Reputation
1,480
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
13 36
Impact
~47k people reached

Feb
5
comment Why did Poitras and Greenwald put their batteries in the fridge?
On Snowden-scale, this amount of paranoia might actually make sense. The question is whether it was for security at all.
Jan
25
comment Are there any feasible solutions/workarounds for WPA2 hole196 vulnerability as of today?
I see, thanks again. And could clients detect the presence of client isolation reliably?
Jan
25
comment Are there any feasible solutions/workarounds for WPA2 hole196 vulnerability as of today?
Thanks! Just curious, could client isolation be also enforced at client level?
Jan
22
comment How should I securely type a password in front of a lot of people?
DO NOT DO THAT. If you set up forwarding, compromising your work e-mail means getting full access to all accounts linked to the personal one, using the "I forgot the password" feature.
Jan
14
comment How exploitable is the recent UseRoaming SSH problem?
@SteveSether: OK, thanks. This gets me closer to understanding it. It sounds like you could put that in an answer as opposed to a comment ;)
Dec
30
comment Are there security advantages gained from forcing a website to be available from just one tab at a time?
@NeilSmithline: thanks, you read my intent correctly. :)
Dec
28
comment Are there security advantages gained from forcing a website to be available from just one tab at a time?
I guess it wouldn't matter, but I hadn't tried.
Dec
18
comment Is this a safe way to verify public keys?
Sounds like a better match for crypto.stackexchange.com
Dec
16
comment How can I use netcat like ping?
Voting to close as "unclear of what you're asking".
Dec
9
comment Can letting anyone create Dockerfiles result in RCE?
Dockerfile? Anyone with access to the Git repo, which are org members. Not all of them have equal privileges.
Dec
9
comment Can letting anyone create Dockerfiles result in RCE?
@NeilSmithline: why do you ask? I'd certainly not allow somename="foo; rm -rf; "
Dec
9
comment Can letting anyone create Dockerfiles result in RCE?
@NeilSmithline: we can say it's hardcoded.
Dec
9
comment Can letting anyone create Dockerfiles result in RCE?
Thanks! Would it be okay if I built the files in a separate VM and deployed to hub?
Dec
9
comment Can letting anyone create Dockerfiles result in RCE?
@amccormack: to the best of my knowledge, it has to.
Dec
9
comment How does letsencrypt's ACME work?
Honestly, I don't know - I read about TLS challenges somewhere. It makes sense for me because you don't really need confidentiality or authenticity there if HTTP is your alternative. You just want the user to be able to prove that he can publish data on the domain.
Dec
9
comment How does letsencrypt's ACME work?
@MikeOunsworth: self-signed one? It's all about putting specific content up. Also, you might want to migrate.
Dec
9
comment Will Let's Encrypt require SNI from the operators?
@SteffenUllrich: now that the initial release was made, could you update the answer?
Dec
7
comment Automatically determining whether particular product version is vulnerable?
@K.P.: it would be perfect to know if the version information lets me determine that; perhaps yes/no/maybe would be a better set.
Oct
14
comment What's a good fuzzing framework for fuzzing a local standalone application?
Why the downvote?
Oct
13
comment Best way to triage crashes found via fuzzing, on Linux?
@D.W.: is it good enough now?