(blog.silentsignal.eu)
2 points by dnet 7y ago|0 comments
25.
by dnet 7y ago
That's only relevant if you're using it to make signatures, thus you can make two inputs that hash to the same digest, and signing that digest creates a signature that's valid for both inputs. In this case, the only threat mo
26.
by dnet 7y ago
You omitted an important part: the pointer pointing to the stack. In GC'd or refcounted languages, (almost) everything is on the heap (occasional exceptions being primitive types like integers). This of course leads to worse performanc
27.
Patching Android apps: what could possibly go wrong(blog.silentsignal.eu)
1 points by dnet 7y ago|0 comments
28.
by dnet 7y ago
https://news.ycombinator.com/item?id=19828317
29.
Evading Cisco AnyConnect Blocking LAN Connections(blog.silentsignal.eu)
4 points by dnet 7y ago|0 comments
30.
by dnet 7y ago
Using Elliptic Curve cryptography would've resulted in much smaller signatures, libsodium is considered secure and has bindings to most sane/modern environments: https://download.libsodium.org/doc/ JWT also h

More ›