frozenice · HackerTrans

frozenice

no profile record

Submissions

Microsoft Warbird and Protected Media Path

security-explorations.com

3 pointsby frozenice2 ปีที่แล้ว0 comments

An Announcement from Gitlab CEO Sid Sijbrandij

about.gitlab.com

10 pointsby frozenice3 ปีที่แล้ว0 comments

July 1 TeamCity Cloud Outage Postmortem

blog.jetbrains.com

1 pointsby frozenice4 ปีที่แล้ว0 comments

Visa card vulnerability can bypass contactless limits

ptsecurity.com

8 pointsby frozenice7 ปีที่แล้ว10 comments

Fake fingerprints can imitate real ones in biometric systems

theguardian.com

83 pointsby frozenice8 ปีที่แล้ว40 comments

[de] 1.8M cleartext passwords leaked from knuddels.de

golem.de

1 pointsby frozenice8 ปีที่แล้ว1 comments

Development on Torus at CoreOS Stopped as of Feb 2017

github.com

10 pointsby frozenice9 ปีที่แล้ว2 comments

Subversive-C: Abusing and Protecting Dynamic Message Dispatch [pdf]

usenix.org

4 pointsby frozenice10 ปีที่แล้ว2 comments

SX (easy storage cluster)

skylable.com

2 pointsby frozenice10 ปีที่แล้ว1 comments

A New Persistent Attack Methodology Targeting Microsoft OWA

cybereason.com

2 pointsby frozenice11 ปีที่แล้ว1 comments

comments

ปีที่แล้วdiscuss

S/MIME is about the mail (content) itself, not the transport. For the transport part there are things like (START)TLS and MTA-STS. With S/MIME you include your certificate in the mail and can either sign the mail with a signature (with your private key, others can verify it using your public key from the certificate) or encrypt the mail (with the receiver's public key, so only he can decrypt it using his private key). Certificate trust is determined normally via the CA chain and trusted CAs.

ปีที่แล้วdiscuss

It didn't need to in my simple case. k6 doesn't do crawling / auto-discovering, from what I can tell - I just wanted to give the tool one URL and press start.

ปีที่แล้วdiscuss

Funny timing. Just yesterday I was looking for an easy Windows tool to do a simple stress-test on a website (legally ofc). A requirement of mine was to just give it the root URL and the tool should discover the rest automatically (staying on the same domain). Also, parameters like parallelism had to be easily manageable. After trying some crawlers / copiers and other tools I went back to a simple one I already knew from saving static copies of websites in the past: HTTrack. It fit the bill perfectly! You can add the root URL, set it to "scan only" (so it doesn't download everything) and tweak the settings like connections and speed (and even change some settings mid-run, save settings, pause, ...). So thanks xroche for HTTrack! :)

2 ปีที่แล้วdiscuss

I also use HeidiSQL almost daily. Besides MySQL / MariaDB it also can connect to MSSQL and Postgres.

I recently had to import a CSV with some million rows into MariaDB. Neither HeidiSQL nor DBeaver could do it (tried various settings). IntelliJ worked like a charm.

3 ปีที่แล้วdiscuss

A useful feature! I have this available to me as part of Refined Hacker News [1], which does a bit more. But if you only want the user popup, a slim extension is nice.

[1] https://github.com/plibither8/refined-hacker-news

4 ปีที่แล้วdiscuss

  time.Second * time.Second

The type of this is `time.Duration` (or int64 internally), not `time.Second` (which is a const with a value).

I agree, though, that this is not quite sound, because it can be misused, as shown above with `time.Sleep(delaySecs * time.Second)`.

In Kotlin you can do `1.seconds + 1.minutes` but not `1.seconds * 1.minutes` (compilation error), which I quite like. Here is a playground link: https://pl.kotl.in/YZLu97AY8

4 ปีที่แล้วdiscuss

I use them on my desktop, too. There are none in this WebView embedded in this mobile app, though.

4 ปีที่แล้วdiscuss

OT: popups and banners managed to cover the whole page... :/ https://photos.app.goo.gl/PqV9FpqyPCujtFTJ6

4 ปีที่แล้วdiscuss

> I hate email-based authorization.

Authentication, not authorization. ;)

5 ปีที่แล้วdiscuss

Think of it this way: there is always a GROUP BY (implicitly), i.e. GROUP BY rownum(). So there is always a big group with all the rows (or rather many small groups).

7 ปีที่แล้วdiscuss

> Positive Technologies found that both of these checks can be bypassed using a device which intercepts communication between the card and the payment terminal. This device acts as a proxy and is known to conduct man in the middle (MITM) attacks. First, the device tells the card that verification is not necessary, even though the amount is greater than £30. The device then tells the terminal that verification has already been made by another means. This attack is possible because Visa does not require issuers and acquirers to have checks in place that block payments without presenting the minimum verification.

