Viewing profile — frogsRnice

Sure - but people are still free to decide where they draw the line. Each extra bit of software is an additional attack surface after all

You all do amazing work, hope I can boast the same someday - or even 50% of it ;) Seriously, you are my heroes!

Imo its not just crypto- a lot of their reports are enlightening to read

It absolutely does

It could be pulling these resources over http ;) Edit: Whoops sorry, morning fog

Unrelated; I just wanted to say that I learned programming from your socket tutorials when I was a kid. Everything was so well written that I used it from highschool, to varsity to…

At some point someone needs to take responsibility for allowing modification of environment variables via something dumb like http. Debugging interfaces are fine- we should expect …

No you misunderstand- it is super simple to pay some other company a small amount to do this for you. No complexity to worry about what so ever. And if things require even a slim a…

Yeah I agree- I think the time spent verifying should vary based on the complexity and sensitivity of what you are looking at, but you never really get away from it. I think my iss…

As opposed to wondering if the llm is hallucinating? You have to expend a mental effort to think about your solutions anyway; I guess it’s pick your poison really.

My main gripe is that if someone finds a vulnerability that gives you a list of urls the model falls apart. I’ve seen this happen in organisations :/ But agree with your statement …

I guess were talking about optimising tail recursion. Would there be any reason to refer to a tail call other than that optimisation? I’ll do some reading on the latter part of you…

Would you not have to use a jump instead of call for it to be a tail call at all- ie otherwise a new frame is created on each call

frida is an amazing tool - it has empowered me to do things that would have otherwise took weeks or even months. This video is a little old, but the creator is also cracked https:/…

I work in the security space and fell victim to an internal campaign as they sent a very enticing looking email at a point where I was on leave and my grandfather just passed. You …

Fair enough on the device compromise point, that said the implementation is still terrible and illustrates what I would be worried about- Maybe more succinctly put, how a credentia…

Ive also seen some pretty terrible implementations that don’t even allow end users to manage enrolled devices; so if someone steals your authenticator they have access to your acco…

Making a website about it benefits other people; finding the vulnerability helps other people; even if its 10%, why can’t someone else do it? Surely someone doing all this would al…

Don’t necessarily agree that selling hacks is ethical, but if I already spent time figuring out how to exploit a system - reporting it to the relevant place is charity. Ill do that…

A vpn (that you trust) would certainly help a little, but in the above case the connection can still be mitmed from the vpn server to the application backend Edit: I would for my p…

Haha thats terrifying! I was just trying to point out that assuming that apps do this correctly is a bad idea; but my experience echoes yours, its a common mistake - even just brow…

There have been cases of applications not performing chain validation - see the paper Spinner: semi automatic detection of pinning without hostname verification (in particular page…

Interesting how tastes can vary, I’ve not used visual studio as much but always dread it when I’m forced to. CLion’s debugger has been fine for my uses, although the best debugging…

Pinning is very complex, there is always the chance that you forget to update the pins and perform a denial of service against your own users. At the point where the device itself …