Viewing profile — moloch

Say they introduce a bug, that deletes every file on your machine.

No, they don't have access to the Wireguard keys and everything is point-to-point. They'd have to push a backdoored software update to gain access (and this is a threat with any ve…

Yeap, I think the Xbox 360 was the first (or one of the first) to implement this protection back in 2005 - https://www.youtube.com/watch?v=uxjpmc8ZIxM

No, unless combined with WebUSB trickery, and such an attack has been possible in the past. However, browsers currently implement blocklists of HIDs and other USB types from workin…

Python has had named arguments for a long time (since v1.4), which is arguably more widespread than PHP or Swift.

None of your cited examples are "secure," they're the very definition of "security by obscurity," which is to say insecure. https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

If anyone is interested in Electron application security, I wrote a guide that explains the methodology behind some of the choices the author here has taken and even goes a bit fur…

I've used nsshell to great effect on multiple projects, highly recommend it (but an encrypted option would be great rook). I've also written a more heavy handed asymmetrically encr…

Always hack with a safety shell!

The conference did _not_ accept the talk, they paid the conference so that they could give the talk.

Using 2Mb with MSVC instead of 1Kb with MASM. Such a wasteful world.

I think their main mistake was requiring a user to change their password to upgrade the hash instead of upgrading the hash on the next user login.

Steam VR/Vive has "AAA" non-exclusive titles.

Is that enabled by default in 4? I use and identical AOT build process with 2.4 and 4 (ng-cli) and there's no problems building with 2.4

Lol, if only the real world were that simple. I have an Angular 2.4 project that when updated to 4.0.0 produces about 300+ build time errors (guess you can't access `private` membe…

This is bad but not horrible, especially in the example given leaking the reset token to Cloudfront. The application is loading JavaScript from the Cloudfront origin, so that origi…

SVG should only be executing in a null origin if it is not blocked by the CSP.

Well TypeScript is sort of "optionally typed" (variables can have a type of `any`) it's also superset of JavaScript so any valid js is valid ts.

Ubuntu also has LTS releases for this exact reason.

I really want the GPU performance, my mid-2014 MBP can only output to a 4k monitor @30hz