Viewing profile — schwag09

This is correct, it's even open source: https://github.com/deepfield/dnsflow .

This article briefly mentions a very useful analysis tool for NGINX configuration: Gixy. It looks for the following misconfigurations[0]: - [ssrf] Server Side Request Forgery - [ht…

Good catch. I went straight to "Documentation", which links to https://mariana-tren.ch/docs/getting-started , while the "Getting Started" button somewhat confusingly links to https…

Interesting tool. This looks like the Java equivalent of Facebook's Python taint analysis tool Pysa: https://pyre-check.org/docs/pysa-basics/ . From what I can tell by the document…

Let me rephrase, I think it's often a fundamental flaw from a practical, security perspective. Reflection and constructs like 'eval' are often at odds with security. You could more…

> In computing, the relationship between structure and behavior, between program and process, is perplexing in itself. That this relationship so often can be subverted, allowing an…

This reminds me of the parable of the Mexican fisherman and the Harvard MBA: 'An American investment banker was at the pier of a small coastal Mexican village when a small boat wit…

I suspect this means a scanner that can derive all necessary information without any configuration. For example, consider a scanner looking for API endpoint authorization inconsist…

That's an interesting approach. It incentivizes users to have a backup plan while also providing an escape hatch if things go wrong. The only issue is, like you alluded to, this co…

It's great to see more introductory ReDoS material! I took a deep-dive on ReDoS myself recently and found the material available to be somewhat lacking, especially for beginners. O…

At one point in time I created a Python package to highlight this benefit of wheels: "Avoids arbitrary code execution for installation. (Avoids setup.py)" - https://github.com/msch…

I had the same thought. Although it looks like Signal uses a proxy for GIPHY requests [1] and has at least thought about the privacy implications of GIPHY support [2]. [1] https://…

Sadly, this is the case at many major CS research universities. I'm working on my Master's in Cybersecurity at one of these universities and most of the papers we read are somethin…

Full series: * Tree-walking algorithms: Incrementally enumerating leaf nodes of an N-ary tree - https://devblogs.microsoft.com/oldnewthing/20200106-00/?p=10... * Tree-walking algor…

Here's the broader security strategy post from Github, "Securing software, together": https://github.com/features/security It looks like Github is making a definite play into the s…

if there are others I'd love to hear about them! I've been collaborating with Duo Security to build a new Python static analysis tool that focuses on security deficiencies: https:/…

Hi HN, creator of Dlint here, happy to answer any questions you may have. I'd also appreciate any feedback or comments. Here's a direct link to the repository: https://github.com/d…

Mozilla is also currently matching all Tor donations: https://donate.torproject.org/pdr Consider donating!

burntsushi's performance analysis of string parsing in Rust vs. Go: https://news.ycombinator.com/item?id=13268051 I learned quite a few things about both Rust and Go!

Shameless self-plug: You can use Fierce! A DNS reconnaissance tool - https://github.com/mschwager/fierce

Interesting! I like the idea!

It's definitely possible! I'd just have to teach RIPLink to ingest data from different sources. I.e. have it parse a text file (or other type of file) instead of HTML. Would you mi…