I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever…
It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.
Specifically, Marriott was deauthing rather than just plain jamming.
You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA signature without demonstrating control…
Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS queries etc.
It’s a vlc issue with h265 - I actually noticed this with videos from defcon last year. Pull the YouTube version or reencode to h264 to fix.
Yes it can do that now, at least on Windows 10
I’ve also encountered that a few times where a fairly anodyne bug in a codepath prevents a serious security bug from being reachable. With my attacker hat on it is very tempting to just report the first one…
The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.
Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf
Browsers already include this feature in a coarse grained (but utterly sufficient) manner in the form of a scroll bar.
It’s a good disassembler that is fairly expensive. https://hex-rays.com/ida-pro/
Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very capricious.
Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.
I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, they report a lot of data back from the…
I’ve worked in tech in NZ for 7 years or so, never actually met someone who calls themselves an SRE. Obviously I know the term, but IME we don’t use that title here
I can’t believe you can get 30 year fixed in the US , that’s amazing. The longest terms I can see where I live are 5 year fixed.
I suppose you could have income from interest on capital or stock dividends
Are you aware which website you’re on? Having strong opinions on esoteric topics is a HN mainstay. Also as a non-American driving in the US made me think about a lot of things I wouldn’t otherwise consider. (Yes you…
NK did personally target security researchers for compromise. See the TAG post referenced inTFA.
Postal 2 and manhunt are two fairly popular video games that were legally censored. Banned modern movies I am less familiar with, but there were many banned historically where the decision still stands today.
Average adult would include women, which are much weaker than men. It is sad if it applied to just men.
If it’s in the class path? Deserialisation gadgets.
I believe Java’s ZGC has max pause times of a few milliseconds
They used several close range photos, not the one in the article.
I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever…
It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.
Specifically, Marriott was deauthing rather than just plain jamming.
You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA signature without demonstrating control…
Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS queries etc.
It’s a vlc issue with h265 - I actually noticed this with videos from defcon last year. Pull the YouTube version or reencode to h264 to fix.
Yes it can do that now, at least on Windows 10
I’ve also encountered that a few times where a fairly anodyne bug in a codepath prevents a serious security bug from being reachable. With my attacker hat on it is very tempting to just report the first one…
The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.
Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf
Browsers already include this feature in a coarse grained (but utterly sufficient) manner in the form of a scroll bar.
It’s a good disassembler that is fairly expensive. https://hex-rays.com/ida-pro/
Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very capricious.
Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.
I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, they report a lot of data back from the…
I’ve worked in tech in NZ for 7 years or so, never actually met someone who calls themselves an SRE. Obviously I know the term, but IME we don’t use that title here
I can’t believe you can get 30 year fixed in the US , that’s amazing. The longest terms I can see where I live are 5 year fixed.
I suppose you could have income from interest on capital or stock dividends
Are you aware which website you’re on? Having strong opinions on esoteric topics is a HN mainstay. Also as a non-American driving in the US made me think about a lot of things I wouldn’t otherwise consider. (Yes you…
NK did personally target security researchers for compromise. See the TAG post referenced inTFA.
Postal 2 and manhunt are two fairly popular video games that were legally censored. Banned modern movies I am less familiar with, but there were many banned historically where the decision still stands today.
Average adult would include women, which are much weaker than men. It is sad if it applied to just men.
If it’s in the class path? Deserialisation gadgets.
I believe Java’s ZGC has max pause times of a few milliseconds
They used several close range photos, not the one in the article.