HN user
ctrl+mouse wheel triggers the application zoom in most cases. However, if my mouse is over the scrollable node, it invokes the Google Chrome window zoom (so I end up with two competing zoom transforms). It also zooms relative to the upper left corner, rather than relative to my cursor (seems the app doesn't support panning?). The background dots also move and change size as I zoom (subtle but somewhat distracting).
If you're interested to explore lots of XSS edge cases, I've found this CTF to be enjoyable.
Encoding for each scenario can be quite complex unfortunately. Django does have some template filters to help.
I recommend following the documentation carefully, and using a JSON API or other similarly standard mechanism if the documented options are insufficient.
Simple JSON encoding alone is not sufficient if you put the output into a <script> tag.
<script>const user_input = "</script><script>alert(1)//"; ...
The "How to use a Python variable in an external Javascript (Django)" examples are likely vulnerable to an XSS attack, when the variable contains user supplied content.
It's important to output-encode for the correct context. By default, Django encodes template variables for an HTML context, which can allow XSS when output inside a script tag or as a JavaScript file.
Further, security of a marketing site tends to be lower priority than the product itself, and an install script should generally be secured similar to the product.
How can ToolJet relicense AGPL contributions to a less restrictive license?
The code is AGPL and accepts volunteer contributions under that license.
https://github.com/ToolJet/ToolJet/blob/develop/CONTRIBUTING...
However, in their AGPL announcement it says:
We do have a commercial license that overrides the AGPL license. This commercial license allows organizations to make changes to ToolJet and provide it as a service.
https://blog.tooljet.com/changing-license-to-agpl/#what-some...
Does the hosted ToolJet service include unreleased code, leveraging this commercial license?
Every volunteer contributor would need to agree to relicensing and/or would need to have previously agreed to assign their copyright to ToolJet, right?
NPTv6 is different from IPv4 NAT and doesn't really have the same issues.
A different solution I've seen proposed for networks with multiple ISPs is to advertise both public prefixes to the network and let each client endpoint figure out which egress to use. This seems like a worse idea though.
The most official approach is to get your own public IPv6 prefix and work with your ISPs to BGP route that to you on both links. However, home and small business ISPs generally don't offer this.
Have you implemented NPTv6 before? What routing product(s) have you implemented this with? Do you happen to have some documentation links handy?
In my experience, this capability is missing from most off-the-shelf solutions, and in the cases where it is available, the documentation of this feature is missing or incomplete.
Here's a list of processors supporting AVX-512:
https://ark.intel.com/content/www/us/en/ark/search/featurefi...
The author mentions it's difficult to identify which features are supported on which processor, but ark.intel.com has a quite good catalog.
If you put your webcam behind your video chat window, you can achieve better eye contact with your remote participants. I wonder how well a webcam can see through these screens and/or how much of a hole would be required in the rendered image to avoid obstructing the camera.
When I saw "purebred" and "AKC", my mind immediately went to:
The Bizarre Truth About Purebred Dogs (and Why Mutts Are Better) - Adam Ruins Everything
DoorDash (YC S13) | Security Engineers | Mountain View, San Francisco | ONSITE, Full-Time | https://www.doordash.com/
We're looking for multiple application and infrastructure Security Engineers. If you have experience securing webapps/apis -OR- experience securing infrastructure in AWS & Kubernetes, we want to hear from you!
Technologies: Kubernetes, AWS, Python, Django, Java, and more
Areas: Security Tools & Infrastructure, Code Review, Architecture Review, Penetration Testing, and more
Again, we're hiring multiple people; you don't need to excel in every technology and area.
I'm the Head of Security here at DoorDash (former head of Matasano Security's south bay office).
Our hiring process is three steps:
1. Introduction call with me personally (to learn more about DoorDash, not to "tech you out")
2. Application or infrastructure security qualifier
3. On-site interview
We recently closed our $535 million Series D, we are expanding from 600 to 1,600 cities this year, and hiring 250 more people as well. Join us now to help take our security to the next level as our systems evolve to meet and exceed our expansion plans.
