2,304 reputation
11019
bio website
location
age
visits member for 2 years, 10 months
seen yesterday

Jul
15
comment This protocol is vulnerable, but why?
It isn't clear what you are trying to do here!
Jul
14
comment Why is the same origin policy so important?
"origin of the script itself is not relevant to the same-origin policy" but it is: first, the script http://a.c/s.js is fetched with its HTTP origin http://a.c, with its a.c HTTP cookies; then run within the scope of the HTML document (http://b.c/doc.html) HTTP origin (http://b.c/).
Jul
13
comment Showing CAPTCHA
With IPv6, getting another, different IP address is as trivial as ipconfig. Be careful with address storage: don't expose yourself to a DDOS.
Jun
16
comment Is it illegal to publish an exploit against a known vulnerability in US?
@AbbasJavanJafari OSS (open source software) is not without copyright and copyright owners.
Jun
14
comment Is it illegal to publish an exploit against a known vulnerability in US?
Could you describe the applicable doctrine or law?
Jun
14
comment Is it illegal to publish an exploit against a known vulnerability in US?
@schroeder "It's a defined concept" But can you prove to a judge that you did a "responsible disclosure"? Can the other party disprove that?
Jun
13
comment Is it illegal to publish an exploit against a known vulnerability in US?
@schroeder Is "responsible disclosure" a well defined concept?
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@makerofthings7 "Google leaks search terms to the target site" not anymore
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
Re: referer You can search for "referer.rustybrick.com" in a search engine and click on the link to see how much info is sent. For Google and DDG, I see only the website (https://google.com/, https://duckduckgo.com/). For Bing, I see lots of stuff. (I use Google Chrome.) Note that this would work with a HTTP website, because referer is usually not sent in this case.
Jun
2
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
I dislike the change-HREF-when-clicked but I disagree about Google trying to hide the fact that selected linked are logged: I have a Google account, and under Search history I can see 1) the searches I have made, 2) the websites I have visited by clicking on Google search results. (I wished Google used the PING feature to collect this data, and not mess with URLs, and I wish browser would show PING requests in some way.) You have to remember that when you have JS on, everything you type or click on a website can be logged by the website, including form data when you do not "submit".
Mar
7
comment Should websites be allowed to disable autocomplete on forms or fields?
1. Some computers get stolen on a daisy. These should have adequate passphrase protection. 2. A CEO is not a system admin and breaking into his account should not have any notable security impact for the information system.
Mar
2
comment Is Adblock (Plus) a security risk?
How many people use Adblock* with EasyList and no other filters?
Feb
28
comment Is Adblock (Plus) a security risk?
@Superbest "It's not "some random German company"." But ADB is known worldwide (like Google). A scandal involving ADB would be great news for the world.
Feb
28
comment How weak is MD5 as a password hashing function ?
There is no known way to efficiently recover x from MD5(x).
Feb
25
comment How big is the threat of Desktop Linux malware?
Un*x/linux is horrible from a security POV. But Windows is worse. Also, nix has many stupid admins, but Windows usually comes with an inane user who sees himself as a know-it-all because he can do a couple of simple tasks. GNU/linux distros come with lots of software to do many basic tasks. Windows computer often don't. Also, most malware just aren't ported to linux.
Feb
24
comment How big is the threat of Desktop Linux malware?
"For a long time, Microsoft didn't enumerate what extensions made a file executable," True; I bet very few people can enumerate these from the top of their mind (I sure can't). The extension hiding thing is perhaps the most notable misfeature of Windows.
Feb
24
comment How big is the threat of Desktop Linux malware?
"Linux has far better documentation" Linux has terrible documentation. Sometimes semantics are only described in dev mailing list. gcc has issues (see: asm). C has issues (see: aliasing). OTOH, MS sometimes has ambiguous or even contradicting documentation for essential semantic issues (memory consistency issues come to mind).
Feb
24
comment How big is the threat of Desktop Linux malware?
"Linux has a tradition of separating "user" and "administrator" roles" Like NT. The Windows 3 and Windows 95 series did not, but MS killed Windows and only kept the Windows NT system. Many incompetent user/admin (on a personal computer) come from Windows and do not understand the "depth" of security gained by the user/admin separation.
Feb
24
comment How big is the threat of Desktop Linux malware?
"Linux does not have the array of special cases that Windows has" Seriously? From device files to fifos, there are many things that you can open for reading or writing, that will behave differently and block at different times. Symlinks are hard links are special. /dev/tmp like devices are special and their semantic has changed. #! executables are special, they are not first class programs, as don't run directly (the interpreter replaces the script). Running a SETUID program is special; and SETUID programming is very tricking. Really nix semantics are awful from a security point of view!
Nov
25
comment Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
"SMTP" as in smtp.my.isp (which do not implement the real SMTP protocol), or the real SMTP servers, as found in MX records?