xnyhps

Will modern clients warn loudly if a server suddenly stops offering channel binding? Otherwise it is trivial to downgrade.

I don't mind XML personally, but I understand why people dislike it. For XMPP specifically you have to use a streaming XML parser, which is quite a bit more complicated than the more common case of parsing XML into a tree and then traversing that tree. Not all XML libraries even have support for streaming parsers and if you start implementing XMPP with a non-streaming parser you'll end up with something really messy.

Streaming parsers give you a stream of events like "open tag 'message'", "attribute 'from'", "open tag 'body'", "close tag 'body'" and you need to gather those and translate them back into the top-level elements of the stream. This is pretty tedious, and if you do it wrong you may end up leaking memory (if you keep the entire tree around in memory) or even introduce vulnerabilities (similar to https://bugs.chromium.org/p/project-zero/issues/detail?id=22... ).

I think Apple doesn’t want third-party developers to compose their own sandboxing rules, because it’s pretty hard to do that in a way that can’t be escaped and that doesn’t break Apple’s frameworks. They provide the Mac Application Sandbox profile for third-party developers. That profile is quite flexible, and if you’re not targeting the Mac App Store there are some ways to add rule exceptions.

If I remember correctly, the last thing I was working on was actually trying to see if GraphHopper performs better! I think I was either still trying to compile it or load a local map, I’m not sure. It has been a while since I’ve worked on this.

Also, I don’t expect it to be 100% correct everywhere, sometimes the GPS data is just not good enough or I might have traveled in a way that the map wouldn’t allow, but there were some instances I found where I thought it should’ve been able to find a match and it didn’t.

I’ve been playing around with a similar project and it surprised me how hard map matching actually is. I’ve also been using OSRM, but no matter how I tweak the settings, it never gets it 100% right.

Some examples: the GPS error is often more than the distance between a road and a cycling path next to the road, so it often confuses them.

The default cycling profile of OSRM actually takes into account the possibility of dismounting and walking with the bike. This is very useful when that is what you did, but it also creates a lot of extra possibilities. For example, a one way cycling path can then be used in the opposite direction by walking.

There’s also a limit to how many points it can process at once (and it becomes quite slow if you increase that). Should I slice up the trip in multiple segments and then somehow connect them, or is it better to drop some of the points? Still haven’t found out what the best option is.

It also helped me spot some subtle errors or missing data on OSM, but that's easy enough to fix.

The colored and animated logging parts are from pwntools (https://docs.pwntools.com/en/stable/).

The HTTP and XMPP traffic is encrypted using TLS. The proxies were used to decrypt, log and re-encrypt this traffic in real-time.

To add to this: there are two different types of Data Vaults. For locations such as ~/Pictures, ~/Documents, Calendars, Contacts, etc. a permission prompt is triggered if an app tries to access it. Other locations, such as where Mail and Safari keep their data, can not be allowed from a prompt. Those require "Full Disk Access" for third-party software to gain access, which you should give only to applications that really need it, such as a backup tool.

Anything not on those locations is not protected, so there's no Data Vault for Chrome's cookie file, for example.

The macOS version installs itself before you give it permission to install: https://twitter.com/xnyhps/status/1149630190877696001?s=21. It is basically malware.

In The Netherlands there are Veiligheidsregio's ("Safety regions", areas where the emergency services work together) which make changes to OSM to improve the routing for emergency services. For example, Veiligheidsregio Twente is quite active.

Last time I looked at it, none of the routers for OSM were good at routing over areas in OSM. For example, when planning a route on foot over a large square, the route often follows the outside edge. This becomes even harder when the area contains "holes" (i.e. a multipolygon). So for canals it could work, but if you need to cross a lake with an island you're in trouble.

Similarly, MySQL Connector/J also used to attempt to deserialize binary data that looked like a serialized Java object (CVE-2017-3523). Doing this with untrusted data can often be used to obtain arbitrary code execution. Connecting to an untrusted server does not appear to be a use-case that received enough attention.

Heap buffer overflow in the network stack allowed for sending ICMP packets that would crash devices.

It's not receiving an ICMP packet that causes the crash, it's when sending an ICMP error response packet. ICMP error packets can be generated in response to any type of IP packet, for example "host unreachable" when using UDP. These packets copy the original header of the packet which generated the error, which is where the out-of-bounds copy is.

I understand why the author doesn't want to give full details, but in this case it leads to a lot of misunderstandings on how it works.

That depends on the country. You lose Dutch citizenship if you have dual citizenship and don't live in The Netherlands or renew your passport in 10 years.

