whs

I believe the root detection is a form of security-by-obscurity. Bank applications are required to be obfuscated, so you can't simply statically decompile them. The other way to do that is to run the app and set runtime breakpoints, which you can't do on production firmware.

Once the application is decompiled the attacker then can proceed to pentest the bank backend, or find any frontend-only security measures to bypass. One attack I heard in local news is not even a hack at all - they simply make script that use the mobile application API to automatically move money between sock puppet bank accounts. Once a victim get scammed, the money move around quickly. For privacy banks do not provide information about unrelated cross-bank transfers so even cops can't easily trace the multiple hops. That specific bank got in the news for that "weak security"

I remember how I flashed my Nintendo DS.

In the back of the device there's a sticker over a screwhole. You'll need to poke a screwdriver in there, but inside is not a screw. It's an electrical contact to make the ROM read-write which your screwdriver needs to bridge, and stay bridged while the firmware is flashing (It is harmless if the contact is loss in the process, but I don't know if it would be safe to abort at that point) Pretty hard to convince someone to do that process, yet doable by anyone with a flathead screwdriver.

I guess nowadays it become Samsung's e-fuse where if you flash it blow an e-fuse and the status of the fuse is now detectable with software. Then apps can refuse to service people just because the custom firmware fuse was blown.

I use it for Thai result (and sometimes English result relevant to the Thailand region). I found the experience similar to Google. Not once that I need to !g, and the times I do wanted to check Google were producing similar garbage. It still doesn't filter blogspams (where a business website would produce low quality content to appears in keywords) nor pushing small websites - forums and personal blogs are almost non-existent in both result pages, even though it might have been popular result when searching for pre-social media era content.

The deranking & blocking feature doesn't help much as it only sort the result. There are multiple "web portal" that may be useful in one category (eg. entertainment news, travel content) but producing clickbaits in other category (eg. local news) so domain-wide blocking isn't exactly usable here.

I saw "fixed function pipeline" and immediately think of RTX Remix. This could've been raytracing modded in to add Turbobloat lol

I wonder if it's a recent rewrite. My GlobalProtect on PAN-OS 11.0 is unusable after 11.0.2 with the entire company unable to connect. The latest release presumably fixed it, but Linux clients still unable to get a stable connection.

I'm trying to build server rendered websites, but I find React (or other SPA-API systems) hard to resist:

- Form is hard. Doing it in backend make it even harder when the form is complicated. For example, a form with tab needs JS to operate and you need to signal the JS which tab the error is.

- If you're using backend form framework, you don't have control over the HTML unless you learn the hook points of it (do you add attribute in code, or in template? Where is the default template to override?) Compared to frontend framework where you can paste the CSS framework's example HTML.

- I wanted to build a new user wizard, which should be easy with a frontend framework as you can easily store incomplete state in memory. If not using JavaScript one would have to store the state in the untyped session variables, add hooks cluttering the HTML template, etc.

- Progressive enhancement is easier when you have to write the code only once. If there's a table and you want to refresh without refreshing the page, in React you just call the data fetcher again. In HTMX your backend needs to have a "full render" endpoint and a "table only" render endpoint. If you're using jQuery you might as well write the table loop twice in the backend template engine and in jQuery.

- I haven't see any good backend framework (be it Django, Laravel, Symfony, Gin) that has similar server-rendered frontend component like React. Many frameworks believed that logic should be precomputed in the view layer and the template engine should not be turing-complete.

I was thinking about moving to SSR-rendered SPA, but I know of no Next.js-style library for any frontend framework that actually allow form submission without JavaScript AND progressive enhancement with JavaScript using the same code.

In that link "The company requires car owners to grant permission on the cars’ touchscreens before Tesla collects their vehicles’ data"

The risk here is they intentionally make it incompatible with Valkey, similar to how Elasticsearch client libraries complain when a newly added slogan header is missing

Not OP, but I also tabs. Usually I set tab to 4 spaces as 2 space is too little to clearly see the indentation, but in frontend projects usually I'd need to set it to 2 as otherwise the JSX layout would easily overflow horizontally. JS also prefer callback-style code that requires another indentation, which might not always be possible to replace with await.

