31–40 of 107 posts
OT: Is there a site that curates these kinds of interestingly detailed hacks? Like Dan Luu does for debugging stories? ( https://github.com/danluu/debugging-stories )
The r/netsec subreddit: https://www.reddit.com/r/netsec/top/?sort=top&t=all
Earlier quoted context omitted.
Even JSON isn't great. It's still a hash-collision DoS attack vector. https://paragonie.com/blog/2016/04/securely-implementing-de-...
Dude, that's horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it's relatively simple. Or are they already available but dev's often rely on these broken ones?
Earlier quoted context omitted.
The r/netsec subreddit: https://www.reddit.com/r/netsec/top/?sort=top&t=all
Interestingly, I've noticed just about every well upvoted story on /r/netsec will hit the HN front page 2-3 days later.
Earlier quoted context omitted.
I'm certainly positive it's faster than Ruby, Python and Java.
It depends on the code base and use case. For the vast majority of coders, the time/cost savings will be in the usability of the language itself rather than the hardware required to run the code.
Earlier quoted context omitted.
Dude, that's horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it's relatively simple. Or are they already available but dev's often rely on these broken ones?
Hash functions designed for hash tables are generally not hard to find collisions for, so there's not much that can be done. You could shoehorn in a secure hash function, but that would hurt performance.
The Perl interpreter has been doing that for ages.
Earlier quoted context omitted.
Interestingly, I've noticed just about every well upvoted story on /r/netsec will hit the HN front page 2-3 days later.
Arbitrage opportunity there: submit them to HN yourself.
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
In the US the law is against unauthorized access. If a company agrees to let people try to hack their stuff, then the access is authorized and legal.
Are there any legal precedents for this?
Earlier quoted context omitted.
Dude, that's horrific. I figured some secure coders wouldve at least implemented a better JSON one by now since it's relatively simple. Or are they already available but dev's often rely on these broken ones?
Hash functions designed for hash tables are generally not hard to find collisions for, so there's not much that can be done. You could shoehorn in a secure hash function, but that would hurt performance.
So does Pornhub's bug bounty program include some number of years of free paid membership along with financial bounties? Kind of a "treat us right and we'll let you treat yourself right" kind of thing?
wow From a legal perspective how do companies and hackerone create a binding exemption from laws used to prosecute hackers?
If they prosecute a white hat there will only be black hats left. It's not a legal perspective but it keeps the honour code working.