With more advance notice, someone could have found resources to fork curl with different vulnerability management expectations, e.g., "will not accept or otherwise handle any vulnerability reports during the month…
For many events, the demographics lean toward age groups where people have jobs with work schedules that aren't known more than a few weeks in advance. The initially planned friend group (e.g., four people) can have…
feature request: AI-based risk analysis, with a model of which types of commercial vehicles at that location are likely to be controlled by organized crime
To disambiguate, the person on the plane could learn to use hand signals (e.g., Cued Speech) and the AI model can be trained on that.
"use, display, and perform Your Content through the GitHub Service" might allow a wide range of uses on GitHub Pages websites, even if https://example.github.io is monetized (monetization is permitted by…
It is discuused here: https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-De... - the HPN-SSH maintainer says "I do have an issue with [the OpenSSH 9.6] release in that it breaks interaction with HPN-SSH. The…
for "Thats exactly what we will be doing initially! Our tablets taste much better than Bite!" I might go with the brand "habitablets" and the tagline "where self-care meets planet-care" the idea is that "habitablets"…
Suppose you have office space in the jail, and give him (or anyone else) the opportunity to apply for remote jobs at anyplace willing to hire him - with the caveat that he loses office access unless he demonstrates that…
a recent audit claims the author "doesn't have enough resources to address" security issues: https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/594 etc.
What data is stored about an employee's justification for viewing a customer account? Is there an enumerated set of justifications such as "direct customer inquiry" versus "to be used for upselling other banking…
Years ago, many decisions to hide error details were a cargo cult reaction to CVE-2012-4929. To review, CVE-2012-4929 works like this: 1. the attacker can see (but not decrypt) the victim's TLS traffic to example.com 2.…
Possibly because the firmware could be modified, and not print the required yellow dots or other tracking data: https://www.eff.org/pages/list-printers-which-do-or-do-not-d... "Some of the documents that we previously…
If I were evaluating this, my top four concerns would be: 1. "NoSQL document database with MongoDB-like queries ... powered by the open source database engine RocksDB" doesn't give me enough confidence that my…
At least one other person reported Hive Social vulnerabilities recently: https://twitter.com/zhuowei/status/1597739467645030400
https://blog.miki.it/2014/7/8/abusing-jsonp-with-rosetta-fla... (this was somewhat more exciting when Flash still existed)
I feel that the goal should be providing tickets to the fans who most want to be there. For example, Round 1 would be for fans who feel confident that a Taylor Swift Eras show would be the best event they would ever…
It looks like MIT didn't maintain their 1789164 U.S. trademark registration number for Athena: "computer programs, and instruction manuals sold therewith, which collectively provide a set of integrated network services;…
The withserve.com homepage refers to the fakercloud.com domain, which seems to host code for Potentially Unwanted Browser Reconfiguration or other unexpected content. It would be better to only use example domains under…
The web developer might be very competent, but choose to use the word "manually" to support a higher cost proposal for the project.
The post says "the vulnerability has only existed for a week." Many Linux systems don't yet have a 3.0.4 package available, but apparently Homebrew is already installing the affected version:…
In many environments, "For that reason, I decided to use semicolons" will cause all of your code to be automatically rejected, because https://standardjs.com/rules.html "No semicolons" is enforced at the SCM layer.
We don't allow our admins to use Parted to change partition tables on production servers. We feel that this is rational because the documentation explicitly says that it might be buggy:…
With CVEs for ham radio, clearly the next step is to add ATT&CK tactics and techniques. If you compromise a PC that's connected to a ham radio, you might be able to transmit maliciously, or interfere with the radio…
Redaction can be needed for a document, but redaction can also be needed for a video (car's license plate, credit card number, etc.). As far as I know, there's no video editing software that recommends black bars and,…
The specific URL on mitmh2022.com might not work as intended in all web browsers. To reach the puzzle in question, you may have to click on this link once, press the Public Access button on the resulting page, and then…
With more advance notice, someone could have found resources to fork curl with different vulnerability management expectations, e.g., "will not accept or otherwise handle any vulnerability reports during the month…
For many events, the demographics lean toward age groups where people have jobs with work schedules that aren't known more than a few weeks in advance. The initially planned friend group (e.g., four people) can have…
feature request: AI-based risk analysis, with a model of which types of commercial vehicles at that location are likely to be controlled by organized crime
To disambiguate, the person on the plane could learn to use hand signals (e.g., Cued Speech) and the AI model can be trained on that.
