So they're using AES in CTR mode for encryption. They encrypt both key (website + login) and value (password) using the same key (wallet private key) and counter (1). [1] Which means you can just bruteforce popular domain names, xor encryptedPass ^ encryptedKey ^ domainName, and get first bytes of the password (depending on domain name length), just by going through some recent TXs at [2].
I was looking forward to reading this article (it's the second part) to see how the author would bypass aslr but they just disable it (running under gdb) so in the wild their method would not work.
Alternative client/UI: check out PleXBMC, you can use any theme you like. That said, plex media player will provide a superior experience as it's using mpv.
irccloud keeps going down every time freenode netsplits. It got so bad lately I actually canceled my subscription and instead set up weechat+glowing bear, which is not as polished, but it works fairly well on both desktop and mobile. (And cheaper)
It's also free software and easy to set up so I encourage everybody to check it out.
Vector (+Matrix) is kinda like self-hosted slack/discord with proper history sync across all your devices, file uploads, nice UI, etc.
It's really good. I recommended it to 7 people and every single one liked it, even got 5 of them to set up their own federated homeservers. We're thinking about moving a ~60-people skype group there as well.
Only issue I had is Synapse hogging the CPU and getting laggy with a large room (#matrix:matrix.org with its 4 thousand members). I'm using scaleway's 3 EUR/month Starter VC1S server for Synapse though. Hopefully it will get even better with time.
Yandex offers unlimited users (up to 1000, then you have to contact them and I guess they will allow more) and claims unlimited storage, zoho free tier is 25 users and 5 GB storage/user.
Reading the blog post, it seems they are not competent enough to actually run it, and the best they could do was to open the main executable (BOOT.BIN, the decrypted version) in a hex editor. Some commenters even tried to help them run it, of course without any reply. 1.5 years later, the files are still not available to download, and that disk is basically rotting away somewhere in the "library".
Please, if you are a game developer, and care about game preservation, don't submit your games to that library. Instead, upload them anonymously to a torrent tracker of your choice. The internet will do the rest.
An attacker can also replace an https:// login URL with an http:// one on a page sent via unencrypted connection. The http:// page can then be manipulated in any way.