albroland

I'm sorry but again, I dont see how an 4 byte OOB write will realistically lead to RCE without the custom buffer in the POC that explicitly puts a function pointer directly where the overflow happens, then invokes it.

I'm happy to be shown what I'm missing but this seems like a memory corruption bug, not RCE, and if it was feasible w/o the custom buffer then why not provide that as the example? In the real world, a ffmpeg invocation would use the default buffer handler that will use padding/alignment/etc that makes the heap even less predictable, and incredibly unlikely to have a function pointer exactly following the frame buffer that will deterministically be invoked by a process placing it there?

It seems very far fetched.

Maybe I'm missing something but the ffmpeg buffer "exploit" involves passing a custom exploited buffer callback to parse a RASC file that presumably has been crafted to contain a packet that can exploit the custom buffer passed in? I don't see how this would be used in practice in the wild as to achieve the first step (custom buffer invocation) would require you to already have access to the machine to even invoke ffmpeg with it?

Like yes there is a heap OOB issue in an incredibly old file format, but without already having arguably compromised access to a machine, exploiting it for RCE seems impossible?

Few thoughts: in context it's not nuts at all:

- moot was fundraising for his VC backed startup during the years the emails are in, and he was likely connected via mutuals in USV or other firms. These meetings were clearly around him trying to solicit investment in his canv.as project.

- /pol/ was /new/ being returned; the ethos of the board had already existed for a long time and the decision to undo the deletion of /new/ was entirely unsurprising for denizens at the time, and was consistent with a concerted push moot was making for more transparency in the enforcement of rules on the site and fairness towards users who followed the rules. /pol/ didn't start a culture war at this time any more than /new/ had previously - it just existed as a relatively content-unmoderated platform for people to discuss earnestly what would get them banned elsewhere.

I believe a lot of this expectation is that as people replace Google searches with LLMs, or even enriched LLM results pushed at the top of Google results, far less click through to the actual sources happens.

This is happening across a lot of web verticals that previously relied on excellent SEO ranking and click through performance to drive ad revenue/conversions/sales. I have direct knowledge of some fairly catastrophic metrics coming out of knowledge base businesses; it wouldn't surprise me in the slightest that something like Tailwind is suffering a similar fate.

I think this author is comically misguided about the speed at which oil extraction happens in Venezuela. Even if the plan was to pay for everything with Venezuelan crude sales, I don't believe ~$30MM/d is going to move the needle much.

1. How do you intend to pay for it? 2. How do you intend to enforce it? 3. How do you intend to defend it?

How many tanks can you deploy? IFVs? Artillery? How much ammunition can you supply? How many fighters are in service and mission ready? Bombers? Tanker aircraft? Transport? Helicopters? How many battalions (of any type) can be formed/deployed?

Repeat the same exercise in the context of a navy.

https://www.statista.com/statistics/584035/defense-expenditu... https://www.statista.com/statistics/1294391/nato-tank-streng... https://www.statista.com/statistics/1293688/nato-aircraft-st...

iPhone, most notably.

musk holds TS clearance but not SCI

I was in Bishkek last year and I don't see the risk; what concerns would you have aside from food poisoning?

Dushanbe I agree with you, but simply because I found Tajikistan rather boring and desolate but in an unimpressive way.

Yeah, it's quite an exorbitant price for the trip described. It said flights included which I have to hope is the majority of it.

It's also the most scenic 'stan imo, by a wide margin. Was definitely my favorite of them all and is the only one I'd actually recommend people visit.

Same, but my Turkmenistan LoI took over 4 years and several attempts to get (us passport holder). It has been by far the most problematic and difficult country for me to gain entry to. DPRK, Iran, etc all were substantially easier. My DPRK one was not an issue in the slightest, maybe 1-2 month turnaround from the tour company applying.

YMMV.

Not sure if you'll take it as reassuring, or alarming, but having worked with a few PBMs on the insurer side ES was the most tech-competent. Worst probably being CVS Caremark.

I poked around google/ddg and didn't see any obvious public discussion of it so I can't blame you for missing it.

If you have access (or have friends with access) to PitchBook, their file on WeWork would have comprehensive data about all the liquidity events.

Nice article, but it is wrong about liquidity events at WeWork. The author only discusses a tender offer that fell through at the end of 2019 after the failed IPO and collapse, implying there was nothing ever before.

There was a tender offer in 2017 with the first SoftBank investment, and again in early 2019 (pre IPO attempt, closed in April) associated with the second investment by SoftBank. It is possible there were earlier events, but I had joined in 2015.

That isn't to say things were roses; I know many early employees who, in the lead up to IPO, exercised their options and took enormous loans to pay AMT and were left in a terrible situation.

100-125 should give you visual effects you'd expect based on your existing conception of hallucinogens.