"use, display, and perform Your Content through the GitHub Service" might allow a wide range of uses on GitHub Pages websites, even if https://example.github.io is monetized (monetization is permitted by…
It is discuused here: https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-De... - the HPN-SSH maintainer says "I do have an issue with [the OpenSSH 9.6] release in that it breaks interaction with HPN-SSH. The…
for "Thats exactly what we will be doing initially! Our tablets taste much better than Bite!" I might go with the brand "habitablets" and the tagline "where self-care meets planet-care" the idea is that "habitablets"…
Suppose you have office space in the jail, and give him (or anyone else) the opportunity to apply for remote jobs at anyplace willing to hire him - with the caveat that he loses office access unless he demonstrates that…
a recent audit claims the author "doesn't have enough resources to address" security issues: https://www.openwall.com/lists/oss-security/2023/09/08/2 https://github.com/schollz/croc/issues/594 etc.
What data is stored about an employee's justification for viewing a customer account? Is there an enumerated set of justifications such as "direct customer inquiry" versus "to be used for upselling other banking…
Years ago, many decisions to hide error details were a cargo cult reaction to CVE-2012-4929. To review, CVE-2012-4929 works like this: 1. the attacker can see (but not decrypt) the victim's TLS traffic to example.com 2.…
Possibly because the firmware could be modified, and not print the required yellow dots or other tracking data: https://www.eff.org/pages/list-printers-which-do-or-do-not-d... "Some of the documents that we previously…
If I were evaluating this, my top four concerns would be: 1. "NoSQL document database with MongoDB-like queries ... powered by the open source database engine RocksDB" doesn't give me enough confidence that my…
At least one other person reported Hive Social vulnerabilities recently: https://twitter.com/zhuowei/status/1597739467645030400
https://blog.miki.it/2014/7/8/abusing-jsonp-with-rosetta-fla... (this was somewhat more exciting when Flash still existed)
I feel that the goal should be providing tickets to the fans who most want to be there. For example, Round 1 would be for fans who feel confident that a Taylor Swift Eras show would be the best event they would ever…
It looks like MIT didn't maintain their 1789164 U.S. trademark registration number for Athena: "computer programs, and instruction manuals sold therewith, which collectively provide a set of integrated network services;…
The withserve.com homepage refers to the fakercloud.com domain, which seems to host code for Potentially Unwanted Browser Reconfiguration or other unexpected content. It would be better to only use example domains under…
The web developer might be very competent, but choose to use the word "manually" to support a higher cost proposal for the project.
The post says "the vulnerability has only existed for a week." Many Linux systems don't yet have a 3.0.4 package available, but apparently Homebrew is already installing the affected version:…
In many environments, "For that reason, I decided to use semicolons" will cause all of your code to be automatically rejected, because https://standardjs.com/rules.html "No semicolons" is enforced at the SCM layer.
We don't allow our admins to use Parted to change partition tables on production servers. We feel that this is rational because the documentation explicitly says that it might be buggy:…
With CVEs for ham radio, clearly the next step is to add ATT&CK tactics and techniques. If you compromise a PC that's connected to a ham radio, you might be able to transmit maliciously, or interfere with the radio…
Redaction can be needed for a document, but redaction can also be needed for a video (car's license plate, credit card number, etc.). As far as I know, there's no video editing software that recommends black bars and,…
The specific URL on mitmh2022.com might not work as intended in all web browsers. To reach the puzzle in question, you may have to click on this link once, press the Public Access button on the resulting page, and then…