The DMZ

A: Is an XSS attack possible under these constraints?

9:15 AM

Am I missing something? It seems to me that this answer is completely wrong, but it has 3 upvotes? (well, 2 now):

Yes, XSS is possible. The first injection into src is secure, as " is HTML encoded, which is a proper defense against XSS in a HTML attribute value context. The second injection however is insecure, as it takes place in a JavaScript attribute context. Here, HTML encoding is not a proper defense a...

nobody

10:14 AM

@ConorMancone Why do you think its wrong? It works

It wasn't working for me when I first tried it. I figured out my confusion though

10:51 AM

@J-- How did you resolve it?

Ah shit :/

Anonymous

So basically.

Anonymous

On this PCB there is a reset pin, usually. But I have version that doesn't have a dedicated reset pin, for whatever reason.

Anonymous

So I had to find the documentation for the microcontroller and short the reset pin on the controller itself.

Anonymous

Then that would put it into the "searching for firmware" mode, then you just flash it over USB

Anonymous

Now I programmed a software reset back in so if i wanna reset it without using the pin i can just hold down a key combination

Anonymous

11:03 AM

but because i trampled the firmware the first time i didnt have the reset key combination anymore

12:10 PM

Ah, nice. And what is the end goal? Like, what can your keyboard do differently now?

Anonymous

It is a 60% keyboard so there are no arrow keys.

Anonymous

I needed to flash a new firmware so that I can hold fn + wasd for arrow keys.#

I see

Anonymous

As well as a few other keys which I didn't have that I use :D

I mean you could have just gotten a bigger keyboard :D

Anonymous

12:11 PM

Haha, no. I really like 60% keyboards.

Anonymous

I've used 60% keyboards for most of my life at this point.

Anonymous

It's just depending on what PCB you get, depends if it comes with pre-programmed arrow keys on fn or not :D

@JourneymanGeek swap is good unless you are on a virtual machine, as it leads to a phenomenon called "double swap": the hipervisor detects some page wasn't touched in ages, so it pages it out. Later, Linux wants to swap something because swappiness is at 60, so it looks at the MRU table and swaps out something: that page that the hipervisor swapped out already.

linux references the page, there's a page fault at the hipervisor, the guest is suspended, hipervisor retrieves the page from storage, moves it to RAM, resumes the guest, puts the page on the recently used pages. Linux swaps out that page.

now RAM is used by a page that isn't used at all, and another page that could be in use is in swap by the hipervisor because of that.

and you got this: pages on RAM on hipervisor are on swap in Linux, and pages that Linux thinks are on RAM actually are on the swap on the hipervisor

@ThoriumBR My face while reading this:

- hipervisor wants to run lots of guests, but have no memory for everyone, so it takes pages from guests and puts on disk
- linux wants to run lots of programs, but have no memory for everyone, so takes pages from processes and puts on disk
- both activities are independent and can run at the same time
- hipervisor moves one page from a guest to swap disk
- guest wants to move the same page to his own swap disk, and it references the page to mark it as swapped out
- page is referenced, so hipervisor needs to get it back from disk. to do so, another page from another guest is moved out to ma…

the hipervisor here is IBM z/VM, not hiper-v... it can run thousands of guests at the same time... I ran a z/VM with 64GB of RAM and had around 100 guests that had 300GB RAM combined, back in 2006...

12:33 PM

@MechMK1 lol, that's my first thought :)

But then again I've had countless developers try to convince me of the importance of IDEs, while I refuse to give up my text editor, so I don't think I have much room to complain

2 hours later…

Anonymous

2:59 PM

Steady, steady, oh God, Jenny, Jenny.

Anonymous

I love this song. emos rise up.#

Q: Malware installed by grabify link?

7:23 PM

The only thing I know about grabify is that everyone who opens a link in it immediately thinks they are hacked. What is grabify for, exactly?

I recently clicked on a grabify link and I think it might have installed a virus as well? The link was to a soundcloud page. I put the link into this website https://sitecheck.sucuri.net/ and it said that it's blacklisted by McAfee for having "Potentially Unwanted Programs". To check I made a gra...

malware ip

@ConorMancone An IP logger and URL shortener

@MechMK1 An malware installer!

Basically

I run a website that can install malware on any machine!

This needs to be one of the memes of info security...

can i has ip address? i haxs your bank!

(nah, not good enough)

"The hacker has my IP address"

2 hours later…

9:11 PM

I was chatting with a friend about the "cellebrite" tool to read data on locked phones, and recover deleted files too

what if there was some way to adding a symmetric key to the inode, and encrypting the file with that key? when you delete the file, wipe the key from the inode, sync, and mark the file as deleted... no recovery tool could recover the file after it

what do you guys think?

Hmmm...let me think

you can keep the filename in clear, there's no need to protect it. but the file contents would be encrypted like LUKS do, but at a file level

Seems reasonable, except that performance is going to be horrible

Doesn't android do a per-file encryption?