vmarquet
Joined 11 years ago
Karma
180
Submissions
20
Member since
Jun 21
Recent submissions
Comment · 5 years ago
I think it's a reference to this blog post https://journal.stuffwithstuff.com/2015/02/01/what-color-is-...
Comment · 5 years ago
I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of.
It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.
Comment · 7 years ago
SEEKING WORK | Full Stack Engineer specialized in Ruby on Rails and InfoSec | Paris or remote
I have 5+ years of experience with Ruby on Rails. I also have a diploma and work experience in Information Security (but I am completely open about working in other fields). Strong entrepreneurial mindset and happy to participate to my client/employer company at every level, not just technical.
I have experience in refactoring apps for easier maintenance and evolution, and in upgrading legacy apps (I have migrated an app from Rails 2 to Rails 5 without issues). I take extra care for UX and design when implementing new features, and try to maximise developer happiness by using the most efficient tools available (exemple: static type-checking with TypeScript instead of JS, etc).
Stack:
* Backend: Ruby on Rails, Python
* Frontend: ReactJS with TypeScript or JavaScript
* Mobile: React-Native
* Also: good knowledge of SQL, Bash, C, Electron, ..., and willing to learn Elixir
Contact:
* Email: vincent.marquet1 [at] gmail.com
* Github: https://github.com/vmarquet
* Stack Overflow: https://stackoverflow.com/users/3486743/vmarquet
Comment · 8 years ago
Note that domain fronting is not only usefull to circumvent Internet censorship, it's also used by malware.
With domain fronting, you can exfiltrate data from a company by making the connection appear to go to a legitimate google service (ex: drive.google.com), whereas it actually is going to a server hosted on google cloud services and controlled by an attacker.
Comment · 8 years ago
lemonde.fr published an article [1] yesterday, in which they debunk this news. A seismologist at Southampton University says [2] that it's unrelated to the rifting.
[1] https://www.youtube.com/watch?v=4QJ8MmbAC_o (in French)
[2] https://twitter.com/seismo_steve/status/977258571716091904
Comment · 8 years ago
For a quick reference of the Dex file format, Ange Albertini (known for PoC||GTFO) made a poster: https://github.com/corkami/pics/blob/master/binary/DalvikEXe...
All his posters are pretty amazing: https://github.com/corkami/pics/blob/master/binary/README.md
Comment · 9 years ago
This. For more information, see this post https://training.kalzumeus.com/newsletters/archive/enterpris... by patio11.
Comment · 9 years ago
In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago."
A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/
Comment · 9 years ago
Oh you're right! I searched for something after the login screen but I missed this before. Thank you.
Comment · 9 years ago
Unfortunately, as many game creators, they seem to believe that everybody in the world has qwerty keyboards, which is not the case. Using the A, W, S and D letters does not make sense on azerty keyboards (up and down reversed). Why can't we use keyboard arrows to move?
Too bad, the game would have been really fun to play if controls were usable for me.
Comment · 9 years ago
Just curious, does it list itself in the list of app subscriptions? :)
Anyway, great product!
Comment · 9 years ago
A way to validate that you're genuinely interested in penetration testing and to learn is to do challenges on sites like https://www.root-me.org/ for example. It's not necessarily realistic challenges, meaning there can be challenges on vulnerabilities you're very unlikely to see in real life, but you'll always learn something If the challenge does not teach you on some kind of vulnerability, at least it will teach you about how to think and do research, which is the most valuable.
I've seen companies filter candidates based on their score on such platforms. For example, for a junior position in penetration testing, they asked for at least 3000 points on root-me (but it was a few years ago, the number of challenges on the site has increased so it would make sense if they had increased their minimum points requirement).
Compared to certifications, it has two enormous advantages: it's fun, and it's free. I've started that way and never regretted it. I've not needed a certification to land a penetration testing job in a serious company (this was in France though, I don't know much about practices in other countries).
Comment · 9 years ago
"Don’t make me hunt for a way to ask it."
And this post makes me hunt google to find what "kthxbye" means...
Comment · 9 years ago
I thought this was quite high, since the net neutrality issue had a lot of coverage in the media, see for example the two John Oliver talks about it:
https://www.youtube.com/watch?v=fpbOEoRrHyU https://www.youtube.com/watch?v=92vuuZt7wak