HN user
i feel that if this was done, it was done 'over the wire', more or less on the fly, and not by wholesale appstore replacement but by mitm of internet traffic streams looking for xcode binary material and replacing it, or portions of it, transparently.
have you considered hiring an intern?
Eric Andre is pretty avant garde. In fact, there is much content on Cartoon Planet that could be deemed at least 'experimental'.
you wouldnt happen to be a pen tester, would you?
wow, i bet some of the other prolific 'security researchers' are pissed they arent mentioned. On the other hand, those mentioned are probably rethinking their disclosure and OPSEC practices, and its interesting that at least one of the names on the list isnt even legitimately a researcher. This article, if true, I feel represents a by-product of the collusion between spooks and hackers at conferences, gladhanding, coin-swapping, etc. As a former fighter, I learned that out of battle its respectful etiquette to befriend an opponent, or someone once seen as an adversary. But now I think weve seen that sometimes its better to avoid the neutral ground altogether. I now feel dirty that I originally applauded when gen alexander swapped coins with Dave Kennedy (who is a great human being). I was sucking up to the new order, and I can come clean and admit it.
"rockstar"
Doesnt really go into "how" enough for my own clickage.
the engine also used OCR to parse timestamps within the rendered trustmark image, and log when the image was past a certain amount of days. it was also possible to generate spoofed trustmarks using the same method and we did that too.
Myself and Shane MacDougall spoke of trustmarks at both BSidesLV and Toorcon several years ago, introducing a tool against some industry backlash, Oizys, to troll through all the trustmark placeholders we could find, logging when detecting a change in the trustmark during subsequent runs. Typically there were several reasons why a trustmark would change: the site was no longer secure from the perspective of the vendor scan tool (modified nessus?), or maybe the vendor was no longer under contract (the bill hasnt been paid to the vendor). The easiest thing to look for was a transparent gif where previously there was a non-transparent one. This can also be done with your favorite search engine, with some thought, but i am glad to see this getting some additional attention.
The Aquabats!! "Nerd Alert" (prolly no music video) is my quinty geek tune.
being from San Diego, i can state that SAIC is right physically down the street from any number of qualcomm campus buildings. also note, that while i am not a conspiracy guy, the security community there has always been fairly tight, a lot of the top feeders know each other, and there are a lot of interworking groups, guilds, clubs, that would easily lend themselves to partnerships, cooperations, things like that. i am just saying not to rule it out.
if length of the string is 1, this may shorten some answers, no?
No lag in working with the document, potentially signifying real close proximity. If you want to buy the narrative, that is. Heck, I can RDP in to my pc with another pc/laptop on a directly wired network, and still have splurges of x,y mouse mapping madness, often requiring a do-over (even if its just a few pixel-wide adjustments), none of that is apparent here, which suggests shenanigans, or a patched, improved RDP. Release the source! ok, that was kinda dumb.
dont torrent chunks show up out of order?
many of my friends have bedcome director level operators, where i have stagnated. while i am happy for them, i feel that maybe my personal ceiling has been hit. when i see a former colleague reaching the next level, it triggers a minor depression that takes a few days to pop out of. and when this happens i spend try to spend more time with my kid. he makes me happy above everything else.
no they arent, i am just upset that i didnt make the cut, basically lashing out at my own failure.
having been recently beset with some really bad life things, i seek solace in my son who is my best friend, inspiration, and reason for living. a few minutes with him, and i am ok for a while. but mostly after being screwed so many times in the past few years by jobs, infosec industry, ... its hard to wake up happy just waiting for the other shoe to drop. constantly looking over my shoulder waiting for something bad to happen is not a fun way to live, but at least i realize the trigger.
this is my own depression and i am going to just put it out there that you have your own depression too. take it one day at a time, get comfort from the little things.
The Aquabats "Charge!!" 24/7
antirez, i recall you from the good old days, and i was pleasantly surprised that you hadnt given up on hacking around. this is great stuff, it opened up an entire cottage industry, and i am personally grateful. i had always been a radio guy with tons of heavy gear, using clunky serial interfaces to interact with my radios. now its all practically portable and multitudes more affordable. thank you for all your work, and for transforming an entire industry. i use dump1090 when i am not tuning pirates or -trying- to capture medical pocsag/flex.
i had to tiptoe around the douchey way it was presented, without appearing to do the superior dance at the same time, cuz for once, i wasnt the one getting smoked during an interview. i actually had relevant background knowledge on the attack, crafting my own version as an exercise during a prior interview with a guy at DirecTV who was in charge of testing all their appliances. THAT guy I really wanted to impress, instead of the monkeys at <blah>HatSec
thisa is really neat. i have been currently working on a titan tunnel, hollowing out an entire world, starting last october with my kid. it really started out with attempting to drain an oceanfront, from there it spiraled into a really big pit with completely unnecessary load bearing walls (i computed nearly 600,000 removed blocks just for the pit), then a tunnel. Battling lava is the real big challenge, as well as glitch spots that cause me to run up against invisible blocks that cant be dug or bypassed.
from what i understand, the benchmark measurements for things like this are based on units shipped not necessarily sold. with that in mind, the context of the lede has an entirely different meaning.
after hundreds of infosec interviews in the past ~5 years, i leave you with this gem: "describe a 'padding oracle' attack, what versions of Oracle does it affect?" this was not a trick question. i wish there was a topic: 'worst answers you've given to interview questions?' The sheer amount of interviews i have been on speaks to my epic failure here.