I'm still wondering how to deal with password changes in that scheme. If you change the salt, you reveal the existence of that account and the fact that the password changed. But keeping the salt the same seems unsafe as well...

Legacy protocols such as FTP and IMAP don't have that luxury, though. There's no way to run a password stretching function on the client.

IMAP uses SASL, which can do client-side stretching by using SCRAM-SHA-1. I don't know how common they are, but there must be some servers and clients that support it.

Downside is that upgrading the mechanism becomes hard, and it's difficult to integrate it with an existing user database with hashed passwords.

SHA-2017 had a really cool badge: https://wiki.sha2017.org/w/Projects:Badge. 2.9" e-paper display, ESP32, 1000mAh LiPo battery and firmware with an online "app store" supporting apps written in micropython.

Sadly, there were only a handful available after the event (for about €30). I'm hoping someone continues with the design, because I can think of quite a few applications, but I'm worried about breaking it.

The affected certificate as confirmed by Comodo: https://crt.sh/?q=278968925. Note that it wasn't logged until about 2 hours ago. CT logging will become mandatory at some point, but not yet.

I highly doubt anyone will be able to answer this, but I'm curious if this law would also apply to iOS apps. Of course, copyright on an app can't have expired, but it could be developed or sponsored by the Portuguese government. If Apple were forced to not apply DRM to one app, how far would they have to go? Allow sideloading of just those apps? That would open a can of worms. I highly doubt they'd do all that work, they'd probably just pull those apps and ban them just like how GPL licensed code is.

That one is even more malicious, it uploads contents of your ~/.bash_history and system profile. But at least it notifies you afterwards...

I think github.io is a good example of where this can be very useful. Users have a lot of control over the content of their pages, but it is undesirable to allow them to get a cert for username.github.io. Previously the only defense would be to block all files or content that could be used for domain validation or specific blacklisting by all CAs. Now GitHub can just say "no one can generate certs for this domain".

And there is a pretty cool open data set for current and historic traffic information (speeds, travel times, etc): http://www.ndw.nu/pagina/nl/103/datalevering/120/open_data/ (page only in Dutch).

Suppose I include 'ü': LATIN SMALL LETTER U WITH DIAERESIS in my password. I switch to a different browser/OS/language and now when I enter "ü" I get 'u': LATIN SMALL LETTER U + ' ̈': COMBINING DIAERESIS. I can't log in anymore, though what I do is identical and defined to be equivalent. Especially if the password is hashed before comparing it, you can't treat it as just a sequence of bytes.

You don't need to use IDNA for this, though. There are standards specifically for dealing with Unicode passwords, such as SASLprep (RFC 4013) and PRECIS (RFC 7564).

That's the point, it's about bypassing Content-Security-Policy, so you musy already have something like xss. It's more like "well, assume you have code execution inside a sandbox, then you can break out using THIS".

Re-encoding is not enough to prevent attackers from constructing polyglots, see https://www.idontplaydarts.com/2012/06/encoding-web-shells-i...

Placing shells in IDAT chunks has some big advantages and should bypass most data validation techniques where applications resize or re-encode uploaded images. You can even upload the above payloads as GIFs or JPEGs etc. as long as the final image is saved as a PNG.

An attacker will likely be able to figure out the exact re-encoding you apply, so unless you add some form of randomness, the attacker can work backwards to get the payload they want included.

FYI, the first part isn't new. Safari already uses mDNS to find webservers on your LAN. For me, this is also supported by my printer, so I can just go to the Bonjour bookmarks to find the admin interface without having to remember its IP address.

What is new (and what appears to make Mozilla's implementation incompatible) is that they are adding a layer of UUIDs to ensure each service gets a separate origin. This ensures that, if you switch between LANs, an open tab for one device can't interact with a device on the other LAN with the same name or IP address. Makes a lot of sense for the security of IoT devices.

Correct. What might be interesting to add to this: you can't query Certificate Transparency servers by certificate. You can query them by index or by using an SCT hash, but if you want a definitive answer to "when was this certificate first logged?" you'll need to process the log completely. CT is not designed for live-checking of certificates, only for monitoring by domain owners.

A number of SCTs (basically statements signed by qualifying logs that they saw that certificate at time X) must be delivered to the client during the handshake. Those can be embedded in the certs (by using pre-certificates), included in the TLS message directly or as part of a stapled OCSP response.

I'd expect HTTP, DNS based or email to {hostmaster,postmaster,etc.}@domain validation to be more common than validation based on WHOIS data. There are probably very few domains for who only the WHOIS based validation is doable.

"Will step down", according to his own post on https://groups.google.com/d/msg/mozilla.dev.security.policy/....