How does it read the value from the coins or dices?

Sounds like zero-sized types in Rust, where it is used as marker types (eg. this struct own this lifetime). It also can be used to turn a HashMap into a HashSet by storing zero sized value. In Go a struct member of [0]func() (an array of function, with exactly 0 members) is used to make a type uncomparable as func() cannot be compared.

We do both, but the enterprise plan isn't as unlimited as the self service plans so we need to limit them as well. (It's not a large site but the Cloudflare contract is for every affiliated companies - it is funny when we serve news of ongoing Cloudflare outages on Cloudflare Enterprise)

>For the trouble of giving up their baggage allowances, passengers were handed a free round trip plane ticket to Hawaii.

Doing that today would likely get people arrested for drug trafficking

My company runs a tech news website. We offer RSS feed as any Drupal website would, which content farm just scrape our RSS feed to rehost our content in full. This is usually fine for us - the content is CC-licensed and they do post the correct source. But they run thousands of different WordPress instances on the same IP and they individually fetch the feed.

In the end we had to use Cloudflare to rate limit the RSS endpoint.

Two comes to mind:

- Cloudflare had a "captcha" POC called "Cryptographic Attestation of Personhood" where you need to use a FIDO-approved token. It's reusing U2F just for the attestation part only. I don't think it ever go to production as most people don't have a token (but perhaps in the future hardware-locked passkey may serve as one...)

- Okta do have an option to enforce attestation. By default it is off, but in my Okta production I can limit the list to FIDO-approved vendor only, or to even a subset of them. They also have a beta feature flag for blocking Passkeys but allowing physical keys (which they do not guarantee success)

I wish I could use internet banking to replace bank apps. The banks are slowly shutting down their internet banking or requiring their app to perform face recognition. This is probably because online gambling and scammers were running automation on the website to move money quickly. The scammers moved on to cracking the mobile apps and instead of adding verifications the banks just start cracking down on debugging techniques like blocking VPN and debugging (or sometimes having Developer Option is enough to trip the block).

The software is not FOSS anyway. The README file says that you can't redistribute self-compiled APK. That is also reason Shizuku is not on F-Droid, as both F-Droid and Shizuku authors don't trust each other's APK.

The FBI famously wanted an iPhone unlocked in the third way.

All the phones I used were Nexus and Pixel. Pixel 3a XL was my last Pixel and now I switched to Sony. They're expensive - they're priced without care to competitor's pricing and sold at Sony stores only. Most people in the street wouldn't know Sony still make phones today.

I don't think I'll go back to Pixel until Sony drop the headphone jack as well, or someone invented a lightweight pluggable backpack that charges everything inside. Until then I'm not touching the backpack when I'm at home - the wireless mouse use disposable AA batteries, my portable battery stays uncharged, the laptop is charged while using it.

Also on Bluetooth, the phone connects to the Tesla and the Samsung soundbar with SBC as the only option. The only thing that use something else is my DAC with Sony's own LDAC. There's nowhere telling you why it doesn't use better codec. Wired always deliver the best quality your hardware could.

It could be designed that doing so will generate some alarm to other people. For example, the backdoor do not exists and it has to be developed, so the attacker has to keep them hostage for some period of time and loved ones may report a missing person. The software then might have to be signed with a key that generate alert to the whole engineering team, which someone else in the company may investigate the unauthorized release as cyberattack. Perhaps the release signing key is physically stored in the office (eg. Yubikey) which also require the attacker to perform a heist in the office.

Surely some three letters organization probably could pull that off, but it add risk to their operation that the operation could be leaked.

As someone who worked in a company during breaches, I'd say if the company is willing to not getting another breach it's a unique learning experience. You'll see company standards stricten, more pentests and perhaps at least for 6 months more emphasis put on product security than time to market. A good time to also suggest tech debt to be fixed related to security.

I had similar thought and I think that doesn't work well in practice:

1. If I have to get back to this project several months in the future, it might be a lot of trouble to bring the fork up-to-date. The fork might not have new features, security updates, compatibility upgrades that I want. The upstream may have rewritten the code, making my fork redundant or refactored it and I have to rework it again

2. I think it is in bad taste to submit PR without intention of getting it merged - it create open ticket that maintainers could perhaps never close and have to sort through.

