21–30 of 107 posts
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
Earlier quoted context omitted.
> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
Honor codes for stuff that traditionally involve corporations going after individuals for criminal charges. I feel that's a bit of a crazy proposition.
Earlier quoted context omitted.
> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
Honor codes for stuff that traditionally involve corporations going after individuals for criminal charges. I feel that's a bit of a crazy proposition.
Surprised that worked. Guess they got lucky and either got the comiler+optization flags the same as the PHP binary used, or the release process can create higly similar builds.
OT: Is there a site that curates these kinds of interestingly detailed hacks? Like Dan Luu does for debugging stories? ( https://github.com/danluu/debugging-stories )
Earlier quoted context omitted.
I guess the site is served using PHP.
That's funny because in my experience php is one of the fastest languages.
Earlier quoted context omitted.
> binding exception Two words -- honor code. Rock the boat and you will find yourself in an unpleasant situation, so instead everybody does good work and nobody asks too many questions.
Honor codes for stuff that traditionally involve corporations going after individuals for criminal charges. I feel that's a bit of a crazy proposition.
For both white hats and Pornhub, the legal/authorized bounty system is in their interest. White hats are making less money than some black hats, but they're not constantly terrified of being prosecuted under intense anti-hacking laws. Pornhub is spending a lot less than they would if they were hacked by black hats. Both parties win.
Earlier quoted context omitted.
Must be a funny comparison group you have there.
I'm certainly positive it's faster than Ruby, Python and Java.
The takeway: You should never use user input on unserialize. Assuming that using an up-to-date PHP version is enough to protect unserialize in such scenarios is a bad idea. Avoid it or use less complex serialization methods like JSON.
Even JSON isn't great. It's still a hash-collision DoS attack vector. https://paragonie.com/blog/2016/04/securely-implementing-de-...