syntheticcorp

7 ms·

1.
by syntheticcorp 2y ago
I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever 9.8 equivalent.
2.
by syntheticcorp 2y ago
It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.
3.
by syntheticcorp 3y ago
Specifically, Marriott was deauthing rather than just plain jamming.
4.
by syntheticcorp 3y ago
You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA signature without demonstrating control of the domain to a CA
5.
by syntheticcorp 3y ago
Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS queries etc.
6.
by syntheticcorp 3y ago
It’s a vlc issue with h265 - I actually noticed this with videos from defcon last year. Pull the YouTube version or reencode to h264 to fix.
7.
by syntheticcorp 3y ago
Yes it can do that now, at least on Windows 10
8.
by syntheticcorp 3y ago
I’ve also encountered that a few times where a fairly anodyne bug in a codepath prevents a serious security bug from being reachable. With my attacker hat on it is very tempting to just report the first one…
9.
by syntheticcorp 4y ago
The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.
10.
by syntheticcorp 4y ago
Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf
11.
by syntheticcorp 4y ago
Browsers already include this feature in a coarse grained (but utterly sufficient) manner in the form of a scroll bar.
12.
by syntheticcorp 4y ago
It’s a good disassembler that is fairly expensive. https://hex-rays.com/ida-pro/
13.
by syntheticcorp 4y ago
Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very capricious.
14.
by syntheticcorp 4y ago
Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.
15.
by syntheticcorp 4y ago
I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, they report a lot of data back from the endpoint so historic
16.
by syntheticcorp 4y ago
ESNI has been dropped, a new spec alters how it works and renames it Encrypted client hello (ECH) https://blog.mozilla.org/security/2021/01/07/encrypted-clien...
17.
by syntheticcorp 4y ago
I’ve worked in tech in NZ for 7 years or so, never actually met someone who calls themselves an SRE. Obviously I know the term, but IME we don’t use that title here
18.
by syntheticcorp 4y ago
I can’t believe you can get 30 year fixed in the US , that’s amazing. The longest terms I can see where I live are 5 year fixed.
19.
by syntheticcorp 4y ago
I suppose you could have income from interest on capital or stock dividends
20.
by syntheticcorp 4y ago
Are you aware which website you’re on? Having strong opinions on esoteric topics is a HN mainstay. Also as a non-American driving in the US made me think about a lot of things I wouldn’t otherwise consider. (Yes you have too many stop signs
21.
by syntheticcorp 5y ago
There is none. This has been asserted for years on HN but I’ve never seen a modicum of evidence for it.
22.
by syntheticcorp 5y ago
NK did personally target security researchers for compromise. See the TAG post referenced inTFA.
23.
by syntheticcorp 5y ago
Postal 2 and manhunt are two fairly popular video games that were legally censored. Banned modern movies I am less familiar with, but there were many banned historically where the decision still stands today.
24.
by syntheticcorp 5y ago
Average adult would include women, which are much weaker than men. It is sad if it applied to just men.
25.
by syntheticcorp 5y ago
If it’s in the class path? Deserialisation gadgets.
26.
by syntheticcorp 5y ago
I believe Java’s ZGC has max pause times of a few milliseconds
27.
by syntheticcorp 5y ago
They used several close range photos, not the one in the article.
28.
by syntheticcorp 5y ago
Australia already has a plan for this in the works to supply Singapore with solar from the outback. It’s called Sun Cable - see: https://suncable.sg/
29.
by syntheticcorp 5y ago
Terrible job hiding the drug dealers identity in this article. They included her first name and location, googling that combination returns her full mugshot in a wanted poster put out by the local police.
30.
by syntheticcorp 5y ago
Looks like they have doubled or tripled? Schools are still safe in absolute terms, shootings are a very small number.

More ›