My Chromecast with Google TV on Apps only mode recently has a full screen, undismissable ads of a YouTube show on the top of the launcher. It is not present if you don't scroll up, but the settings button and account switcher is up there.

I wish it is a list of <who, what, which>. Right now you can't even get a comprehensive list of people who can access this S3 object. Add assume roles, conditional access, cross account, per-service object level policy into the mix I don't think it's even actually possible for AWS to implement that.

I found GCP's access control to be much simpler but more limited than AWS. They're adding complexity though with conditional access. In GCP the "who" in most case is an email (Google Account, Google Groups, service account)

In Rust most function take a reference to its argument, which means the ownership is shared. However, you can also pass non-reference to it which indicate that you wish to transfer ownership to the function (of course the caller must be the previous owner). Once the function take ownership there's no way to take it out unless they returned it, so it achieve the effect you're looking for.

I heard some HTTP library used that to expose a state machine, so functions that cause HTTP header to be sent will take ownership and return a new value which no longer expose HTTP headers setter methods.

For freeing memory or resources, the recommended way to do it is in RAII-style, with custom Drop implementation that will get called when the ownership is dropped instead of explicit close() or free()

My company need deterministic encryption to search encrypted data.

Turns out the people who wrote the in house Go library didn't have any idea. There is no non-deterministic encryption function because that might be too complicated for non-senior engineers (afterall they wrote most of the actual application) to correctly choose.

The first version use AES-CFB. There's no authentication. It's probably copy pasted from a public Gist and nobody ever commented on it that it is insecure. I wonder if it was actually intended to be the non-deterministic version, but the higher level wrappers do not wrap this function so people didn't actually use it.

The second version use AES-GCM with nonce derived from the key and AD. Since nobody understand why AD is needed, AD is always nil. Essentially there's ever one nonce.

I think the problem is that many senior engineers know that encryption use "AES" library but the Go standard library doesn't tell you how to use it securely.

Surprisingly this mistake also happen in our Java stack that was written by a different team. A senior engineer did notice and quietly moved away from the vulnerable version without telling the Go version.

I wrote a POC to decrypt data of the Go version, then wrote the third version, perhaps it will be open source soon. The new library only implement envelope key management, encrypted string wrapper and ORM integration. The rest is Google's Tink.

In my company we use reseller billing as AWS do not have a local billing entity. The reseller owns the organization's root account and we do not have access to it. Every subaccount creation require a support email to the reseller.

I heard from some sites long ago that users with 2FA are enthusiast, and disable account recover to prevent social engineering attacks for people who care about security. Today 2FA is the new normal, often mandated by organization. I think it invalidate the previous believe and account recovery should be a configurable option not tied to 2FA.

It'll work but my Minecraft server sees everyone as 127.0.0.1. After disabling TS_USERSPACE I see each person's Tailnet IP. Tailscale doesn't provide this information anywhere (since their node name is private), so once I have their IP address I can also use `tailscale ping` to ping the IP and see whether the connection is going through relay or direct, which is helpful when debugging their latency.

My users report better latency, but I doubt it.

I run my game servers using `network_mode: service:tailscale` and every time the game server needs to restart (or crash) Tailscale will permanently lose connectivity and needs to be recreated (restart doesn't work).

To solve this problem I add another container which should never need to be restarted, and both the game and Tailscale use the networking of that container. This is also the exact use case of Kubernetes' pause containers, so I just use the EKS pause image from ECR public gallery.

Another tip I'd recommend is to run the Tailscale container with `TS_USERSPACE: 'false'` `TS_DEBUG_FIREWALL_MODE: nftables` (since autodetection fails on my machine) and give it `CAP_NET_ADMIN`. This allow Tailscale to use tun device instead of emulation, and it supposed to be more performant. But the clear benefit is that the game server will see everyone's Tailnet IP instead of 127.0.0.1.

In Thai: https://blog.whs.in.th/node/3676