Viewing profile — syntheticcorp

I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns …

It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.

Specifically, Marriott was deauthing rather than just plain jamming.

You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA s…

Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS qu…

It’s a vlc issue with h265 - I actually noticed this with videos from defcon last year. Pull the YouTube version or reencode to h264 to fix.

Yes it can do that now, at least on Windows 10

I’ve also encountered that a few times where a fairly anodyne bug in a codepath prevents a serious security bug from being reachable. With my attacker hat on it is very tempting to…

The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.

Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf

Browsers already include this feature in a coarse grained (but utterly sufficient) manner in the form of a scroll bar.

It’s a good disassembler that is fairly expensive. https://hex-rays.com/ida-pro/

Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very …

Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.

I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, …

ESNI has been dropped, a new spec alters how it works and renames it Encrypted client hello (ECH) https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

I’ve worked in tech in NZ for 7 years or so, never actually met someone who calls themselves an SRE. Obviously I know the term, but IME we don’t use that title here

I can’t believe you can get 30 year fixed in the US , that’s amazing. The longest terms I can see where I live are 5 year fixed.

I suppose you could have income from interest on capital or stock dividends

Are you aware which website you’re on? Having strong opinions on esoteric topics is a HN mainstay. Also as a non-American driving in the US made me think about a lot of things I wo…

There is none. This has been asserted for years on HN but I’ve never seen a modicum of evidence for it.

NK did personally target security researchers for compromise. See the TAG post referenced inTFA.

Postal 2 and manhunt are two fairly popular video games that were legally censored. Banned modern movies I am less familiar with, but there were many banned historically where the …

Average adult would include women, which are much weaker than men. It is sad if it applied to just men.

If it’s in the class path? Deserialisation gadgets.