Viewing profile — jagracey

Commented above, but to follow up from yesterday, here is the next post. "Hacking GitHub with Unicode" https://news.ycombinator.com/item?id=21693550

Just posted another Unicode article to HN. "Hacking GitHub with Unicode" https://news.ycombinator.com/item?id=21693550

211 of the top 500 domains ( https://moz.com/top500 ) contain the letter 'i' within them. It may be worth checking out if they are also susceptible to the Turkish dotless 'i' probl…

I agree. I'll be releasing an article about this tomorrow. There are in-fact many security ramifications that have not been solved in practice.

Static Version: https://wisdom.engineering/awesome-unicode/amp/

Thanks for catching. It's a fairly complex subject matter- and particularly hard get extra eye balls willing to check for typos. - String length is typically measured in code units…

For exploration, additionally I'd recommend http://shapecatcher.com/ It allows you to draw the shape you are looking for, and with some form of ML, sorts by similarity. It has come…

Just a quick and scrappy "Ghost" blog running on a $5 Digital Ocean droplet with the usual analytics.

The Emoji emoji modifiers are pretty cool. - Skin color modifiers - Character combiners: - man [ZWJ] woman [ZWJ] boy [ZWJ] girl === family of 4

Unicode reverse character: 'hello \u{202e} world'; 'hello dlrow' // Visual equivalent

Does anyone have experience having their JavaScript code professionally audited for performance impact and application side effects? (I'm not interested in security audits or gener…

I got one about bypassing GitHub's authentication using Unicode on the company blog: https://blog.getwisdom.io/hacking-github/ I've wanted to write a deep dive on JS defense for a …

I might be alone on this one, but I feel the Freedom-to-Tinker report was unfair to the analytics providers. I know the folks in the industry work really hard towards privacy and s…

Great work yz-yu. Hope you've learned a lot- I've personally found the session replay space to be incredibly rewarding. However, as a session replay industry competitor and a forme…

Don't forget to redefine numbers!

Approximately 3/4 of the top 30 status code checking tools are all vulnerable against basic XSS. Thought I'd share this rather fun method. Checkout "netcat security.gracey.ca 1500"…