steakejjs

6 ms·

1.
by steakejjs 11y ago
Lcamtuf notably found several ELF Parsing bugs in file, that appeared may have been exploitable. The work he has been doing with AFL and googles big fuzz farm, focusing on utilities that are used daily without thought is insanely important,
2.
by steakejjs 11y ago
The first way I did it was just read the file, parse the json, check for nulls, and print. Then I piped this to a file. That is too boring though. The next way I did it was with Vim replaces. There might be sexier ways of doing this? 1) A b
3.
by steakejjs 11y ago
It might be extremely valuable for Google to prompt you, while riding in your driverless Tesla, to make a stop at a Krispie Kreme on your way home.
4.
by steakejjs 11y ago
What if you are an experienced engineer talking to another experienced engineer ? Seems to me if someone writes bad code when they SHOULD be writing good code, code-shaming might be in order. I'm all for being nice and understanding. E
5.
by steakejjs 11y ago
Nginx and net/http has worked wonderfully for me. Nothing fancy is necessary.
6.
by steakejjs 11y ago
After reviewing the code it looks like I was wrong. The code from the tutorial won't provide any encryption for your sessions, only integrity. In order to encrypt the values in the session, rather than just encode you have to do a NewC
7.
by steakejjs 11y ago
I actually wrote a tool[0] to attack gorilla sessions that are mentioned at the bottom of this, and gave a talk on some security functions in Go. The big take-aways from my talk. Go doesn't have a lot of unsafe functions. HTMLTemplates
8.
by steakejjs 11y ago
They are technical. Brushing up on: K&R - The C Programming Language K&P - The Unix Programming Environment K&P - The Practice of Programming Kerrisk - The Linux Programming Interface (Not light reading) Even though
9.
by steakejjs 11y ago
Google has a big fuzz-farm and Project Zero looking for this type of thing and even they did not find Heartbleed years ago. They are nabbing tons of bugs but there are many that are simply buried. This seems to me a bit like when you do a m
10.
by steakejjs 11y ago
The new stuff happening in the PHP space is really really awesome. HHVM + HACK + XHP is an entirely different experience compared to writing PHP. Code can actually be very clean and lots of bugs can be found that may have previously gone un
11.
by steakejjs 11y ago
Sounds like we were always on the same page... I never said an attacker can't do this. I'm saying an attacker can't do a s/https/http and have a user end up at an HTTP login page, where the attacker can sniff creden
12.
by steakejjs 11y ago
Relay what credentials from the HTTP connection ? There are none... It sounds like you are talking about creating a phishing page and injecting it, hoping the user enters their credentials, and stealing them. I already said this was possibl
13.
by steakejjs 11y ago
Not all traffic. Amazon has a separate SecureOnly cookie for access to their trusted pages that isn't sent over HTTP. Without that cookie not all traffic can be proxied.
14.
by steakejjs 11y ago
Right, but you get a redirect to the https login page with an http login URL. An attacker can attempt phishing with HTML/JS injection on a HTTP page but an attacker cannot get a user to be looking at Amazon's real login page over
15.
by steakejjs 11y ago
No. SSL stripping is an attack where you prevent a user from upgrading to an HTTPS connection. That isn't possible here. Many sites have multiple tiers of authentication. For example viewing items to purchase is over HTTP but to actual
16.
by steakejjs 11y ago
What's wrong with being more than one thing. They are shaking up A LOT about how we currently think about the ``energy'' models. I think batteries are going to do wonder for countries that don't have a ``grid''
17.
by steakejjs 11y ago
I think it would be hilarious to see fictional "failed" historic YC apps, especially those that made it big in their time.
18.
by steakejjs 11y ago
I don't understand your issue with hardcoded salts. It essentially works the same way as an HMAC. It is some secret material that further complicates the attackers job...It doesn't mean they react to a successful attack in a diffe
19.
by steakejjs 11y ago
I actually think Terry could provide a lot of value if he was able to provide training in system engineering. The experience he has is invaluable. I'm not sure what his plan is, though....
20.
by steakejjs 12y ago
In case you're thinking this is THE BUG that should have been released today, I don't think it is. While serious, I saw this on github several days ago. I've also seen two others this week. This also isn't internet shatt
21.
by steakejjs 12y ago
Would a possible example of a large magnitude event be the 2012 Virginia Derecho[1] ? Does anyone remember this evening as a day of large outages? I wasn't able to experience the event as an internet user having lost power. This is the
22.
by steakejjs 12y ago
Yeah, it is only base64ing the woffs. The reason I post it is that it has all the benefits of this project (only CSS) without the downsides (being ridiculously hard to use).
23.
by steakejjs 12y ago
You can already do regular fonts in pure css. See. Here's open sans in pure CSS. https://github.com/steakejjs/OpenSans-CSS I've actually found its much nicer using this in my projects than using a font cdn or
24.
by steakejjs 12y ago
What do you mean? ``If you can do something malicious''. Browser extensions have a lot of abilities. People install browser extensions with no idea what they actually do, when content scripts in chrome extensions can scrape all yo
25.
by steakejjs 12y ago
I actually began working on the exact same thing within the last month or so in my spare time. Having competed in the CCDC for 6 years in college, I found it pretty insane when I saw that employers don't use real hardware during interv
26.
by steakejjs 12y ago
In case people are interested in the under-the-hood. I just dug in a little bit and it looks like a library is used that automatically generates IV for each encrypt, and automatically uses your passphrase, passed through EvpKDF as the key.
27.
by steakejjs 12y ago
Be carful not to forget reading off a semi-colon. Syntax counts!
28.
by steakejjs 12y ago
Great post. I hate interviewing. I think a lot about it since I'm the type of person who performs horribly in an interview call when some person I've never met is asking me trivia questions on speaker phone... One thing I wonder.
29.
by steakejjs 12y ago
No it is even true for security things BUT the authors need to have no problem taking a dose of humble pie and labeling the project as completely insecure. I don't see anything wrong with writing security software that is insecure as l
30.
by steakejjs 12y ago
Wolf is 100% correct. These details make it sound like this product is insecure. We definitely don't want ecb mode or a weak kdf like 1 round of sha256 with no salt. BUT before anyone lambasts this guy, it's good the author posted

More ›