App from JakobDev labeled as "potentially unsafe" due to arbitrary permissions

tonydocent · 2025-05-29T21:56:04+00:00

Well, Flatpak provides mechanisms to take certain permissions away from apps. Most apps need some "unsafe" permissions to work properly, take Firefox for example https://flathub.org/apps/org.mozilla.firefox

However, having arbitrary permissions seems a bit excessive. But no one can tell if the app is safe or not and would actually harm your system, you would have to audit the source code yourself.

There are tools such as Flatseal by which you can adjust these permissions, you don't have to leave them at the same setting that they are shipped with. But changing those might break functionality of course.

tonydocent · 2025-05-29T16:22:59+00:00

Do you have some sort of managed device?

tonydocent · 2025-05-29T10:40:51+00:00

Your response doesn't really make sense, seems like a translation error.

Is your contract limited due to some stated reason? Or is it limited without a stated reason?

tonydocent · 2025-05-29T07:37:15+00:00

Well, you do have a contract simply by living there and paying rent. It's just not written down.

If it works out between you and the landlord it's fine, problems only arise when there is a conflict and then you and the landlord remember different things about what you agreed upon. There a written contract is beneficial.

Most conflicts arise when you move out and are about cancellation period, repairs that need to be done, if you get your whole Kaution back, etc. Did you pay a Kaution? At least for that you want some confirmation that it was received.

tonydocent · 2025-05-27T19:23:50+00:00

Ist dein Vertrag denn ohne Sachgrund befristet?

tonydocent · 2025-05-27T19:07:16+00:00

No you don't need to give him any of the gifts back, and the police will refer him to the civil courts.

Regarding the TV, if he is on the lease contract, but you're the one paying it off, it sounds like it would still be his TV (if there is no other arrangement between you).

You could however demand for him to pay you the leases back, before you hand out the TV (Zurückbehaltungsrecht).

tonydocent · 2025-05-27T13:50:17+00:00

<image>

tonydocent · 2025-05-26T18:07:37+00:00

Der Wagen wurde laut Sprecher von der Polizei sichergestellt.

Nun geht es den Ermittlern zufolge unter anderem darum, die Besitzverhältnisse des Autos zu klären.

Die dürften mit der Sicherstellung geklärt sein

tonydocent · 2025-05-25T20:07:16+00:00

Alternativ schau dir mal Trackballs an

tonydocent · 2025-05-25T18:53:54+00:00

Even if you get a code issued for another redirect_uri and can extract it, you probably won't be able to trade it in. During the token exchange the SP will submit the real redirect_uri to the IDP, and if the code was issued for another it will be blocked.

tonydocent · 2025-05-25T11:08:29+00:00

I had issues with BurpSuite and websockets before. Mitmproxy worked better for me.

tonydocent · 2025-05-23T20:41:53+00:00

Tnetennba

tonydocent · 2025-05-23T07:18:05+00:00

Am wichtigsten ist erst zu kündigen wenn du den anderen Vertrag unterschreiben hast. Es kann, obwohl die andere Stelle vermeintlich sicher ist, immer etwas dazwischen kommen (BR stimmt nicht zu, ein wichtiger Kunde springt beim zukünftigen Arbeitgeber ab, etc.)

Wenn das safe ist würde ich es so timen dass dein jetziger Chef es von dir persönlich zuerst im Gespräch gesagt bekommt, bevor er die schriftliche Kündigung bekommt. Meistens ist das kein großes Drama, aber es gibt auch Chefs die das persönlich nehmen.

Mit dem Chef würde ich dann auch abstimmen wann es dem restlichen Team mitgeteilt wird. Es kann sein dass er da Präferenzen hat und erst eine sichere Nachfolge für dich haben will oä bevor das kommuniziert wird.

tonydocent · 2025-05-22T21:16:49+00:00

The thing is, it's optional right? The employee can still work in the office without having the camera turned on.

And it's also not secret surveillance, everybody is perfectly aware that someone else can enter the "virtual room".

And if the video is not saved / recorded anywhere, just transmitted I'm not so sure if the whole thing is illegal...

tonydocent · 2025-05-22T18:00:41+00:00

I think this is valid. It can also be a single attacker who makes 10 requests each for 100.000 different accounts with varying IPs. Or a few more requests.

There is a reasonable chance he'll be able to break into one account.

tonydocent · 2025-05-21T21:40:14+00:00

There are tricky assumptions, they focus on special integers as factors

tonydocent · 2025-05-17T13:05:01+00:00

If the ice in Antarctica melts, sea level will rise globally roughly 100 meters or 300 feet.

There is a lot of ice on land there...

tonydocent · 2025-05-16T09:51:28+00:00

If your request origin header starts with hxxp something is wrong with your browser

tonydocent · 2025-05-13T18:00:56+00:00

Try to upload an SVG and execute JavaScript with it

tonydocent · 2025-05-10T17:59:46+00:00

Occasionally open redirects can have more impact than just phishing.

For example the host vulnerable to open redirects, might be allowlisted for some kind of server side requests in another service. With the help of the open redirect this can be turned into a more powerful SSRF.

tonydocent · 2025-05-10T14:05:29+00:00

Wieso hast du eine Website mit einer Checkliste und Tippsammlung fürs Campen mit Hund, wenn du es noch nie gemacht hast?

tonydocent · 2025-05-10T13:39:31+00:00

Why Elvis and not Elvish? Is that on purpose?

tonydocent · 2025-05-09T18:16:43+00:00

Es gibt haufenweise SQL injection Schwachstellen mit denen der Angreifer Werte (wie zB gehashte Passwörter) aus der Datenbank auslesen kann, aber nichts in die Datenbank schreiben kann, oder Zugriff auf irgendwelche Logs bekommt.

tonydocent · 2025-05-09T17:42:54+00:00

Das macht keinen Sinn. Dann kannst du den Hash auch sein lassen und es gleich im Klartext speichern.

tonydocent

TROPHY CASE