That's the first time I hear about RFID/NFC MITM, neat.

7 ปีที่แล้วdiscuss

+1 for TeamCity. We tried GitLab CI before, but are happier with TeamCity now.

8 ปีที่แล้วdiscuss

> There are only two hard problems in computer science: cache invalidation and naming things.

There are only two hard problems in computer science: cache invalidation, naming things and off-by-one errors.

8 ปีที่แล้วdiscuss

translation: https://translate.google.com/translate?hl=en&sl=de&tl=en&u=h...

Troy Hunt is already looking for the data ;) https://twitter.com/troyhunt/status/1038368815778648064

8 ปีที่แล้วdiscuss

I'm re-evaluating k8s again - tried it one or two years ago and hit some roadblocks for my use-case.

Kelsey's tutorial is a bit outdated (Oct 2 2017 with k8s v1.8, v1.11 just got released). Here is a link to the official kubeadm guide for Creating a single master cluster with kubeadm:

https://kubernetes.io/docs/setup/independent/create-cluster-...

It basically is just running

  kubeadm init

on a server / VM (after installing docker and kubeadm, of course). Add a pod network add-on (Calico seems to work well, 2 commands to install), remove the mentioned taint and optionally join more worker nodes (also a single kubeadm command). Every step is in the guide, just copy & paste. ;)

Note: This is no production-ready cluster (it has a single master), also you should have some basic understanding of k8s, which the OP provides. I also highly recommend to dig around kubernetes.io/docs - good material there.

I started with kubeadm some days before the release of k8s v1.11, which made some stuff I wrote obsolete, oh well... :) I really like the new kubeadm phase stuff, though.

There is also an official guide for Creating Highly Available Clusters with kubeadm (it's updated for v1.11) which I just went through:

https://kubernetes.io/docs/setup/independent/high-availabili...

I opted for the "stacked masters" approach (run HA etcd right on the k8s master nodes), wrote some ansible tasks to automate to boring stuff like copying configs/certs etc., and am currently (re-)exploring add-ons and advanced functionality (helm, network policies, ingress controller, ceph via helm, ...).

Let's see how far I get this time!

9 ปีที่แล้วdiscuss

I'm very satisfied, too. Servers are ready in minutes, not hours, after ordering. We currently run ~30 servers there (dedi) and over the last ~7 years roughly had 1 HDD fail per year. Each time the replacement was done on our chosen time and quickly in about 5 - 20 minutes (the installabled images come with pre-configured software RAID 1). We recently tried a AX60 (Ryzen 7 1700X Octa-Core) and had some sporadic crashes, support changed some BIOS settings, no problems since. Service and prices are unbeatable, imho.

9 ปีที่แล้วdiscuss

rook (which was linked in the README) looks pretty nice, though it's still in alpha (it wraps Ceph and etcd to easily run a ceph cluster, managed internally by rook). https://github.com/rook/rook

10 ปีที่แล้วdiscuss

That reminds me of a trick I discovered nearly 10 years ago on an Acer to reset the BIOS Password from Windows.

There was this eSettings.exe which let you change some BIOS Settings from Windows, including the password. Of course it first asked for the old password and showed a prompt, denying the request if it was wrong.

I fired up good old OllyDbg and traced the prompt in the ASM code. I changed only one bit IIRC (jne to je, or similar), saved the .exe and tried my luck.

It let me through the prompt and I entered the new password. Amazingly the BIOS gladly accepted it!

I didn't bother to find out what functions it exactly called to set the new password to write a small tool, because I already had one. ;)

I wonder if this still works... If not with an Acer, maybe with some other make?

10 ปีที่แล้วdiscuss

Abstract

The lower layers in the modern computing infrastructure are written in languages threatened by exploitation of memory management errors. Recently deployed exploit mitigations such as control-flow integrity (CFI) can prevent traditional return-oriented programming (ROP) exploits but are much less effective against newer techniques such as Counterfeit Object-Oriented Programming (COOP) that execute a chain of C++ virtual methods. Since these methods are valid control-flow targets, COOP attacks are hard to distinguish from benign computations. Code randomization is likewise ineffective against COOP. Until now, however, COOP attacks have been limited to vulnerable C++ applications which makes it unclear whether COOP is as general and portable a threat as ROP. This paper demonstrates the first COOP-style exploit for Objective-C, the predominant programming language on Apple’s OS X and iOS platforms. We also retrofit the Objective-C runtime with the first practical and efficient defense against our novel attack. Our defense is able to protect complex, real-world software such as iTunes without recompilation. Our performance experiments show that the overhead of our defense is low in practice.

10 ปีที่แล้วdiscuss

Funny, just this week I was looking for an easy solution to cluster storage for containers.

I found SXCluster and posted it here https://news.ycombinator.com/item?id=11812566 - not directly geared towards containers, but very easy to setup (no need for etcd and the like).