schwag09

7 ms·

1.
by schwag09 1mo ago
I wrote one of the referenced posts describing the history here: https://blog.trailofbits.com/2025/08/20/marshal-madness-a-br... I was also part of the team that audited RubyGems.org: https://githu
2.
by schwag09 9mo ago
This is correct, it's even open source: https://github.com/deepfield/dnsflow .
3.
Fuzzing Golang msgpack for fun and panic(redcanary.com)
1 points by schwag09 4y ago|0 comments
4.
by schwag09 5y ago
This article briefly mentions a very useful analysis tool for NGINX configuration: Gixy. It looks for the following misconfigurations[0]: - [ssrf] Server Side Request Forgery - [http_splitting] HTTP Splitting - [origins] Problems wi
5.
by schwag09 5y ago
Good catch. I went straight to "Documentation", which links to https://mariana-tren.ch/docs/getting-started , while the "Getting Started" button somewhat confusingly links to https://maria
6.
by schwag09 5y ago
Interesting tool. This looks like the Java equivalent of Facebook's Python taint analysis tool Pysa: https://pyre-check.org/docs/pysa-basics/ . From what I can tell by the documentation, it looks like Mariana&
7.
by schwag09 5y ago
Let me rephrase, I think it's often a fundamental flaw from a practical, security perspective. Reflection and constructs like 'eval' are often at odds with security. You could more generally say that utility is often at odds
8.
by schwag09 5y ago
> In computing, the relationship between structure and behavior, between program and process, is perplexing in itself. That this relationship so often can be subverted, allowing an untrusted data provider to preternaturally gain control
9.
by schwag09 5y ago
This reminds me of the parable of the Mexican fisherman and the Harvard MBA: 'An American investment banker was at the pier of a small coastal Mexican village when a small boat with just one fisherman docked. Inside the small boat were
10.
KPop Fans: Non-Traditional, Non-State Actors(sec.okta.com)
1 points by schwag09 6y ago|0 comments
11.
by schwag09 6y ago
I suspect this means a scanner that can derive all necessary information without any configuration. For example, consider a scanner looking for API endpoint authorization inconsistencies. Does the scanner need you to describe your authoriza
12.
by schwag09 6y ago
That's an interesting approach. It incentivizes users to have a backup plan while also providing an escape hatch if things go wrong. The only issue is, like you alluded to, this could price out a large portion of the world's devel
13.
by schwag09 6y ago
It's great to see more introductory ReDoS material! I took a deep-dive on ReDoS myself recently and found the material available to be somewhat lacking, especially for beginners. Over the course of my investigation I found some interes
14.
by schwag09 6y ago
At one point in time I created a Python package to highlight this benefit of wheels: "Avoids arbitrary code execution for installation. (Avoids setup.py)" - https://github.com/mschwager/0wned Of course Python
15.
by schwag09 6y ago
I had the same thought. Although it looks like Signal uses a proxy for GIPHY requests [1] and has at least thought about the privacy implications of GIPHY support [2]. [1] https://github.com/signalapp/Signal-Android&#x2
16.
The Tyranny of Management(thecommoner.org.uk)
2 points by schwag09 6y ago|0 comments
17.
by schwag09 6y ago
Sadly, this is the case at many major CS research universities. I'm working on my Master's in Cybersecurity at one of these universities and most of the papers we read are something the professor co-authored in '08 or '0
18.
by schwag09 7y ago
Full series: * Tree-walking algorithms: Incrementally enumerating leaf nodes of an N-ary tree - https://devblogs.microsoft.com/oldnewthing/20200106-00/?p=10... * Tree-walking algorithms: Incrementally performing a
19.
by schwag09 7y ago
Here's the broader security strategy post from Github, "Securing software, together": https://github.com/features/security It looks like Github is making a definite play into the security space. The abov
20.
by schwag09 7y ago
if there are others I'd love to hear about them! I've been collaborating with Duo Security to build a new Python static analysis tool that focuses on security deficiencies: https://github.com/duo-labs/dlint
21.
by schwag09 7y ago
Hi HN, creator of Dlint here, happy to answer any questions you may have. I'd also appreciate any feedback or comments. Here's a direct link to the repository: https://github.com/duo-labs/dlint
22.
by schwag09 9y ago
Mozilla is also currently matching all Tor donations: https://donate.torproject.org/pdr Consider donating!
23.
by schwag09 9y ago
burntsushi's performance analysis of string parsing in Rust vs. Go: https://news.ycombinator.com/item?id=13268051 I learned quite a few things about both Rust and Go!
24.
by schwag09 9y ago
Shameless self-plug: You can use Fierce! A DNS reconnaissance tool - https://github.com/mschwager/fierce
25.
by schwag09 9y ago
Interesting! I like the idea!
26.
by schwag09 9y ago
It's definitely possible! I'd just have to teach RIPLink to ingest data from different sources. I.e. have it parse a text file (or other type of file) instead of HTML. Would you mind opening an issue on Github?
27.
by schwag09 9y ago
Project: R.I.P.Link - a tool for finding dead links on the web[0]. The inspiration for this project came from Wikipedia and the Internet Archive partnering to fix broken links on Wikipedia[1]. After briefly searching around I couldn't
28.
Show HN: R.I.P.Link – Find dead links on the web(github.com)
4 points by schwag09 9y ago|0 comments
29.
by schwag09 10y ago
If you support this you should consider donating to Wikimedia or the ALCU: https://wikimediafoundation.org/wiki/Ways_to_Give https://action.aclu.org/secure/donate-to-aclu
30.
Show HN: Cohesion – A tool for measuring Python class cohesion(github.com)
3 points by schwag09 10y ago|0 comments

More ›