Viewing profile — tprynn

ActiveSupport adds tons of great convenience methods to Ruby and you can require it even outside of Rails! blank, present; date and time conversions like 1.month.from_now; except; …

I am. Pinning is a footgun with negligible real world security impact: https://tprynn.github.io/2022/12/06/cert-pinning-bad.html

You tell a fun anecdotal narrative but in other cases those workers show up unannounced and threaten to separate families if they don't allow entrance even though of course that's …

This is true, by default Android apps do not trust user-installed certificate authorities. IMO the easiest solution if you're doing security testing on a dedicated device is Magisk…

I am not sure how this is getting so many upvotes, but the claims in the readme do not appear to be supported by evidence. Those claims are so extreme that they are simply not beli…

Visual Studio Code has built-in support for remote development. It runs a local agent on the remote server via SSH which does essentially whatever you would be doing locally (e.g. …

It's showing a little age, but this list from Tech Solidarity gives you an intro to (1): https://techsolidarity.org/resources/basic_security.htm

I agree with the principle, but the way these arguments have been summarized here has led to near-complete strawmanning. It's like the author started from the blog title and then c…

Yes, it's basically a side effect of activating Emergency SOS. The five-press shortcut works on all iPhones as far as I'm aware. As the doc says: "If you use the Emergency SOS shor…

Signal could add app-level encryption, but who would this serve? Signal can't do anything better than what the OS/hardware provides in terms of encryption. Even if they let you spe…

The instructions posted by the dev directly include instructions for pulling the APK from your phone which was installed through the Play Store. https://github.com/signalapp/Signal…

uBlock Origin in advanced mode is gorhill's suggested replacement. If you have never used uMatrix before most likely uBlock Origin is what you should be using, and can easily accom…

BinData ( https://github.com/dmendel/bindata ) is a Ruby gem for this, basically using a DSL in Ruby to declaratively define binary data formats that can be both read and written.

EMR is just an automated way of deploying open source components (Hadoop and co.) - there's some glue code there but the equivalent "open" version is probably the Hortonworks stuff…

With DNS rebinding, you can still only send HTTP requests* to the target. With this attack, you have a direct, raw TCP/UDP socket. (*) I'm simplifying, what I mean is that DNS rebi…

We don't have to consider anything near unlimited resources here - you can do a masscan of the internet on commodity hardware in an hour, or you have a shodan sub (they've sold lif…

The cost of any additional untargeted attack attempt is essentially zero in most cases. It doesn't matter whether you are trying your exploit on 100 hosts or 1 million. An attacker…

By itself, disclosing version information provides little to no security consequence. If you are using an outdated, vulnerable server version, you will be exploitable regardless of…

I think it's generally a poor assumption to assume that any two internet "crowds" are the same people. Some commenters care about X and some about Y and we can almost never tell wh…

It's a real system dialog popped by the OS when the install script requests superuser privileges. It's not fake, and the password goes to the OS, not the script.

Curious what the higher-level solution to CSRF/SSRF is? I’m struggling to think how it could be prevented except at the browser level (for CSRF). And for SSRF if there’s a legitima…

I enjoyed the post and like the idea of Tailscale[^1], but agreed. As long as there's some path to the Internet, you can't trust your LAN. I mean, that's kind of the whole point of…

Presumably power is disconnected by the T2 chip. Different from mechanical disconnect via a physical switch, but equivalently effective if you trust the T2 chip. (And if you don’t …