Viewing profile — RagingCactus

While I dislike the feature getting removed, this argument does not hold up to scrutiny. They will remove using external SMTP servers to send emails from external, third-party addr…

You can do that, but my understanding is you can't get the browser to attach cookies to your request in this way, while you can with forms. Do you agree?

This is fundamentally a CSRF issue and framing CSRF as an access control issue often yields to wrong conclusions. With CSRF you might face the situation that the request has a vali…

You can massage a text/plain form into valid JSON. text/plain is also one of the allowed default types. It works if the server doesn't check the content-type. Source: I've done tha…

> Some libraries being buggy never was an argument against using libraries. And do you expect your single-purpose code not to be? Of course you should use battle-tested and well-ma…

> Also, WTF is wrong with people who accepted algorithm "none." They dared to use the default validation function of their JWT library. They did not choose to accept "none". And th…

> First, we need to add a token_secret column to our users table: > ALTER TABLE users ADD COLUMN token_secret; So it's "stateless" but we have to query the users database on every …

> Necessary qualifier: for browser-based user sessions. > Plenty of good uses for JWTs for service-to-service communication. This is the sensible conclusion right there. I agree JW…

As a security person it is tiring to see so many people here either directly claim or at least allude to the claim that this is somehow much less scary because the _published_ expl…

Seeing the confusion in the comments I want to provide some examples of situations where this might come up in a security or CTF context: * You have a restricted shell or other way…

Lots of people here are (perhaps rightfully) pointing to the unwrap() call being an issue. That might be true, but to me the fact that a reasonably "clean" panic at a defined line …

Yes, you're definitely right that there are edge cases and I was simplifying a bit. Notably, it's called SameSite, NOT SameOrigin. Depending on your application that might matter a…

I work as a pentester. CSRF is not a problem of the user proving their identity, but instead a problem of the browser as a confused deputy. CSRF makes it so the browser proves the …

The SameSite cookie flag is effective against CSRF when you put it on your session cookie, it's one of its main use cases. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Ref…

I don't believe this is true, as https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... exists. It does need an extension to be installed, but I think that's fair in your …

Direct link to the comment with the new information (apparently it is not possible to keep the URL fragment): https://github.com/microsoft/vsmarketplace/issues/1168#issue... The gi…

The article doesn't mention possible security implications. However, we already get lots of vulnerabilities exactly _because_ implementations disagree on delimiters. Examples for t…

`git push -u origin HEAD` pushes the current branch to `origin` with the same name you have locally. You could even add an alias for that.

And another party trick: Base64-encoded JSON objects always start with "ey".

Are there any resources you can recommend to understand D-wave's quantum computing a bit better? I took a very basic course about gate-model quantum computing at my university. The…

For the Fibonacci example the author claims: > Notice how state was introduced? It made the code easier to read. Correct me if I'm wrong, but the only state in that snippet lives i…

Thanks! Just defining it as a config variable is far too obvious in hindsight, I don't know why it didn't cross my mind. I'll definitely try it out!

Is there a way to manage different "categories" of systems with chezmoi? For example, a "linux-server" category would contain an essential set of dotfiles, but not all the window m…