Viewing profile — kdbg

Its one of the features that is behind a minimum karma requirement. https://github.com/minimaxir/hacker-news-undocumented/blob/m...

Only tangentially related but I'm a Canadian but have been on a US Cell provider (AT&T) for over a decade now because its cheaper, especially when I used to spend a lot more time r…

I'm not a lawyer so maybe I'm misunderstanding something but the plaintiff is Whatsapp, not the journalists. This isn't really about holding NSO Group accountable for hacking journ…

Author of the site here (though not this specific post). Any chance you could take a screenshot of what your seeing? The other commenter mentioned the contract of comment s in code…

curious what type prompting you do on the LLM? I run a markov chain bot in a Twitch chat, has some great moments. I tried using a LLM for awhile, would include recent chat in the p…

Reminds me a little of a stored XSS I read about last year. https://tttang-com.translate.goog/archive/1880/?_x_tr_sl=aut... Had that same root of not having the mime.types in the c…

You can, but maybe not in the "standard" way. Standard way being trying to measure the precise differences between requests. The smaller the difference the more requests are needed…

Thanks for this, was trying to wrap my head around it a bit and you broke it down nicely.

Binja decompiler is more-or-less fine. Its not as mature as IDA or Ghidra but its not a bad decompiler. Though for me the big selling point on Binja is the Intermediate Languages (…

Pretty sure that price is only for your first year if you sign up with a code/link from one of their creators. The advertised rates are currently $5/month or $50/year.

First, just a high-level overview over how it would work as an app/consumer which is not terribly centralized outside of requiring browser support: Passkeys are an open standard, a…

Its not just historically (atleast if you include IoT/Industrial/Medical devices) Microsoft's "Section 52" (IoT security research group) called out this issue in several allocators…

It is, it'll build a few fuzzers hitting different areas[0]. The important function in many of those `.c` files is `FuzzerTestOneInput` which is effectively the entrypoint for a si…

So "pentesting" often kinda defaults to "network pentesting" which is closer to an IT job than a software engineering job and its salary range (in general, as you specialize pay go…

This is a bit of a common trap, the idea that to do anything you must know everything. When you read writeups you see people just going from some bug to exploit and incorporating o…

Funnily, both ExpressVPN and NordVPN which you call out have been externally audited. NordVPN had the clients audited by VerSprite last year, and their No-log policy audited by PwC…

https://www.science.org/doi/10.1126/science.abi9069 Unfortunately many parts of this paper are beyond me, but this study does appear to find that community level masking has an imp…

On a whole what I found more interesting here was just the techniques they came across through fuzzing that had some impact. Yes its interesting to see the specific combinations th…

So, disclosure policy is kinda an active discussion within the security community but there is a general move away from coordinated disclosure (aka responsible disclosure) where th…

Kinda on a related note I found myself needing to make a bunch of these sorts of scraped feeds. The problem for me was the lack of date parsing support which I sorely needed (and i…

So kinda a quick summary given the available information that I've seen. Back in August 2020 some research was performed looking at introducing vulnerabilities into the Linux Kerne…