Viewing profile — yoloClin

Broken access control is things like direct object vulnerabilities and authorisation bypasses _as well_ as broken authentication controls. I'm not saying you're wrong, and agree th…

Friendly reminder that this is about frequency, as opposed to severity. 'Cryptographic Failures' is everything from theoretical vulnerabilities which require millions of dollars to…

This. I want a shell that will contextually spit out plaintext in interactive mode, then a JSON object when scripted or piped. Pretty sure this is what Powershell does, but the UI …

I really like Reveal.js. I feel the design constraints enforced (size / amount of text per slide) is awesome, but at the same time very limiting for technical presentations where l…

On the flipside, it's more plausible for an actor to get malicious code into a project in order to infect a target. Sure it has to be obscure enough to pass any code reviews during…

I agree with CSP, but as I've commented on another thread I recommend CSP _with_ other mitigation factors due to DOM/HTML injection, and browser support.

I think the best solution is CSP _and_ injection mitigations - even without XSS there is still DOM injection which can be equally damaging reputationally. iirc, IE11 (under Windows…

Ping me on twitter. @yoloClin

Thanks, that's exactly what I want!

Is anyone able to provide a map of modern frameworks? With React-native, React-redux, Angular, Vue and probably a bunch of others. I'm really not sure what's relevant now and what …

HTML Code Golf - How to make really small _extremely fragile_ HTML that doesn't break Firefox or Chrome, currently at least FTFY

I just disable it: ``` #!/bin/sh # Disable capslock setxkbmap -option caps:none # Better repeat rates # Previously set in lxdm.conf (arg=/usr/bin/X -ardelay 175 -arinterval 20 xset…

Hey thanks for this, nushell looks really interesting! I really like the idea of an objective shell but don't like the verbosity of PowerShell inputs. I think if you go through my …

What I'm talking about is a UI/UX problem that cannot be solved by key layout, I even experimented with a Ergodox and ended up in keybind hell really quickly because supporting one…

I fee like UI/UX needs to be completely redesigned and dvorak isn't even half (or any) of the battle. Single-key copy/paste, undo/redo, keyboard driven UIs, etc etc. I say this as …

Mike Zamansky has a pretty decent series which focuses mostly on third party package features - https://www.youtube.com/watch?v=49kBWM3RQQ8&list=PL9KxKa8NpF...

I had multiple friends pull me aside about similar email and asked to deal with it confidentially, I've probably had other friends pay up in attempt to avoid humiliation. I think i…

I'm from a country with public health care, so this comes as an interesting shock - would employees immediately lose health benefits if made redundant / fired etc? Seems to incenti…

I'm more curious about how DB rollbacks occur in situations where a PR changes DB and is then reverted.

Irrespective of who's right or wrong it's pretty unnecessary to call each other names just because you don't agree, particularly when the question is theoretical and has almost no …

Transport encryption with PKI.

The issue is an injection attack. The ability to insert either unsanitised HTML data or data reflected inside the context of a JavaScript code block which results in JavaScript exe…

IMO, using DNS for anything other than hostname lookups is a complete hack. I'm looking at you, SPF.

Secrets stored in cookies really shouldn't be accessible, the Set-Cookie HttpOnly flag should stop all JS access to a cookie. The HttpOnly flag still submits a cookie when you do a…