tshadwell

8 ms·

1.
by tshadwell 9y ago
this is an article about the UK.
2.
by tshadwell 9y ago
'we've taught this robot to move small uniform blocks and we're going to make it perform arbitrary complex tasks on a variety of objects' sounds a lot like 'i'm trying to draw the mona lisa and I got her eyebro
3.
by tshadwell 9y ago
from experience, I wouldn't recommend other than context-aware safe templating systems for html safety in this day and age. to an even greater extent than templating systems, sanitization systems of this type need to be built by an exp
4.
by tshadwell 9y ago
So in order to use a function that exposes the software to serious undue security risk unless used correctly, the engineer is pushed to do research? That really doesn't seem like a bad thing...
5.
by tshadwell 10y ago
in a similar vein, I often close browsers with ^W, expecting to delete a word. Thanks Vim.
6.
by tshadwell 10y ago
Really cool product presented beautifully. But perhaps from being a security engineer, I wish it would say anything at all about how they're going to ensure a 16 year old kid can't pwn me from the internet and crush things -- here
7.
by tshadwell 10y ago
See also: https://github.com/shockone/black-screen
8.
by tshadwell 10y ago
I tried to enjoy ingress, but didn't and I enjoy pokemon go. Obviously the Pokémon brand is a draw, but ingress felt like a platform for a game that people had to construct. I got contacted by people who told me I needed to join these
9.
by tshadwell 10y ago
That's an amazingly regressive point of view. Sure, in the past such things risked prosecution but why exactly does it mean we have to figuratively knock stones together on vulnerability ethics? When cars were invented, a man had to ru
10.
by tshadwell 10y ago
What are you proposing to replace cookies with? Auth tokens and XHR? Localstorage? Why?
11.
by tshadwell 10y ago
The primary problem this hopes to solve is actually CSRF. Simply generating an HTML form for a website for any website and submitting it sends the cookies of the target website, regardless of where the form is based. XHR isn't so much
12.
by tshadwell 10y ago
I might look into this. People are always surprised by how long it takes for me to notice them in a crowd
13.
by tshadwell 10y ago
I have a really excellent visual imagination. I can imagine myself walking or driving great distances, and I can imagine all the scenery, the trees, the colour of the sky. I can put things in the scene, take them out, rotate them. I don&#x2
14.
by tshadwell 10y ago
See also: https://github.com/StackExchange/blackbox "blackbox by StackExchange"
15.
by tshadwell 10y ago
> I'm sure threat modelling is something everybody does implicitly. You may work somewhere that this is the case, but I can't count the number of times I have tested an application where someone has equated security to having a
16.
by tshadwell 10y ago
This aricle falls foul of what I might call 'security shopping'-- passing mentions of lots of brightly coloured complex sounding security things with very little regard to what exact problem they're solving. They mention a VP
17.
Breaking Steam Cryptography(steamdb.info)
2 points by tshadwell 10y ago|0 comments
18.
by tshadwell 10y ago
I think it's super important to understand that removing the preflight request practically kills the security measures of CORS. With no preflight request, the browser has no idea whether it can make a request until it already has, at w
19.
by tshadwell 10y ago
Some notes: 1) Never blacklist. Seriously, unless you are in the business of writing and securing browser parsers, you are never going to catch everything. There are many vectors not listed on OWASP's XSS Filter Evasion Cheat Sheet. Se
20.
by tshadwell 10y ago
What area of 'cybersecurity' would I be finding myself breaking substitution ciphers based on wingdings in? I work in the information security industry, and I feel like I'm missing something but I really have to ask what thes
21.
by tshadwell 11y ago
All understood, and you're right, but the tone of this article and that of its kin is at least equally bad at idea discussion -- it's not weighing out positives and negatives or trying to get an idea of why things are how they are
22.
by tshadwell 11y ago
> How to make it reusable? `<-chan interface{}`? Welcome to the land of types casting and runtime panics. If you want to implement high level fan-in (merge) you’re losing type safety. The same (unfortunately) goes for all other patter
23.
by tshadwell 11y ago
So I typed my name and clicked one of my repos and I have a small green butterfly model to view at low resolution, and I can read the description I can read on github. If I click on it or attempt to interact with it in any way, it's de
24.
by tshadwell 11y ago
Since JSONP allows you to have a callback, you can load this in script tags on the same domain and make calls to that / those functions.
25.
by tshadwell 11y ago
I don't think `X-XSS-Protection` is a worthwhile header to have. Every browser with XSS protection has it on by default. OWASP says this only exists to turn it on when a user may have turned it off (I have no idea why they would). `Con
26.
by tshadwell 11y ago
Correction (thanks ams6110): The "weird thing" being: 'The posture of larger cats should be different to smaller cats, but it isn't'. “It's famously said that a lion is just a scaled-up house cat,” says Anjali
27.
by tshadwell 11y ago
The "weird thing" being: 'A Cat's posture should change as it gets older, but it doesn't'
28.
by tshadwell 11y ago
Being a .info site, it's surprising this site has zero information on /why/ USB dongle authentication is important to have. The tweets it helps you make just say "it's important" and link to this website.
29.
by tshadwell 11y ago
I disagree. While I agree that web UI programming can undeniably be described as complex: a) JS, HTML and CSS have been designed to build more than "documents" for over 10 years. b) Contrary to the idea that these technologies lea
30.
by tshadwell 11y ago
suggested title: 'statistical model of IQ test beats humans at the same IQ test'

More ›