vmarquet

5 ปีที่แล้วdiscuss

I think it's a reference to this blog post https://journal.stuffwithstuff.com/2015/02/01/what-color-is-...

6 ปีที่แล้วdiscuss

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of.

It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

vmarquet

7 ปีที่แล้วdiscuss

SEEKING WORK | Full Stack Engineer specialized in Ruby on Rails and InfoSec | Paris or remote

I have 5+ years of experience with Ruby on Rails. I also have a diploma and work experience in Information Security (but I am completely open about working in other fields). Strong entrepreneurial mindset and happy to participate to my client/employer company at every level, not just technical.

I have experience in refactoring apps for easier maintenance and evolution, and in upgrading legacy apps (I have migrated an app from Rails 2 to Rails 5 without issues). I take extra care for UX and design when implementing new features, and try to maximise developer happiness by using the most efficient tools available (exemple: static type-checking with TypeScript instead of JS, etc).

Stack:

* Backend: Ruby on Rails, Python

* Frontend: ReactJS with TypeScript or JavaScript

* Mobile: React-Native

* Also: good knowledge of SQL, Bash, C, Electron, ..., and willing to learn Elixir

Contact:

* Email: vincent.marquet1 [at] gmail.com

* Github: https://github.com/vmarquet

* Stack Overflow: https://stackoverflow.com/users/3486743/vmarquet

vmarquet

8 ปีที่แล้วdiscuss

Note that domain fronting is not only usefull to circumvent Internet censorship, it's also used by malware.

With domain fronting, you can exfiltrate data from a company by making the connection appear to go to a legitimate google service (ex: drive.google.com), whereas it actually is going to a server hosted on google cloud services and controlled by an attacker.

vmarquet

8 ปีที่แล้วdiscuss

lemonde.fr published an article [1] yesterday, in which they debunk this news. A seismologist at Southampton University says [2] that it's unrelated to the rifting.

[1] https://www.youtube.com/watch?v=4QJ8MmbAC_o (in French)

[2] https://twitter.com/seismo_steve/status/977258571716091904

vmarquet

9 ปีที่แล้วdiscuss

For a quick reference of the Dex file format, Ange Albertini (known for PoC||GTFO) made a poster: https://github.com/corkami/pics/blob/master/binary/DalvikEXe...

All his posters are pretty amazing: https://github.com/corkami/pics/blob/master/binary/README.md

vmarquet

9 ปีที่แล้วdiscuss

This. For more information, see this post https://training.kalzumeus.com/newsletters/archive/enterpris... by patio11.

vmarquet

9 ปีที่แล้วdiscuss

In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago."

A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/

vmarquet

9 ปีที่แล้วdiscuss

Oh you're right! I searched for something after the login screen but I missed this before. Thank you.

vmarquet

9 ปีที่แล้วdiscuss

Unfortunately, as many game creators, they seem to believe that everybody in the world has qwerty keyboards, which is not the case. Using the A, W, S and D letters does not make sense on azerty keyboards (up and down reversed). Why can't we use keyboard arrows to move?

Too bad, the game would have been really fun to play if controls were usable for me.

vmarquet

9 ปีที่แล้วdiscuss

Just curious, does it list itself in the list of app subscriptions? :)

Anyway, great product!

vmarquet

9 ปีที่แล้วdiscuss

A way to validate that you're genuinely interested in penetration testing and to learn is to do challenges on sites like https://www.root-me.org/ for example. It's not necessarily realistic challenges, meaning there can be challenges on vulnerabilities you're very unlikely to see in real life, but you'll always learn something If the challenge does not teach you on some kind of vulnerability, at least it will teach you about how to think and do research, which is the most valuable.

I've seen companies filter candidates based on their score on such platforms. For example, for a junior position in penetration testing, they asked for at least 3000 points on root-me (but it was a few years ago, the number of challenges on the site has increased so it would make sense if they had increased their minimum points requirement).

Compared to certifications, it has two enormous advantages: it's fun, and it's free. I've started that way and never regretted it. I've not needed a certification to land a penetration testing job in a serious company (this was in France though, I don't know much about practices in other countries).

vmarquet

9 ปีที่แล้วdiscuss

"Don’t make me hunt for a way to ask it."

And this post makes me hunt google to find what "kthxbye" means...

vmarquet

9 ปีที่แล้วdiscuss

I thought this was quite high, since the net neutrality issue had a lot of coverage in the media, see for example the two John Oliver talks about it:

https://www.youtube.com/watch?v=fpbOEoRrHyU https://www.youtube.com/watch?v=92vuuZt7wak

vmarquet

9 ปีที่แล้วdiscuss

Knuth's checks have their own wikipedia page: https://en.wikipedia.org/wiki/Knuth_reward_check

vmarquet

9 ปีที่แล้วdiscuss

And the weirdest way of all to do a console.log(1):

    [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]](([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

How: http://www.jsfuck.com/

As a side note, jsfuck is usefull for bypassing filters who try to prevent the exploitation of XSS vulnerabilities.

vmarquet

9 ปีที่แล้วdiscuss

I'm surprised no one yet has mentionned the famous stack overflow question: https://stackoverflow.com/questions/8318911/why-does-html-th....

TLDR; For legacy reasons, some words produce valid colors even if they don't respect the standard color formats. For example, "chucknorris" produces red.

vmarquet

9 ปีที่แล้วdiscuss

Little known fact: lead might be one of the reasons of the decline of the Roman Empire, because they used it inside the pipes carrying water. https://en.wikipedia.org/wiki/Lead_poisoning#History

vmarquet

9 ปีที่แล้วdiscuss

Isn't Uber like a Ponzi scheme in some way? They use investors money to subsidize drivers so that prices are low and they get more users, and with more users they are valued better and get more investors money. When investors money or/and user growth stops, prices go up, people stop using it, and the system collapses (or at least the user base shrinks).

Submissions

A Look at How Often Docker Images Are Updated

comments