71–80 of 80 posts
OT but is there a way to see projects with the most stars on github? This one seems to be skyrocketing. Oh here we go, and lookie who is at the top: https://github.com/trending
https://github.com/stars?direction=desc&sort=stars
Edit: Found this two minutes later: https://github.com/googlei18n/libphonenumber, seems to be an official Google product and Apache licensed.
/dev/urandom can also be used as a source of random and unusual input data, as it contains by definition all 256 byte values and 65536 2-byte values, 16M 3-byte values, etc., and should eventually output every possible string.
"Eventually" being the key word here. Fuzzing with purely random inputs will take eons to actually reveal non-trivial bugs...
" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153 ) /dev/null; rm -rf /*; echo " That's a little aggressive for testing no?
Likewise: 1;DROP TABLE users 1'; DROP TABLE users-- Seems a bit hairy to have that in there in case someone tries to run these tests on their prod environment
Earlier quoted context omitted.
Likewise: 1;DROP TABLE users 1'; DROP TABLE users-- Seems a bit hairy to have that in there in case someone tries to run these tests on their prod environment
Why would you test in a prod environment?
So someone may test against prod if they didn't really know what these things could do.
Earlier quoted context omitted.
Aw, Sophos on OS X doesn't think it's a threat.
Without giving too much away, I was sufficiently surprised by that that I downloaded the Sophos for Mac Home Edition. It does recognise it. Here's what I get: http://i.imgur.com/JQzVsQf.png This was picked up by the on-access scanner and a manual scan. The Web Protection doesn't complain about the text in a page (rightly or wrongly). Are you using a centrally managed version (i.e. not Home Edition)?
" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153 ) /dev/null; rm -rf /*; echo " That's a little aggressive for testing no?
Earlier quoted context omitted.
Without giving too much away, I was sufficiently surprised by that that I downloaded the Sophos for Mac Home Edition. It does recognise it. Here's what I get: http://i.imgur.com/JQzVsQf.png This was picked up by the on-access scanner and a manual scan. The Web Protection doesn't complain about the text in a page (rightly or wrongly). Are you using a centrally managed version (i.e. not Home Edition)?
Interestingly, I found what caused the false-negative. If I used Vim to create the file, it was picked up. If I "echo ...EICAR > text.txt" it doesn't get picked up, at least not immediately!
A scheduled scan would pick this up eventually.