orkj
Joined 13 years ago
Karma
176
Submissions
75
Member since
May 1
Recent submissions
Comment · 11 months ago
From the reporter of the React vulnerablility, Lachlan Davidson
Comment · 11 months ago
very interesting to read.
However, if I am reading this correctly, your PoC falls in the category described here: https://react2shell.com/
> Anything that requires the developer to have explicitly exposed dangerous functionality to the client is not a valid PoC. Common examples we've seen in supposed "PoCs" are vm#runInThisContext, child_process#exec, and fs#writeFile.
> This would only be exploitable if you had consciously chosen to let clients invoke these, which would be dangerous no matter what. The genuine vulnerability does not have this constraint. In Next.js, the list of server functions is managed for you, and does not contain these.
Context: This is from Lachlan Davidson, the reporter of the vulnerability
Comment · 1 year ago
> what is an auth description?
They are probably referring to the text in the basic auth "pop-up" which is usually set like
WWW-Authenticate: Basic realm="my text"
Comment · 1 year ago
Did you see this one? https://www.casio.com/europe/watches/casio/vintage/product.A...
Comment · 1 year ago
This sounds like a great idea for a feature for the OP. Cool feature to kickstart the database. Take a photo. Something something AI. 150 rows filled in
Comment · 1 year ago
Seems like general good advice, but for me it was simply a matter of `atuin import auto`. The initial response was similar (as in, here is no history, where is my history, this is useless). Then I read this page where it said to import, which seemed relevant:
Not sure if that was the missing case for you, but just in case someone reads this and gets the same feeling as me
Comment · 1 year ago
The description of the repo is "A compendium of absurd "open-source" licenses." Which I think is relevant to change the title to (the addition of the word "absurd" specifically.
The word "bad" is also used several times, and can be argued is also useful to put in the title
Comment · 1 year ago
Tangentially related: I have been having a ton of fun programming for the sensor watch lately: https://www.sensorwatch.net/
Granted it's far from as smart as pebble, but that battery life... ♥
Comment · 1 year ago
Built https://violinist.io, a PHP / composer update service in 2017 and it passed that figure probably something like 2021?
Comment · 2 years ago
Does something like this exist for my phone, android specifically? Any good recommendations?
Comment · 2 years ago
It's mentioned in one of the first references in this article:
https://boehs.org/node/everything-i-know-about-the-xz-backdo...
IRC activity