1,746 reputation
815
bio website
location Paris, France
age
visits member for 3 years, 4 months
seen 21 hours ago

Security consultant, specializing in application security.


Jul
25
revised Is there something similar to pseudorandom generators but in the opposite direction?
fix typo in the most important word
Jul
25
suggested suggested edit on Is there something similar to pseudorandom generators but in the opposite direction?
Jul
25
comment Is there something similar to pseudorandom generators but in the opposite direction?
Unless I miss something, you just described a cryptographic hash.
Jul
18
answered is there a way to indirectly uncharge rapidly a coin cell to defeat an anti tampering mechanism?
Jul
17
answered Why is the code CVE-2010-5298 used for a vulnerability discovered in 2014?
Jul
17
answered How can my .exe become infected?
Jul
17
comment Help removing my domain from blacklists
Your best bet is to contact the blacklist managers, a certificate won't help at all wrt this issue.
Jul
16
awarded  Civic Duty
Jul
16
comment How to prove flyer was (not) authored by specific person?
If you don't want to pay a TSA, you can use the bitcoin blockchain for the same purpose (put hash of document in a transaction). Very low chances of if being accepted in court thought, a notary may be your best bet if the goal is to eventually go before a judge.
Jul
16
comment Is php DOMDocument::loadXML completely secure?
I would hope the Billion Laughs is addressed in the library we talk about, I was talking about the simpler problem that a legit document can take a lot more memory that its text representation, especially if tag names are small etc...
Jul
16
comment Is php DOMDocument::loadXML completely secure?
It's hard to do, you can however makes an example program that parses it and observe its memory usage.
Jul
16
comment Is php DOMDocument::loadXML completely secure?
No need for macros, you can just optimize a valid document for maximized memory footprint, lots of one letter tags and attributes will do it. A valid XML header followed by <a><a><a><a> x 100,000 followed by </a></a></a></a> x 100,000 is valid XML and often has a huge memory footprint. If you look for stuff in the document it could possibly take a very long time too.
Jul
15
comment Is php DOMDocument::loadXML completely secure?
At the very least, a 2MB XML length limit offers an attacker lots of leverage to create a file that will take much, much more memory on your server. Possibly enough to turn it in a denial of service attack.
Jul
2
answered Sniffing 2400bps v22bis modem traffic
Jul
2
answered How can the NSA remotely turn on your iPhone?
Jun
19
comment Security in automated systems using Puppet and Chef
jpmens.net/2012/07/27/verifyhostkeydns-yessssss explains pretty well how it works in both cases, with example outputs
Jun
19
comment Security in automated systems using Puppet and Chef
IIRC if you don't have DNSSEC (or to be pedantic, if the reply isn't authenticated) it still informs you with the message "Matching fingerprint found in DNS" in addition to presenting you the fingerprint and the yes/no question. So even without DNSSEC it brings some level of convenience.
Jun
19
comment Security in automated systems using Puppet and Chef
It looks like you missed a great opportunity to use SSHFP DNS records to publish your public keys.
Jun
16
comment How to avoid cloaking attacks?
It looks like rogue SEO. Not a security issue per se. You'd likely get better advice on a SEO forum.
Jun
16
comment How to avoid cloaking attacks?
Why do you call it a "cloaking attack" and not just rogue SEO riding on your site reputation?