xianb

7 ms·

1.
by xianb 4y ago
I'd assume it's similar to what grubhub said here that the platform pays https://twitter.com/grubhub/status/611320394256109568?lang=e...
2.
by xianb 6y ago
It's fascinating how Auth0 actually had a blog post about finding and fixing a handful of JWT vulnerabilities years ago (one of them is more advanced to exploit than this). Just another example of why you always have to be vigilant and
3.
by xianb 8y ago
probably need to be fined billions to get them to take it seriously
4.
by xianb 8y ago
Houzz and Nest security emails also got filtered
5.
by xianb 8y ago
I think it's not just the journalists though...pretty sure some of the concerns with FB were published years ago but fell on mostly deaf ears. But now you have a public that cares more due to some "big revelations" and also a
6.
by xianb 8y ago
> Why would LE send the SNI in the first place? I thought the purpose was to prove you own the domain, not cohabit an environment where the domain is hosted? The assumption was that you controlled the domain if you could return the self-
7.
by xianb 8y ago
For ETH the big one is the DAO where they had to fork it to recover There's also other smaller bugs like coinbase and parity wallet
8.
by xianb 8y ago
Perhaps this might be a poor setup on my company's part, but it's awful navigating between teams and finding escalation policies and schedules in PD
9.
by xianb 8y ago
> The green lines are flight paths from before the implementation of the new technology (January 2013). The red lines are flight paths from after the implementation of the new technology (January 2015).
10.
by xianb 8y ago
sounds like a nice generic company value/principle
11.
by xianb 8y ago
is it really different from the data collection of other grocery store shopper cards though?
12.
by xianb 8y ago
if you store plaintext password on the client, you'd be one XSS attack away from potentially having a lot of passwords stolen - best practice is to have password in plaintext for a little as possible (there's some research on not
13.
by xianb 8y ago
anything that makes computation less intensive for you also makes it less intensive for a potential malefactor - it's just an inherent tradeoff. Rather than scan for password being contained in the message, something more reasonable to
14.
by xianb 8y ago
accurate description of LinkedIn by Blake Lively and Anna Kendrick https://youtu.be/xmo8-Bh98fw?t=270
15.
by xianb 8y ago
but you can also choose to withhold stock for taxes basically would have just been a losing gamble to have withheld money instead instead of it being something forced upon them
16.
by xianb 8y ago
https://twitter.com/kenjennings/status/339170784406810624
17.
by xianb 8y ago
yeah, if you're absolutely inept and have insufficient logging/monitoring, you can't even tell how bad you'd been screwed. kinda like a Dunning Kruger effect of sorts
18.
by xianb 8y ago
sounded like the video stuff was added after view as was added so it probably didn't go through the same level of scrutiny
19.
by xianb 8y ago
sounds similar to this https://en.wikipedia.org/wiki/False_positive_paradox
20.
by xianb 8y ago
https://www.youtube.com/watch?v=E5gPdrlyc84 people have, but who knows how long it'll last
21.
by xianb 9y ago
It's running fine for me on a Pi Zero W. There's honestly like no slowdown at all
22.
by xianb 11y ago
>profit on them. Nope. http://gawker.com/here-are-the-internal-documents-that-prove... Granted that businesses like Amazon are unprofitable, but Uber is not nearly going to be as stable