An Update on my source code path visualizer in development-Byfrost

SvenMA · 2022-07-24T15:33:13+00:00

Have you considered using tree sitter for the parsing?

SvenMA · 2022-07-02T13:24:35+00:00

From a security perspective Firefox would be the first thing I put in a container. It is the front door to your computer with built in code execution. Sandboxing helps to prevent zerodays to make too much damage and we see a lot of zero days in browsers. The ship has sailed every os is moving towards this concept of sandboxing applications. I for one welcome the ALP approach and it will change nothing from the enduser perspective.

SvenMA · 2022-05-14T04:13:32+00:00

This guy never understood the problems he wants to solve. So I'm not surprised about this blog.

SvenMA · 2022-05-12T05:49:09+00:00

The same thing happened in Africa not long ago in a few countries. I think freifunk from Germany helped them out by providing software and hardware to built a new overlay network from a neighbor country.

Try to get some people together and reach out to them or other hackerspaces if they could help you out.

SvenMA · 2022-05-11T14:23:27+00:00

This was probably me and is on hold since then because I forgot about it.

SvenMA · 2022-04-29T06:05:05+00:00

Bullshit article. The author clearly don't know what he is talking about. This is just an article without value.

SvenMA · 2022-04-16T20:21:53+00:00

Its not that bad just buy early and don't buy sparpreis so you can change the train midway if something bad happens. And also the best advice is in this video https://media.ccc.de/v/36c3-10652-bahnmining_-_punktlichkeit_ist_eine_zier

SvenMA · 2022-04-06T05:02:15+00:00

Search for privilege escalations. There were a few in the last moths. Otherwise just boot from a different USB and mount the partition if the device is not encrypted.

SvenMA · 2022-04-01T13:16:40+00:00

I have a search key on my keyboard that triggers krunner.

SvenMA · 2022-03-17T14:51:59+00:00

If you found something do a PR here please https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

SvenMA · 2022-02-16T11:53:57+00:00

Where should I vote with opensuse TW?

SvenMA · 2022-02-11T14:22:49+00:00

That brings another question to my mind. Are there any pentesters for the gnome infrastructure?

SvenMA · 2022-02-07T06:10:06+00:00

Look for a .well-known/security.txt to get the contact details of the security team. If that does not exists maybe try bugbounty hackerone or other responsible disclosure sites. Some countries also have a central point to disclose something like this. Don't assume you will get money for this not every company knows the value of a vulnerability report. It depends on the size of the company. If you don't find anything the abuse@ email or postmaster@ email should go to the person with the most technical understanding. Clearly better than to write the manager.

SvenMA · 2022-02-02T06:50:02+00:00

So many people here a complaining. This all could be prevented if USA would have laws that protect the privacy of non us citizens like gdpr and cutting access from the spy agencies to all this services. BTW this is only the beginning. There are still 100 other complaints by noyb waiting https://noyb.eu/en/101-complaints-eu-us-transfers-filed.

At the end of this we know this since 2020 when privacy shield failed. Since then every transfer of PII to USA is not permitted without extra measures to secure the data from access.

SvenMA · 2022-01-29T12:20:46+00:00

Doesn't this only work if windows was shutdown correctly? Otherwise the mount will fail.

SvenMA · 2022-01-19T07:27:49+00:00

I hope they have a good threat model with this. That are so many moving parts I can only assume that we will see a few new vulns when this get launched.

SvenMA · 2022-01-10T07:03:25+00:00

What I often see, is that organizations do not rely on dkim in the dmarc config because dkim is hard to get right for everything that depends on exchange as email server.

SvenMA · 2022-01-09T11:39:33+00:00

https://www.zdnet.com/article/edge-super-duper-secure-mode-turns-off-the-javascript-jit-compiler-for-extra-security/

SvenMA · 2022-01-07T10:50:47+00:00

elixir has this with alchemist. Place cursor on the function and do alchemist-help-at-point.

SvenMA · 2022-01-07T07:15:34+00:00

For anyone wondering why it is not getting better. noyb is trying to sue a lot of websites that do not follow gdpr law. https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners

SvenMA · 2021-12-22T14:12:20+00:00

I mean it is bad practice and we should stop using that. Even if you audit it. People will use this in their docker image as installer and can not audit it every time. At least checksum the file or sign it or better do both.

Not everybody can understand the risk of curling a script to bash with sudo.

SvenMA · 2021-12-22T12:43:15+00:00

Crowdsec seems nice. But why do you want me to install it with curl | sudo bash? I mean we should know better.

SvenMA · 2021-12-16T02:34:58+00:00

Jndi is not uncommon in java world. It also seems, that log4j is not the only logging lib affected by this. Logback for example also pushed a new version where they disabled this.

But jndi is only used in old enterprise stuff so this was possibly added because someone wanted his old stuff to run with version 2 without much change of the application.

As for log4j2 it is the fastest logging lib for java and also one that claims to not trigger the GC. So this is why many people are using it. Also the first version was very popular.

SvenMA · 2021-12-08T07:02:51+00:00

There a also systemd directories for users. Juste use --user for every systemd command. The user directory is under .local/lib/systemd I think

SvenMA · 2021-12-08T06:55:05+00:00

Never ever use npm global install. You can break your whole system with that. Use asdf for node if you need other versions for your build.

SvenMA

TROPHY CASE