hackermondev
Joined 5 years ago
Karma
1,107
Submissions
36
Member since
Jun 7
breaking stuff
https://hackerone.com/daniel
x
View on Hacker NewsRecent submissions
Comment · 8 months ago
the fact they're not even trying to hide this is beyond crazy
> openai-watchlistdb.withpersona.com
> openai-watchlistdb-testing.withpersona.com
Comment · 10 months ago
Discord puts the authentication token in local storage
Comment · 10 months ago
the impact varied by customer. in Discord's case, the auth token is stored in local storage and their docs is hosted on the primary domain; they were susceptible to a full account takeover. X's docs are on a different subdomain but we found a CSRF attack that could facilitate a full account takeover. most companies were significantly affected in one way or another.
Comment · 10 months ago
imo, the impact is pretty clear here. an unsuspecting user clicks (or is redirected) to one of these malicious links on the platform (ex. vercel); the script grabs their cookie and credentials and sends it to the attacker. they now have full access to the victim's account.
Comment · 1 year ago
Thanks for the feedback, I've updated the README!
Comment · 1 year ago
That's what the `window` option does (https://github.com/hackermondev/batched?tab=readme-ov-file#b...). After the first item is added to the buffer, it waits for the maximum window time, then calls the inner function with the buffer fill.
Comment · 1 year ago
Need to be specified at build time, but you can set a dynamic window length based on the current buffer length. https://github.com/hackermondev/batched?tab=readme-ov-file#b...
Comment · 1 year ago
seriously doubt Google Cloud is relying on Cloudflare KV lol
Comment · 1 year ago
that's a hackerone bug, that 8-year-old report is not mine :)