Reach out to learn more about DoorDash, and tell me what you want to work on!
rusty.burchfield+hn@doordash.com
DoorDash (YC S13) | Security Engineer | San Francisco, Mountain View | ONSITE, Full-Time, https://www.doordash.com/
Formerly managing Matasano Security's south bay team, I've joined DoorDash as Head of Security to build our internal security team.
We are looking for application and infrastructure Security Engineers to work on a small team (<5) keeping DoorDash secure. If you have experience securing custom web applications and APIs -OR- experience securing infrastructure in Docker & AWS, we want to hear from you!
https://boards.greenhouse.io/doordash/jobs/802600
Technologies: Python, Django, Docker, AWS, and more
Interesting challenges:
* Secure the next iteration of our platform architecture
* Multiple customer types to secure (merchants, dashers, consumers)
* Many external contractors (support, menus, etc.)
* Securing customers and teams without hindering them
Reach out to learn more!
DoorDash (YC S13) | Security Engineer | San Francisco, Mountain View | ONSITE, Full-Time, https://www.doordash.com/
Formerly at Matasano Security, I've joined DoorDash as Head of Security to build our internal security team.
We are looking for application and infrastructure Security Engineers to work on a small team (<5) keeping DoorDash secure. If you have experience securing custom web applications and APIs -OR- experience securing infrastructure in Docker & AWS, we want to hear from you!
https://boards.greenhouse.io/doordash/jobs/802600
Technologies: Python, Django, Docker, AWS, and more
Interesting challenges:
* Secure the next iteration of our platform architecture
* Multiple customer types to secure (merchants, dashers, consumers)
* Many external contractors (support, menus, etc.)
* Securing customers and teams without hindering them
Reach out to learn more!
The wording is technically imprecise in a number of places. The mechanical components certainly can't move at any significant fraction of c, but they may be referring to the electrical fly-by-wire signals controlling them.
Still not precisely the speed of light, but close enough if that's what they meant.
The security of passwords at rest depends on how they are stored. Further, if an SSA database is dumped, passwords won't be the data exposure people are upset about.
What login rate-limiting, account lock-out, and password expiry policies do they have though?
Based on the password requirements, they have something like 2.6 trillion possible passwords. If your account is locked out after 3 failed login attempts, if they limit to one attempt per second, or if they have a forced password change every month, etc. there are a number of ways to tighten this up.
Their password policy is anachronistic, and this /could/ be a symptom of other issues. However by itself, it seems more like a usability issue than a security issue.
In fact, they could be attempting to discourage password reuse with other sites. That would be a security bonus if it worked (I doubt it works).
Most of these look like things I'd expect.
However, number 13 is an obvious spam link if you look at the mentions.
I wonder how HN protects against this type of spam and how this particular spam got through. The most recent mention was 4 years ago, so it would appear this particular issue is fixed in the current software.
If you buy a business type router, a similar wireless AP, and some "smart" switches, you can actually segregate things pretty well.
Examples:
Ubiquiti EdgeRouter Lite https://www.ubnt.com/edgemax/edgerouter-lite/
Ubiquiti UniFi AP AC Lite https://www.ubnt.com/unifi/unifi-ap-ac-lite/
Netgear Web Managed Plus switches http://www.netgear.com/business/products/switches/unmanaged-...
$238.98 on Amazon (before tax/shipping) for the ER Lite, UniFi AC Lite, and the GS108E 8-port switch.
The key here is to have network gear that supports VLANs and VLAN trunking (802.1q).
On the ER Lite, you setup separate VLANs (networks) for each class of device just as you said. You can control what traffic can go from one network to the others via firewall rules. So, just as you said, your laptop can access everything, while your wall switches can't get anywhere.
Each VLAN will have a number associated with it, I recommend starting at 100 or something and going up from there (the netgear switches treat vlans 1-3 as special). There are up to 4096 vlans available.
Tell each switch about which VLANs are coming and going on each port. For actual devices (eg. an IP camera hard-wired) you want to have the port Untagged with the PVID and Untagged vlan being the vlan for that class of device. For traffic between switches and the AP, mark every VLAN in use as Tagged on those ports.
Tagging puts an extra header on the Ethernet frames so that the devices on either end know the traffic is for a different network.