If you don't care for visual hallucinations, anywhere from 50-75 will give you a lot of the usually pleasant mental effects: high sense of novelty, mood elevation, curiosity, sense of openness, etc.

Even a smaller dose of 25-50 will give you perceivable mental effects.

You should also spend the bit of extra money on a reagent testing kit to ensure you aren't taking random research chemicals being passed off as LSD. You can keep the reagents in the fridge pretty much indefinitely for future use as well.

Customers too, Especially B2B. If you're buying something from an early stage startup (service or product) you want to believe that they'll be around in a couple years so you haven't wasted the time/effort of onboarding or using the product.

My favorite so far, the entire product description is chef's kiss: https://www.amazon.com/haillusty-Apologize-fulfill-violates-...

TIL! Ty, I'll keep this in mind next time my credit card number is inevitably compromised.

I understand that, I’m curious if reporting fraud activity helps prevent that in some way like the parent comment seems to suggest, if only for a year.

Correct me if I’m wrong, but I’ve signed up for all 3 bureaus and enabled the credit freeze. My understanding, and experience years later, is that it is still frozen. I had to unfreeze a specific one last year for an auto loan.

Is there something else I’m missing that’s only temporary?

There already is a company that rents out a system like this called the A-1 Array: https://www.array.cam/

I first saw this at an art installation in Brooklyn in 2017.

>you must keep the patina or it loses value?

That's exactly it, especially among vintage rolex collectors. They have a bunch of slang for describing different ways things have aged eg the tritium paint on the dial having faded into a desirable cream color (creamy lume!), the hand's lume matching (implying it is the original paint on both the dial and hands), the dial itself could have any variety of sun damage like spidering or spotting, and on the GMT's in particular the color on the insert can fade so you might find yourself looking at a "fuchsia GMT". There is also a huge aversion to polishing of any kind.

This also can end up creating a lot of drama with Rolex itself if they send the watch in for factory service with instructions that end up not being honored. If you poke around on forums you'll see some very angry customers who specified no polishing, no replacing of worn/patina'd components like hands or dials, who got their watch back with a bunch of factory new parts.

I'd say you've heard very wrong. If your concern is maximizing your income I'd highly recommend not going the mainframe route. The only people commanding SF/NYC gargantuan salaries will be old guard who retired to do contracting and get brought on to un-fuck situations at incredibly high rates under short term contract. IME you're likely to see MAYBE 80-100k as a midlevel COBOL dev as you're competing primarily against offshored pay - I would expect bootcamp front end devs to make as much or more than COBOL devs.

Also as others have insinuated, COBOL itself isn't a challenge (nor PL1 or HLASM or any other language really), it's the zOS/360 mainframe environment, understanding the nuance behind how all these disparate systems work together, being a JCL wizard, knowing all the IBM yellow books off the top of your head from 40 years of working in the industry, understanding how to use IBM IMS db efficiently, etc. Also the entire ecosystem of stuff you might take for granted, like IDEs/debuggers/deployment/etc, are all quite ancient on zOS systems and take years to get proficient in.

that's an excellent point/callout.

My read on the bug is that it'd take quite the combination of factors to be exposed, I don't think it poses a widespread or remotely likely risk.

App in question has to allow file upload that writes to local disk. Attacker would have to upload his ruby payload via this method.

App in question has to allow arbitrary, user-entered time zone select, eg allowing a user to enter "EST", and then pass that directly, raw, to TZInfo::Timezone.get(). Attacker would have to know where in the target filesystem their uploaded payload is, and submit a crafted timezone payload with escape characters to the path of their uploaded payload file relative to where the TZInfo gem is.

So, lets say I upload nasty_ruby.py, and the app puts it in /temp/myappuploads/nasty_ruby.py And lets say the tzinfo gem is running in /myapp/gems/tzinfo-gem/ I would submit something like 'fake\n../../../temp/myappuploads/nasty_ruby.py' which would cause the impacted tzinfo-gem method to call require on '../../../temp/myappuploads/nasty_ruby.py' which would execute it.

In general, I don't think I've ever seen time zone selection available as freeform text vs, say, a dropdown, so that seems fairly rare. Assuming you do have a freeform text form submission for timezone, you have to ALSO have a file upload capability that would place files on the local disk on the same system. And then, the attacker would have to either know or traverse/explore to find the path to where those files are on the system - ostensibly possible but seemingly unlikely? And this is all predicated on you using an old version of tzinfo-gem.

That said, if your ruby app checks all these boxes and is running an outdated version of the gem then yeah, its a straightforward RCE and thus very bad (and i think why they rated the severity as they did)

Yeah, they continuously try to rewrite history. The original whitepaper directly stated "Each tether issued into circulation will be backed in a one to one ratio with the equivalent amount of corresponding fiat currency held in reserves by Hong Kong based Tether Limited."

For further reading, see the CFTC settlement