calebbrown
Re:PyPI: Preventing ZIP parser confusion attacks on Python package ins...
on Thursday August 07, 2025 @04:48PM (#44830152)
Apart from Python Wheels, the other popular ecosystems using zip files are Java jar files, and NuGet.
Of these Java is the most interesting as there a few JDKs commonly in use.
But I’m also interested in various security scanners that are built in other languages that can be fooled.
Re:OpenSSF: Scanning open source packages for malicious behavior
on Tuesday May 03, 2022 @04:10AM (#31245897)
Thanks!
`--privileged` is needed to run the container inside a container.
e.g. https://www.docker.com/blog/docker-can-now-run-within-docker...
This is particularly useful for using Kubernetes to manage a cluster of instances.
Re:OpenSSF: Scanning open source packages for malicious behavior
on Monday May 02, 2022 @11:31PM (#31244221)
Author here.
It's running a Podman container (like Docker but daemon-less) with a GVisor runtime for isolation inside the docker container.
The outer container is privileged, but doesn't run any attacker controlled code.
But, yeah, seeing those two strings together in the same command is certainly amusing.
Project Zero Discloses Use-After-Free 0-Day in Android
Re:Alphabet spinoff Malta raises $26M for technology to store power in...
on Thursday December 20, 2018 @01:27AM (#18722907)
Dinorwig Power Station in the UK pumps water to store 9.1Gwh
https://en.wikipedia.org/wiki/Dinorwig_Power_Station
Re:How HTTPS Handshake Happens
on Monday June 26, 2017 @11:55PM (#14642465)
Doesn't cover perfect forward secrecy (PFS).
Without PFS if the server's private key was stolen (e.g. by hacking the server) then all traffic sniffed in the past could be decrypted.
Re:Super Mario Run
on Thursday December 15, 2016 @11:14PM (#13191014)
That website was frustrating.
- splash page that has to load the background video before you can do anything.
- you have to start watching the video on the splash page to skip it.
- horizontal navigation in the about page.
- clicking the obscure "here we go!" back link in the about page has to reload the video before you can do anything.
It looks really nice, but the interaction is incredibly slow and cumbersome.
Re:Apps are too much like 1990's CD-ROMs and not enough like the Web
on Tuesday December 13, 2011 @09:50PM (#3350355)
I think apps are popular because they are more concrete than the web.
A user knows where an app starts and ends and they know what icon they need to touch to get there.
Websites are far more ethereal and it isn't as clear when you've left one site and landed on another. And it's much harder remembering how to get there.
Case in point: how many people type 'facebook' into google and click the first link instead of entering 'www.facebook.com' into the address bar.