News for hackers. Stuff that matters.

hackerpain

hackerpain on Hacker News

Re:Pidgin – A Universal Chat Client on Friday January 22, 2021 @11:51AM (#25873309)
Using it since a decade, I faced bugs in the PGP encryption add on, they need to work on a lot of things to make it secure. This is my go-to Jabber client.
Re:Linux Mint fixes screensaver bypass discovered by two kids on Sunday January 17, 2021 @04:20AM (#25809369)
How does this kind of vulnerability even remain, after code reviews?

Is it hard to spot?

Re:Stealing Your Private YouTube Videos, One Frame at a Time on Monday January 11, 2021 @11:15AM (#25730932)
This bug was found by my friend. David has found many creative bugs and we worked on a project together :)

Must say a quick thinker, and he's just 17 or 18.

Re:Breaking the Google Audio ReCAPTCHA with Google's Own Speech to Tex... on Tuesday January 05, 2021 @12:35PM (#25648151)
I think ReCaptcha has been like this since at least last 6 years. Are they copying research?

https://www.youtube.com/watch?v=_RDXtILdkV0&persist_app=1&ap...

Re:Testing a Proof of Concept of security bug on Monday January 04, 2021 @04:33PM (#25638415)
Please ignore
Re:Is Slack Going through a DDoS attack? on Monday January 04, 2021 @10:37AM (#25632648)
they haven't mentioned if an API (or, endpoint) is being DDoSed, just an incident update?
Re:Slack is down on Monday January 04, 2021 @10:32AM (#25632554)
Indeed.
Re:Ask HN: How did you turn your failed business model into a successf... on Tuesday December 29, 2020 @02:14PM (#25573578)
We spent like 12 years trying to create a medium sized business in electronics and we were at that time in an era when mobile phones were still getting popular. It was a nascent stage of refurb smartphone industry but even then it was a steep climb for us!

But there are companies operating in the same segment that started later, with VC and investor backing who rose quite fast.

Re:Ask HN: How did you turn your failed business model into a successf... on Tuesday December 29, 2020 @02:11PM (#25573537)
That's quite hard because getting established in one trade in the industry itself takes a lot of time and effort.

Ask HN: How did you turn your failed business model into a successful venture?

Posted by hackerpain on Tuesday December 29, 2020 @01:55PM
from the ask-hn dept.

I started with flipping gadgets, but failed at first to make a substantial income. It was hard to make ends meet...At first we bought devices from dealers and stores who got them in exchange.But thereafter, my profit increased 5-6x after I started a business model which cut down all middlemen and bought gadgets directly from consumers. There have been some issues like stolen devices and as...

( Read More... | 4 comments | on HN )
Re:Ask HN: How can I use my phone to create things rather than consume... on Tuesday December 29, 2020 @10:16AM (#25570486)
Install code-server (https://github.com/cdr/code-server) on a server, and using it in your phone's browser to develop small web apps (works well in landscape mode with 6 -6.7 inch phones)

If you have a powerful processor and adequate RAM - you can do almost any thing that you do on desktop/pc

Re:Stealing private documents through a bug in Google Docs on Monday December 28, 2020 @11:03AM (#25560237)
I am sorry but that can ruin your career as its illegal. You can't sell or, trade vulnerabilities on live websites like Google as per the terms and conditions of the Google VRP (Responsible Disclosure policy) while it may seem unfair, its illegal to do so.
Re:Stealing private documents through a bug in Google Docs on Monday December 28, 2020 @09:41AM (#25559506)
docs.google.com didn't have X-Frame-Options: DENY nor a restrictive CSP so I think its a browser quirk (rather, a clever bypass) that works here. Also, the author had exploited a postMessage flaw which wasn't validating the host name properly that led to the cross-origin leak of screenshot data

Check this out https://youtu.be/KpkrTUHoWsQ (video about URL validation bypass and SOP)

Re:Stealing private documents through a bug in Google Docs on Monday December 28, 2020 @09:24AM (#25559376)
Google VRP team has a tradition to reward 4 figure and 5 figure amounts to match 1337 or, L33T (Leet or, Elite).

Example bounty amounts - $1337, $3133.7, $13337 and $31337

Re:Stealing private documents through a bug in Google Docs on Monday December 28, 2020 @09:08AM (#25559238)
this one technically requires some user interaction

Anyway, in the past I found a way to takeover an organization account in Google cloud acquisition and they rewarded me $100, saying their "Panel" decided that, Google's VRP panel sucks, so you're right about that.

Re:Hackers last year conducted a 'dry run' of SolarWinds breach on Saturday December 19, 2020 @10:54AM (#25478147)
SolarWinds earlier said the backdoored binaries were put into their servers in March 2020, and hinted that the breach happened in 2020 but seems like the breach happened way before.

See related thread regarding the 2018 credentials leak - https://news.ycombinator.com/item?id=25442734

Ask HN: How ethical are pre-sales? Have you ever pre-sold a product?

Posted by hackerpain on Thursday December 17, 2020 @02:51PM
from the ask-hn dept.

Pre-sales are becoming a popular funding strategy for companies, and its effectively 0 interest loans from your prospective users. I am considering to do one.But Fake Door testing isn't quite ethical. You are selling a product you haven't made yet. Someone might steal your idea before it takes off. You need an audience.What is your opinion on pre-selling products and the new paid waitlists trend?

( Read More... | 2 comments | 3 points | on HN )

Older »