Viewing profile — jkrejcha

I don't really agree here. Setting aside the question of how often a compiler can vectorize a loop, because I do think it's not totally relevant here, as you still don't really hav…

C is very much a "high level/portable assembly" type language still and there's really no sign that it'll change from that. Even if it has ostensibly has abstract semantics, many o…

"That's the best password ever!"

Good security policies should have an upper bound on password length, but also those upper bounds should maybe be like 100 characters or so. There's a couple reasons for this. Firs…

Ostensibly you could subtract "Shmem"[1] in /proc/meminfo from the cached value... maybe? Do agree it's not the best UX and utilities should probably do a better job at showing tha…

This is only really a problem if you accept overcommit as a force of nature that can't be changed or tweaked (you can still do address space reservation without needing overcommit)…

> The “cached” memory includes tmpfs and ramfs for seemingly no reason. If you're curious why that is by the way, it's because that's actually how these are implemented (tmpfs/ramf…

> ...Ghidra Ah, MS07-052[1] ("code execution leads to code execution") strikes again. These sorts of "if you allow arbitrary code to be executed, code will be executed" "vulnerabil…

> a version of SQLite that has a severe vulnerability Calling CVE-2025-70873 a severe vulnerability is a bit overplaying it imo. The vulnerability requires that you allow an attack…

It simply doesn't mitigate CSRF by itself

In the Discord case they can just call the `getToken()` function. It's not on `window`, but it's trivial to find. The mitigation is rough on systems where SIGKILL happens early and…

Gonna play devil's advocate here I think to some extent CORS and SOP are a bit equivocated somewhat intentionally... i.e. CORS is a used as a shorthand for SOP because CORS is a mo…

With an variable length array of structs, you can set all the fields all to 0 at the cost of an extra member at the end. In the cases where this is, the structures are such that (e…

Reminds me of an article[1] that described how he cut GTA Online loading times by 70% because strlen was getting called for effectively every character in a string [1]: https://nee…

> True. However it's not impossible to mitigate that: https://news.ycombinator.com/item?id=48563286 It's not a perfect mitigation for session stealing, isn't available in all cases…

The problem here is that null kinda is consequential of intentional design of the type system itself. In this way, I do think that null was discovered, rather than invented. Rememb…

If you exclude all of the flaws of one implementation and include all of the flaws of another, then of course you can say one is better than the other. But that's not a fair compar…

The only difference between the cookie scenario and localstorage scenario here is that you're reading "storage/default/ /ls/data.sqlite" It's even conveniently grouped by domain Th…

> First time I'm hearing that frameworks require disabling HttpOnly. They effectively do in the case where you're using local storage because they need to grab the session token fr…

For those curious, here are the relevant specified fields along with the relevant standards (both IETF, OIDC, etc) JWT: https://www.iana.org/assignments/jwt/jwt.xhtml JOSE: https:/…

> - HttpOnly fights XSS which is impossible to execute with modern frontend frameworks. Eh. Frontend frameworks tend to make successful XSS much worse because they tend to require …

If the attacker can already execute code as you unrestricted, then you've kinda already lost. Local storage isn't any better in this regard

JOSE can still have problems if it's secure when implemented properly. A lot of API surfaces for them can kinda suck. If secure when held right was equivalent to good, then that wo…