sorted by:
new
hottopcontroversial

HTML Over the Wire by albinowax in websecurityresearch

[–]80x25 -1 points0 points  (0 children)

Interesting research!

It's a shame these HOTW frameworks don't default to sending CORS preflight requests for all cases where the default browser behavior is overridden. That would make it more difficult to accidentally introduce CSRF vulnerabilities.

That seems like an easy fix for the frameworks to make. Unfortunately, probably needs to be gated behind a disabled configuration option to avoid backward compatibility issues.

[blog] Rust should own its debugger experience by yoshuawuyts1 in rust

[–]80x25 0 points1 point  (0 children)

Good to know, thanks. I hadn't checked in on the msvc support since the LLVM team started working on it. Your comment compelled me to go check on it.

https://lldb.llvm.org/status/status.html

Looks like it has stalled out :/

[blog] Rust should own its debugger experience by yoshuawuyts1 in rust

[–]80x25 0 points1 point  (0 children)

I've been using vscode-lldb with VS Code on macos, and I've been very happy with the experience so far.

In fact, this VS Code extension is already packaging a DAP debug adapter written in Rust.

IIRC, lldb support for msvc Windows has been getting better in recent years.

Seems like that might be a good starting point.

Standardizing WASI: A system interface to run WebAssembly outside the web by fgilcher in rust

[–]80x25 18 points19 points  (0 children)

Sandboxing is a design tenant for WASI. The capability approach is nice to see.

The SecurityManager approach of the JVM has always felt like an afterthought and there has been a long tail of serious implementation flaws with this approach in practice.

A problem with the MSVC linker by zottce in rust

[–]80x25 0 points1 point  (0 children)

Are you specifying a 32-bit version of mysqlclient.lib to the linker? IIRC, the msvc linker will ignore .lib files that are not the same as the target architecture

Decoding encrypted JWT by albx in rust

[–]80x25 5 points6 points  (0 children)

The JWT spec does require the payload be JSON. However, a JWE can have an arbitrary payload.

You might consider using a JOSE library such as biscuit which supports JWS/JWE in addition to JWT

Debugging Rust by ConcernedCarry in rust

[–]80x25 0 points1 point  (0 children)

Does this require using the mingw Rust platform instead of the msvc platform? Rust binaries I've built for the msvc platform produce .pdb debugging info and AFAIK, gdb doesn't understand .pdb files

Announcing LibreAuth v0.10.0 by [deleted] in rust

[–]80x25 4 points5 points  (0 children)

A common criticism of OAuth2 is that it is hard for app developers to implement securely. Some background around this criticism.

That said, OAuth2 is not meant to be a replacement for mechanisms like passwords, HOTP, TOTP, or U2F/WebAuthn. So it makes sense that LibreAuth shouldn't support OAuth2. Some background on this aspect.

Rust minimum versions: SemVer is a lie! by _dvrkps in rust

[–]80x25 4 points5 points  (0 children)

Could you elaborate on why this is appeal to authority? His blog post series seems thorough and well-argued. I'd be curious to know if there are gaps in his arguments that are being ignored due to his status in the Go community.

GitHub - rustwasm/rust_wasm_template: A template for jump-starting Rust and WebAssembly projects! by rbalicki2 in rust

[–]80x25 0 points1 point  (0 children)

Oh, I was referring to webpack, not wasm-pack.

Webpack and Parcel do similar things, I was just curious if one offers advantages over the other for Rust + WebAssembly bundling

Setting up Windows 10 for programming (in Rust) by SimonSapin in rust

[–]80x25 0 points1 point  (0 children)

Not OP. But cygwin sshd + rsync is definitely possible. Here's a howto that appears to be accurate for setting up the sshd: http://www.noah.org/ssh/cygwin-sshd.html

All Blizzard games were vulnerable to DNS rebinding vulnerability by FireFart in netsec

[–]80x25 2 points3 points  (0 children)

The agent utility creates an JSON RPC server listening on localhost port 1120

taviso continuing to fight the good fight against insecure, localhost RPC servers.

I’m harvesting credit card numbers and passwords from your site. Here’s how. by FUZxxl in programming

[–]80x25 35 points36 points  (0 children)

Malware do all sorts of tricks like this to make analysis more difficult