nbpoole

6 ms·

1.
by nbpoole 11y ago
As far as I'm aware this is the first time I've been mentioned in a conspiracy theory. So thanks for that. :-)
2.
by nbpoole 13y ago
Interesting: this sounds like a recurrence of the same issue which was described a number of months back: https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... At the time, the blog post claimed that the issu
3.
by nbpoole 13y ago
I think tptacek's point is that the answer to your question is spelled out very clearly on the page. ;-) From the page: > You should own Ferguson and Schneier’s follow-up, Cryptography Engineering (C.E.). Written partly in penance,
4.
by nbpoole 13y ago
If that were true it would be a major security vulnerability. ;-) The Google Translate content is served up from a subdomain of googleusercontent.com. This is a domain designated by Google for user-supplied content so that it can be rendere
5.
Investigating apparent IT breach, Stanford urges users to update passwords(news.stanford.edu)
2 points by nbpoole 13y ago|0 comments
6.
by nbpoole 13y ago
This was posted yesterday: https://news.ycombinator.com/item?id=6080048
7.
by nbpoole 13y ago
Right. But your post shows that you can reliably get the browser to crash. It doesn't demonstrate that the crash is exploitable, unless I'm missing something.
8.
by nbpoole 13y ago
Right. But I can very easily find reports of reliable ways to crash IE via CSS: https://www.google.com/search?q=crash+ie+css I don't have a problem with your blog post. It documents how to reproduce the issue reference
9.
by nbpoole 13y ago
Not sure why this is getting voted up so much. The author came across a report of IE freezing/crashing, replicated it, and Microsoft fixed it. In the same security update ( http://technet.microsoft.com/en-us/securit
10.
by nbpoole 13y ago
Luckily, this question has been asked and answered fairly recently! Specifically https://news.ycombinator.com/item?id=5955043 from last week, complete with a response from Matt Cutts ( https://news.ycombinator.com
11.
by nbpoole 13y ago
I believe that's how Rails works, except using an HMAC on the cookie instead of AES (since AES itself doesn't prevent tampering).
12.
by nbpoole 13y ago
You can't just read cookies for arbitrary domains in an iframe.
13.
by nbpoole 13y ago
Not in general, no. You can drop replay protection as a requirement and that gets you to actual statelessness. If you then have your website on a single domain and never put anything else onto other subdomains, theoretically now the only ri
14.
by nbpoole 13y ago
"Stateless" CSRF protection as described here is strictly inferior to other forms of protection. The reasons are somewhat laid out in this blog post's comments: 1. JavaScript in any subdomain allows a cookie to be set on unre
15.
by nbpoole 13y ago
"This wouldn't happen if Yahoo had a Vulnerability Reward Program" As much as I support these kinds of programs ( https://nealpoole.com/blog/responsible-disclosure-programs/ ), that's a false dichotomy. Some companies have responsible dis
16.
by nbpoole 13y ago
I encountered the same problem on a site I run where I provide custom subdomains. The RFCs technically prohibit underscores but they appeared to work fine in the major browsers, with the exception of cookies in older versions of IE (ie: ht
17.
by nbpoole 14y ago
Please don't presume to speak for me. I left Matasano because I was returning to school; I greatly enjoyed my time there and I keep in touch with everyone I worked with because they are a group of intelligent, kind, and all around awesome p
18.
by nbpoole 14y ago
Hmm, a majority of passfree's account's submissions (20/25) appear to be for websecurify.com. Combined with the dismissal of Burp as "java madness," seems like a socketpuppet on behalf of the company.
19.
by nbpoole 14y ago
Ex-Matasano chiming in! ;-) I've been demonstrating web app security topics for the Intro to Security course at Brown University this semester. I've used Burp almost exclusively. I've even had the students use the free version of Burp for l
20.
by nbpoole 14y ago
This is an (unfortunately) fairly common class of vulnerability. Many applications fall victim to this form of attack because they don't think to check signatures on binaries. There is a tool, EvilGrade ( https://code.google.com/p/isr-evilg
21.
by nbpoole 14y ago
This reminds me of a post a few months back about Voyager 2, where NASA traced the issue back to a single bit flip (and fixed it!) Engineers successfully reset a computer onboard Voyager 2 that caused an unexpected data pattern shift, and
22.
by nbpoole 14y ago
The hosting companies I've used (eg: Linode, Dreamhost for smaller projects) all provide DNS services. I trust them to manage a DNS infrastructure more than I trust myself.
23.
by nbpoole 14y ago
Some previous discussion on this issue (almost 2 years ago): http://news.ycombinator.com/item?id=2443710 I'll say the same thing I said then: As an anecdotal counterpoint, I'm an extremely happy Name.com customer. I transfered several do
24.
by nbpoole 14y ago
Example: http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
25.
by nbpoole 14y ago
I think the CVE description is inaccurate in this case. Check out the Rails security email list description, which never mentions sessions. https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...
26.
by nbpoole 14y ago
This is actually several months old: http://www.theverge.com/2012/9/21/3369878/facebook-saves-you... > The default privacy setting for searches is "Only Me," and cannot be changed unlike the privacy toggles of other Activity Log entri
27.
by nbpoole 14y ago
First idea that comes to mind: http://stackoverflow.com/questions/3837043/best-practice-for...
28.
by nbpoole 14y ago
Anecdotally I've seen similar bad behaviors in a lot of bug bounty programs: - I haven't submitted to PayPal, but I do have a minor eBay XSS which I reported in May (eBay doesn't have a bounty program, but they do have a responsible disclos
29.
by nbpoole 14y ago
I have no Django experience, but I can imagine how an attack like this works: 1. Links are rendered via some function that takes into account the user's current request (ie: to determine the proper host) 2. The "reset your password by click
30.
by nbpoole 14y ago
> We don't post anything without your explicit permission on the page following authentication. Respectfully going to disagree on that one. The "Unhack" button doesn't seem to have removed any content from my profile but it did post a

More ›