jupenur

6 ms·

1.
by jupenur 3mo ago
This whole blog post makes me sad. I've been active on both sides of the vulnerability disclosure process for well over a decade and have reported a whole bunch [1] of security bugs to the Go security team. I was there back when Filipp
2.
A deep dive into deeply recursive Go(mattermost.com)
2 points by jupenur 1y ago|0 comments
3.
CVE-2024-47081: Netrc credential leak in PSF requests library(seclists.org)
62 points by jupenur 1y ago|23 comments
4.
by jupenur 2y ago
The weAudit VSCode extension [1] works pretty well. It's designed for security work, but there's no reason why you couldn't use it for general note-keeping. [1] https://blog.trailofbits.com/2024/03/1
5.
A year of security fixes in Go(mattermost.com)
1 points by jupenur 2y ago|0 comments
6.
A DoS bug that's worse than it seems(mattermost.com)
4 points by jupenur 2y ago|0 comments
7.
Show HN: Swerve – A framework for establishing integrity guarantees in web apps(github.com)
6 points by jupenur 2y ago|0 comments
8.
Go fixes its 7th code execution bug in the same feature(mattermost.com)
11 points by jupenur 2y ago|0 comments
9.
by jupenur 3y ago
The big problem with transparency logs is that they can't prevent attacks in real time because of the merge delay. You'll only find out afterwards if you've been attacked. It significantly raises the bar for an attack, but ca
10.
by jupenur 3y ago
Thanks! Automatic updates are still possible; you can implement a code signing-based flow on top of this, or fetch hashes from GitHub releases, or anything, really. Attacks are only possible during setup, and targeting at that point in time
11.
by jupenur 3y ago
I've looked at web bundles and a variety of other solutions myself, but the service worker approach feels like a winner so far. There's no magic, nor any bug being abused, but the client does have to trust the server to behave nic
12.
by jupenur 3y ago
This is great. I feel like E2EE has slowly fallen out of focus in recent years as the tech has stabilized, but important developments like this and the MLS standardization still continue to happen. One specific area where I'd love to s
13.
by jupenur 3y ago
I'm trying to solve the problem of "how can I trust an e2ee messaging app on the web". Basically, the issue is that while e2ee messaging apps (think WhatsApp, Signal) assume no trust in the server, the user still has to trust
14.
by jupenur 4y ago
There's an even more ubiquitous app that also usually has mic and camera permissions and suffers from a similar (but technically unrelated) local code injection issue: Chrome. The bug is described here [0] and was closed as WontFix bec
15.
by jupenur 4y ago
We weren't happy with what was already out there, so we built our own -- https://github.com/mattermost/gobom
16.
by jupenur 4y ago
Noteworthy in this security release: 7 out of the 9 issues fixed are stack exhaustion bugs, meaning something in the stdlib is recursing too deeply and with a large enough input the runtime hits its 2 GB stack limit. Unlike it says on the a
17.
Go 1.18.4 and Go 1.17.12 are released(groups.google.com)
2 points by jupenur 4y ago|1 comments
18.
Securing XML implementations across the web(mattermost.com)
3 points by jupenur 5y ago|0 comments
19.
CI/CD Pipeline Security 101(mattermost.com)
2 points by jupenur 5y ago|0 comments
20.
CVE-2021-28965: XML round-trip vulnerability in REXML(ruby-lang.org)
1 points by jupenur 5y ago|0 comments
21.
by jupenur 6y ago
Well that didn't stop them from trying
22.
by jupenur 6y ago
Blog author here; Russell's implementation is backed by github.com/beevik/etree, but like you said, it's just an interface. The tokenizer is still encoding/xml. Adding better support for namespaces and providing API
23.
Coordinated disclosure of XML roundtrip vulnerabilities in Go’s standard library(mattermost.com)
223 points by jupenur 6y ago|114 comments
24.
Security advisories and JSA-2020-0001(community.jitsi.org)
10 points by jupenur 6y ago|3 comments
25.
by jupenur 6y ago
Better link with context https://www.minervanett.no/angus-dalgleish-birger-sorensen-c...
26.
XSS vulnerability in unmaintained JavaScript library poses severe risk(portswigger.net)
1 points by jupenur 7y ago|0 comments
27.
Multiple Vulnerabilities in JQuery Mobile(gist.github.com)
1 points by jupenur 7y ago|0 comments
28.
by jupenur 9y ago
Just to be clear, I haven't really disclosed anything publicly, not regarding the e-payment API issue or any other issues for that matter. The SlideShare from my comment references the e-payment API vulnerability but doesn't discl
29.
by jupenur 9y ago
The thing about setting deadlines like that (blind drop or not) is that it's very easy to look at it as some form of extortion. "This guy has cyberweapons, and unless we do what he tells us, he's going to release them on DATE
30.
by jupenur 9y ago
Also a big issue here, as with many software vulnerabilities, is that the people the public disclosure would actually damage are the users, not the company making the vulnerable software. The bank would only start losing money if the users

More ›