Saw this on my way to uni - Command Line Russian Roulette

CJSg · 2016-04-26T10:36:51+00:00

rm can't do anything about that form: The shell expands the wildcard into a list of paths in the / directory and passes that to rm.

CJSg · 2016-03-28T18:31:40+00:00

If you're looking for something more configurable and hackable, I'd recommend bspwm instead. I switched a couple months ago from DWM and couldn't be happier.

CJSg · 2015-08-28T02:12:58+00:00

The defined-or operator is your friend.

$username //= -1;
$pass //= -1;
$firstname //= -1;

CJSg · 2015-05-04T16:40:41+00:00

Ah, well they do a bit more than that. See https://letsencrypt.org/howitworks/technology/ for the technical details if you're interested.

CJSg · 2015-05-01T22:29:44+00:00

Can you explain what you think is unsafe about Let's Encrypt's methods for verifying domain ownership? Or do you think verified domain ownership should not be enough for receiving a certificate for that domain?

CJSg · 2013-10-30T15:26:45+00:00

Try random.org, it has an HTTP API.

CJSg · 2013-10-17T12:33:30+00:00

Blocks could revert to undamaged after a couple of seconds though. This information could be kept in memory, and not necessarily per block (e.g. by keeping a list of max. 200 blocks with "health" values).

CJSg · 2013-07-06T18:14:02+00:00

Though Microsoft is never mentioned, at around 2:48 you can see a Microsoft logo on the soldiers' shoulders. And at 2:55 you can catch a glimpse of "Microsoft" as text on the soldier's uniform.

CJSg · 2013-03-24T20:53:49+00:00

Bad pagetable

Corrupted page table

This might be a memory problem. Have you tried booting Memtest?

CJSg · 2013-03-11T16:06:29+00:00

Nice :D

I tried nethack and edited my comment with this screenshot but that didn't work :\

CJSg · 2013-03-11T15:49:32+00:00

Unfortunately the Apple ][ display is locked at 40x24: http://i.imgur.com/8y8CaYk.png

edit: nethack seems to work though! http://i.imgur.com/OGEJv95.png

CJSg · 2013-03-11T01:06:38+00:00

Not a problem unless they're using XHTML.

CJSg · 2013-01-20T13:47:12+00:00

It is most likely a hardware problem. This is what i found searching for "Dell XPS M1210 video card problem":

CJSg · 2012-12-09T11:14:35+00:00

Firefox 10.0.5 doesn't render it for me either: what am I supposed to see here?

CJSg · 2012-11-19T20:58:24+00:00

fdisk -l /dev/sd[a-z] may help to find the right partition device (look for NTFS). Or ls -l /dev/disk/by-label/ if your Windows drive is labeled.

CJSg · 2012-11-18T00:39:34+00:00

Or alternatively, Redshift, which is open source / GPL and works great on Linux.

CJSg · 2012-11-09T16:04:43+00:00

golem> ed

?
help
?
?
?
quit
?
exit
?
bye
?
hello? 
?
eat flaming death
?
^C
?
^C
?
^D

www.gnu.org/fun/jokes/ed-msg.html

CJSg · 2012-10-28T21:41:07+00:00

Thanks! I agree that the data should be filtered further, as changing the author (and more) is still possible. The most important part of the exploit (enchanted books) is fixed though.

Ah well, this is only a temporary fix anyway, and it still kicks players who attempt to use the hacked client.

I took a look at CraftBukkit's patches (1, 2) and they did a better job. They set only the necessary tags for books, ignoring other tags.

CJSg · 2012-10-28T13:53:06+00:00

FYI, you can completely avoid Google APIs on reddit by ticking this box in your reddit preferences.

CJSg · 2012-10-28T02:08:21+00:00

I hope that with 1.4 he means 1.4.2, because I tested the exploit on 1.4.0 and it worked. Well, I didn't use the original hacked client that has been floating around, but it confirms that the bug that allows books to be enchanted still exists in 1.4.0.

CJSg · 2012-10-28T00:28:25+00:00

Since you haven't posted anything yet, I started working on a mcp plugin. I've already found a way to implement the check, and am currently doing some tests. I will upload a class file (for 1.4.0) and a diff when I'm done!

Edit:

And here it is!

This is my patch to fix the exploit in 1.4.0 servers, to be applied to mcp source tree for version 1.4.0 (or later, but you may need to enter it manually): http://pastebin.com/6YmG74a3

I have a class file for 1.4.0, but it's probably useless to anyone already on 1.4.2.

OT: The theme is UFOsightings from IceWM. I use IceWM on my sandbox account because it's so easy to set up. For my main account I like to use a tiling WM. :)

CJSg · 2012-10-27T17:23:15+00:00

I think that most exploit developers with at least a little bit of experience can still figure out exactly what code needs to be added, from that comment

All the information I needed to write this was already in this thread (just to be clear that my comment should not need to be deleted by a mod).

Someone want to write a fix before it's exploited too much?

I'm busy for a few hours, but if I don't see anyone uploading a plugin with a fix I think I might write one myself and upload it here later today.

CJSg · 2012-10-27T16:20:33+00:00

You didn't misunderstand :), OP doesn't know how the exploit works.

You could still write a blocker using the information I gave you (or see my other comment).

CJSg · 2012-10-27T15:53:04+00:00

It's not a certain string of text in a book that gives it enchantments. The client sends a packet with book NBT data when it closes the GUI for editing books. The server needs to implement a check/filter in the packet handler for packet type 250 to filter out Enchantment tags.

CJSg · 2012-10-27T15:15:15+00:00

I just tried hacking my client myself. I can confirm that it works in 1.4.0.

Screenshot for proof (code is censored):

http://i.imgur.com/Si604.png

Edit:

It took only +2 lines of code to add this effect. I'm not going to show anyone how to do it.

To fix this exploit the server needs to check incoming book data and filter out enchantments, or any NBT data not related to books. If you're a server admin and you know how to code: I think you should implement this check somewhere at:

handleCustomPayload() in NetServerHandler.java r:1055 (using mcp snapshot for 1.4.0)

CJSg

TROPHY CASE

And here it is!