@Xander didn't notice but now that you mentioned it, I clearly remember it having coloured boxes next to site names, and that's gone now. A bit strange decision IMO maybe it's some transition thing?
@Xander Oh yes that's changed too, you have good visual memory :) I just use my SE accounts page for fast links to all sites (no Careers 2.0 or Data Explorer there, tho)
hmmm looks like RBLs are still under attack it doesn't pass a day that I don't see one of the big ones down or utterly slow... today it's UCEprotect that appears dead
my facebook profile JUANITA VAN DER WESTHUIZEN - [email protected]
The is a page on FACEBOOK allegedly showing who is checking our your profile, I entered it and now I am blocked this message keeps on coming up please assist as I need to access urgently to contact my family. Your prompt ass...
we need a mod or high rep members to approve suggested edit,... it's disclosing PII (real name and email address), and there's other things wrong with it too I'm sure LOL
@ManishEarth I requested it. ;) Anyway, some people simply trust authority too much, it's how they're programmed... and this poor woman probably saw IT Security in Google and thought "hey there's a bunch of guys that will help me out and I can trust". What she doesn't know is how long ago any of us saw tits and how desperate we are to see any.
@RoryAlsop Thanks. In the mean time I've got her address, phone #, photos, bra size (rough estimate), marital status,... if I was single and desperate I'd call her on her phone and suggest she changes her last name with a bit of my help too :)
Not that I'm interested, mind you. But with some people all it takes is a bit of googling, and you've got it nearly all. She should consider herself lucky it was Facebook that prompted her something might be afoot with her sharing habits.
@LucasKauffman yeah well at the moment I think they've got price matching in place for AWS so it should be reasonably priced and the management interface is quite nice..
what is this constant gpu throttling? it's not overheating, seems to have enough voltage, and even at stock it seems to be throttling itself.
gpu-z claims an actual clock speed that is different from what Kombustor claims the core is actually running at - and shows a substantial downthrottle.
also, I can easily push it past that 1150 mark, stable and all, but benchmarks dont change - and after the throttle, kombustor claims the actual speed doesnt change (1149 mhz).
but if I set it to 1150, it downthrottles even further. to get it to run at 1150, I need to push it a few mhz past that.
It seems like the gpu clock is not a similar mechansim to cpu clock, as I am familiar with.
@TildalWave yeah if you follow @bsidesLondon or @geekchickUK they should have the details. My slides are up on Prezi (info on our blog hhttp://blog.scotsts.com/?p=615)
@RoryMcCune How familiar are you with mutable XSS attacks? Basically an XSS attack where the markup looks normal so it gets pass filters but the browser interprets it wrongly.
@AviD I don't recall the exact examples he used. That will have to wait till the slides are up online. It's related to how the browser parses innerHTML.
browser differences of interpretation are a rich source of things like XSS. If you look at the vector list on html5sec.org a lot of the vectors are browser specific
@TerryChia interesting. I want to say "it's just DOM XSS", but it reminds me too much of SQL Smuggling.
Similar situation, the payload is not in a malicious state at the time of filtering, and it relies on the target processor to transform the text into malicious payload.
However I think he misused the term "mutable", he probably meant "mutating".
some would see it as "just" another form of evasion, but this does go beyond that. It's still a subset of DOM XSS, though, but a special one.
I think the big deal is just how many web applications will be vulnerable to this - basically any web application who does not know of this issue and take steps to prevent it.
one thing I think he missed in his statistics, of those millions of instances of sites that use innerHTML - how many were already vulnerable to "regular" DOMXSS, without needing his tactics?
yeah a lesson I learned once I had a tablet and started Interneting over breakfast is, avoid all reddit WTF posts and any dangerous clicks to shortened URLs
@AntonyVennard I always liked the US one where people put "tired of the governments sour policies, try lemonparty.org " onto political blogs (BTW EXTREME Warning do not go to lemonparty)
@AviD Supplying Corrupt Or Treacherous Target Pages Allowing Conscience Killing (SCOTTPACK). Dammit @Scott, why does your name have to end with a K? That makes making a CRIME-esque name for this attack so hard!
@RoryMcCune we have a corporate phishing training team that send out "safe" phishing emails to educate, I wonder if I could convince them to change the links to a "SCOTTPACK" site. They'd quickly learn not to click links...
@AviD yeah some people have a weird reaction to that vid, but most people are pretty horrified... some of the ones with young guys who are trying to act hard are the funniest :)
@AviD yeah some people have a weird reaction to that vid, but most people are pretty horrified... some of the ones with young guys who are trying to act hard are the funniest :)
@AviD One time for funsies I added @RoryMcCune to the list of room owners so we could pass sooper seekrut messages by deleting them immediately after posting.
We have an HTTP proxy that requires authentication, and the username password are the same as the ones we use for a billion other important things in the uni
When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc.
If your browser is configured to use a web proxy, the current HTTP protocol supports a CONNE...
When browsing to a website over HTTPS, the web browser typically does a lot of work in the background - negotiating a secure channel, validating the site's certificate, verifying the trust chain, etc.
If your browser is configured to use a web proxy, the current HTTP protocol supports a CONNE...