On the wireless AP, send all the VLANs into it as tagged. Then create separate SSIDs for each VLAN with separate credentials. I recommend hiding the SSIDs (disable SSID broadcast) for this, not for security, but for sanity.
With all that setup, you can set arbitrarily broad or specific rules on your router as to which traffic will be routed between vlans and the internet.
As said in another comment, you can use "dumb" switches still, but they won't understand VLAN traffic. So every device on the switch will have access to the same network(s).
One important caveat about separation like this is that devices normally discover each other via broadcast traffic. Since each VLAN is a separate broadcast domain, only devices on one VLAN with discover each other. This may or may not matter for your devices. For example, you probably connect to an IP camera directly rather than via discovery. However, for a Chromecast there would be discovery needed.
For many devices, they use mDNS for discovery. There is a mDNS reflector service on the Edgerouter that can be used to replicate discovery packets on another network. That way your laptop can discover devices on other VLANs.
All that said, while it isn't outrageously expensive to accomplish this, it will be time consuming to configure properly. ;-)
It looks like they are using the Song typeface for simplified Chinese (宋体). Maybe they are using this to get square symbols instead of the usual rectangles of monospace.
They could have used monospace with letter-spacing to make it square.
Try "letter-spacing: 0.1em;" to get an idea of the difference.
I would guess he is suggesting that less than 40% means you are over-spending or under-performing and more than 40% means you are under-spending (eg. you should invest more in growth).
What are the boundaries of those rights?
Is it OK for your neighborhood to protest by sitting in your house? What about in supermarket checkout aisles? or on the interstate?
These are just random examples, but in all these cases, they are breaking laws.
I think it was smart of him to discuss general discretion rather than civil liberties.
"freedom to protest is important in and of itself"
That is your opinion, and while I agree with it, police exist to enforce laws (with discretion), not to promote or otherwise engage in discussions regarding civil liberties.
I think he did an excellent job making his points without taking sides.
I was hoping someone would post this. Too bad it hasn't been updated recently, but it had a good run.
This is one of those cases where browsers are different from the spec. (BTW, the spec you are looking for is here https://url.spec.whatwg.org/)
It really depends on the browser. Here are a few test cases to consider. http://jsfiddle.net/8e525ne9/
Leading nulls used to work in common browsers. Most recent browsers don't support it. However, most do continue to support fun things like newlines and tabs in the middle of URL schemes.
While good advice, I suspect that isn't what's going on.
My guess would be that the URL is being validated with code which relies on null-terminated strings, and it's being processed/executed with code that uses a separate length value.
The empty string "" will pass a same-origin check as it refers to the current page. "\0javascript:alert()" looks like the empty string to validation code expecting null-terminated strings. However, it's a valid URL and is executed as JavaScript by code that knows the true length.
One easy way this could happen is if the same-origin check happens in C++ (eg. WebKit) and the URL fetch happens in Java.
The same problem can happen in reverse and has before. Java had a file path vulnerability where Java code would see the full path and the OS calls Java passed to would only process up to the first null. This opened up bypasses in application logic designed to validate paths.
Sunnyvale, CA - Matasano Security [WILL RELOCATE]
Matasano is an application security consulting firm. Our clients are the best companies --- and most of the largest of them. Our teams include some of the best researchers in the field.
You can read more about our hiring process at http://www.matasano.com/careers. Put simply: we hire for aptitude, we respect and appreciate candidates, and we put real effort finding good fits.
You can find out more by emailing <careers at matasano.com>. A human being who knows what they're talking about will talk to you. And I'd like to think we're fun to talk to!
For some of the flavor of what we do, check out https://microcorruption.com/
Are you suggesting the government compromised a trusted SSL CA? Or are you just saying they blocked HTTPS?
I am sure they ran some sort of simulation first.
However, "the right engine inlet's automatic control system malfunctioned".
That probably wasn't part of their simulation. While it sounds like they could have erred on the side of caution and cancelled the remaining tests after that occurred, they must have been confident in their manual control abilities.
Even if they had simulated with the inlet(s) under manual control, real life airflow and reaction times are going to vary.