a1a

I didn't mean to trivialize the issue. You describe a problem that arise when multiple parties share data with "presumptions of trustworthiness" i.e. do not perform proper input validation. No?

Wow, this is a Hyper-V breakout! I am amazed that it's 2024 and we still have problems with basic input validation.

I looked briefly at the encoder and it looks like the ad names are truncated on the size 32. Not sure why the threat actor would do that do. I guess they need some size limitation and just picked an arbitrary number

Yes, if I interpret your suggestion correctly. How would you know that the attacker have not manipulated the size parameter?

That's the best case. Worst case you end up with a memory vulernability (see heartbleed https://xkcd.com/1354/)

Think there is a need for a clarification. It says _member states_ of EU have trackers on their websites. Not EU itself.

1) Is that really a bad thing? Isn't it generally a good thing that law enforcement finds law-breakers?

2) So do drunk drivers that crash.

3) You're arguing against yourself. Yes, it's bad that bad guys get notified so they can avoid checkpoints.

4) Shouldn't law enforcement spend their time enforcing the law? It's well spent time IMO. As you say in (1), they also solve other more serious crimes (e.g. finding wanted criminals)

Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team.

I agree that the impact is low compared to other vulnerabilities. It is definitely the case that you get a t-shirt (at best) for it. Though, my point is that they could be critical for the users, not for the website itself. An attacker that don't really care about the vulnerable website can still exploit the trust in the vulnerable website to perform attacks on the user he is interested in (e.g. hash stealing or malicious redirects). In fact, I believe malicious redirects is a really common payload of XSS flaws.

Firstly, it is not possible to opt out of facebook. [1] And they do indeed collect private data that we didn't choose to share (shadow accounts, third party website trackers, etc).

Facebook have broken "actual laws". There are so many cases were facebook have broken the law. [2] [3]

Also, please read up on Fallacy of relative privation ("not as bad as").

[1] https://boingboing.net/2017/11/08/involuntary-profiling.html

[2] https://www.theguardian.com/technology/2018/feb/12/facebook-...

[3] https://techcrunch.com/2018/02/19/facebooks-tracking-of-non-...

So that's why there is no gravity over there?

Seriously though, the statement is ignorant at best. Please help me understand the point of posting it?

and Bloomberg https://www.bloomberg.com/news/articles/2017-11-20/uber-step...

I'd recommend deleting all content associated with the account and removing the address from any third party site (recovery etc).

I would however never actually delete the account.

My concern with deleting the account is that it exposes you to some really nasty impersonation attacks. It is free to keep. Just keep it.

Just had to test what the other keys did.

What i found:

t = search file

j/k = move down/down (selected file)

w = select branch

s = focus search field

y = expands url

Anyone know any more?

EDIT: Found this https://help.github.com/articles/using-keyboard-shortcuts/

That's one of the main takeaways from the story tho. In an open office those who need silence cannot get it, even if there are private rooms available: "Some of us even feel that escaping to a quiet room is a sign of weakness" and "it can feel as if we’re not pulling our weight if we’re not present"

Most definitely. In my experience ideas are rarely valuable by themselves. Rather an idea is valuable when implemented by someone who have what it takes to see it through.

Simply put, not a lot of people have what it takes just because they filed a patent.

How? I bet most commercial VPN services rotates on billions of different IPv6 addresses (from completely different subnets that is).

Better keep your real laptop at a safe distance unless you want VM escape --> Bluetooth propagation --> pwned.

Any reliable source? This is quite the accusation

I don't think they are comparable. I run both. NoScript is a security suite – besides blocking java, webgl, flash, silverlight, javascript, etc – it has additional defenses against XSS, ABE, clickjacking etc.

uBlock was to my knowledge never developed to securely stop scripts and deter drive-by attacks etc. It should be used for adblocking, not for security.

"Any headline that ends in a question mark can be answered by the word no."

https://en.wikipedia.org/wiki/Betteridge%27s_Law_of_Headline...

To be fair, if it was a con

1/2) Hijack identity of someone reputable

3) Create scam device

4) Film a video that looks like a DEFCON speech. Some simple video editing should fix the face. Voice likely doesn't matter. Start speech by saying "oh this talk is not listed, we changed topic last second"

5) Hack blog and post bogus article

6) Profit

TLDR still not likely

Technically speaking they could target VPN users by infecting uploaded files with a simple trojan that pings home to a server, I assume you disable VPN after the download is complete.

I really dig the login system!

I thought it should be vulnerable to 1. find hash on victim's profile, 2. login using the hash + username

But it seems the hash is never actually submitted to the server, neither through the login form nor later on by cookie. That is good news! The implied hurdle is that you'll need to update the hash on each login.