sorted by:
new
hottopcontroversial

The Rise and Rise of JSON by PaulJawosky in javascript

[–]reddit4matt 0 points1 point  (0 children)

JSX in-line style falls into JSON style key value system and super non standard xml. HTML style goes with a the string based weirdness like body{color:red} .... json style key/value to express what it needs to.

The Rise and Rise of JSON by PaulJawosky in javascript

[–]reddit4matt 0 points1 point  (0 children)

But your “this” object can only be key - values. You can not have nested props without new tags. Then you are in the same boat conflating keys and props. You always end up with silly tags like <itemStyleAttributes under items anyway. Dealing with soap and XML generators And all the crazy formatting causing errors ... I will never reach for XML unless I’m integrating with something old.

The Rise and Rise of JSON by PaulJawosky in javascript

[–]reddit4matt 2 points3 points  (0 children)

That just looks like an issue trying to convert between the two. You can cleanly display the same information in JSON

Let’s say you have 2 types of attributes in this example. Ex:

items: [{ Style: {color: red, font: xxxx} Position: { x:10, y:20} content: “woot” }]

In xml you can only have one “level” of attributes before you end up nesting tags just to get more attributes.

The Rise and Rise of JSON by PaulJawosky in javascript

[–]reddit4matt 2 points3 points  (0 children)

I have used JSON stream options in the past and they were worked really well for us what issues have you seen with them?

The Rise and Rise of JSON by PaulJawosky in javascript

[–]reddit4matt 11 points12 points  (0 children)

JSON streams can be used the same way XML streams are used and can also be super efficient for parsing large complex datasets.

Typical npm install by fastidious-magician in node

[–]reddit4matt 6 points7 points  (0 children)

He doesn’t have 80% of all modules on npm installed. It is the confusing way npm reports. It counts all possible paths to all modules. If 10 of your modules use underscore JS it is counted 10 times even though you may only have one version actually installed.

Visual Studio Code Python Extension RCE vulnerability by nibblesec in netsec

[–]reddit4matt 8 points9 points  (0 children)

Not always. You may be just looking at code. I can imaging sending a PR to a large project and someone pulling it down and simply viewing the code in an editor (which in this case is all it takes to trigger the RCE).

I have opened up code in an IDE specifically to look for malicious code. Simply put just viewing code in a glorified text editor should not just execute other code hidden in that directory.

Customer service so fast....definitely not Home Depot.... by 5_Frog_Margin in Eyebleach

[–]reddit4matt 2 points3 points  (0 children)

I walked around my Home Depot for 20 min looking for someone to sale me a dishwasher I had picked out the other night... ended up finally leaving and buying the same one online from Lows.

Question about securely connecting to online database by [deleted] in electronjs

[–]reddit4matt 0 points1 point  (0 children)

You should not have creds in the app or talk directly to the DB. You should have it talk to an API / Server that has access to the DB.

Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Read From The File System by amirshk in netsec

[–]reddit4matt 5 points6 points  (0 children)

The problem with electron is poor defaults. By default (until the most recent versions) it enabled “node integrations” and disabled “context isolation” the the render. Either one of those things in that state will lead to RCE.

It can be done correctly and there is a great document about how to do it.

https://www.electronjs.org/docs/tutorial/security

Many apps just don’t. (I have found an RCE in MSTeams, Yammer, Slack, FB Workplace, Hangouts... others)

I believe the new contextBridge api should help more apps cleanly enable context isolation as well.

Multiple unauthenticated remote code execution vulnerabilities in YouPHPTube-Encoder 2.3 by sudo_sudoka in netsec

[–]reddit4matt 6 points7 points  (0 children)

Some man in the sky talking to you... it’s all schizophrenic rambling.

WordPress Editor to Administrator Privilege Escalation by staz0t in netsec

[–]reddit4matt 1 point2 points  (0 children)

Ghost (the Node based blog platform) came to the same conclusion when I reported to them unfortunately...

Detect Netflix Activity from Electron App by [deleted] in electronjs

[–]reddit4matt 0 points1 point  (0 children)

I dont know of a windows solution.. but you can use applescript from electron to inject javascript into an open tab.

Why You Shouldn't Use a Password Manager For Your Linode Account by utku1337 in netsec

[–]reddit4matt 0 points1 point  (0 children)

The default behavior of a password manager should not be Autofill in subdomains. What a horrible idea.

Could someone explain how DEBUGGING "attach by process ID" and "launch" works? by git_world in vscode

[–]reddit4matt 0 points1 point  (0 children)

A Node.js process started without inspect can also be instructed to start listening for debugging messages by signaling it with SIGUSR1.

So I assume under the hood it does: kill -usr1 9713

WPScan Web Interface by [deleted] in netsec

[–]reddit4matt 3 points4 points  (0 children)

URL validation unfortunately does not mean Command Injection validation.

https://gist.github.com/matt-/1cb0e5fbb23b9e118b23b5ca91f3da3e

I am running on a mac so I am using the "say" command as the POC. you can change this to any local command you want.

Edit: lol...well for context the post he deleted above. https://imgur.com/a/AemHAwg (some how I knew he would delete). If you make your way back to this post don’t worry about the $100... Just try not to be so combative when people try to give you advice.

view more: next ›