mgliwka

>This can lead to a replay attack where an attacker substitutes an archive with an earlier—unmodified—version of the archive. This would prevent APT from noticing new security updates which they could then exploit.

>To mitigate this problem, APT archives includes a timestamp after which all the files are considered stale[4].

Let's take a look at the repo spec then:

https://wiki.debian.org/DebianRepository/Format#Date.2C_Vali...

> The Valid-Until field may specify at which time the Release file should be considered expired by the client. Client behaviour on expired Release files is unspecified.

“Should”, “may”, and unspecified behaviour.

Rails Turbolinks utilizes this technique for iOS: https://github.com/turbolinks/turbolinks-ios

Video explanation/demonstration: https://youtu.be/SWEts0rlezA

Try this: http://buckets.grayhatwarfare.com

This bug even haunts Azure Functions: https://twitter.com/troyhunt/status/1059254759293542400?s=21

Can you disclose the contents of your email here for the wider public?

It’s pretty easy to acquire blocks larger than /64.

You can look it up by searching for "Diceware".

https://www.packer.io/ - allows you to create images for a lot of platforms.

At the first place I worked at: Zip Files. $customername-YYYYMMDD.zip. "Branches"? Easy. Just create a new folder. Merging? WinMerge is your friend :-D Deployment was sending a Zip File with DLLs to the customer. Obviously no build system, but built on the dev's local system.

Thank god I could convince the team to move to SVN.

If you can fix it in the morning, why bother at all? As long as it's not an common occurrence, it should be fine, right?

https://github.com/intel/hyperscan/ implements this along multiple regex matching and a pcre pattern compatible engine (chimera).

Then visit fortune.com, it’s one of those sites.

I have to disagree with the statement, that those techniques are not being used in the wild. I‘ve observed a porn advertising network delivering some js once, which opened a third-party domain served pdf with cookies in the background and then closed the popup immediately again. I was wondering what that was about. Now it’s clear to me.

What's the nature of your data? Is it static or dynamic?

That's been exactly my experience. Most time is spent connecting or waiting for the server response (TTFB). Using an async I/O event loop approach in combination with EPOLL/KQUEUE you can handle thousands of concurrent connections. You then push the response to your worker nodes, which process the data in a multi-threaded fashion. Stream Processing Frameworks like Apache Spark or Storm work great for that.

Crawling may be cheap, but you also want to save that data and make it queryable without waiting minutes for the response to a query. That makes it way more expensive.

GitLab exposes a list of newly created projects over it's API: https://gitlab.com/api/v4/projects?order_by=created_at

And Github allows to search by commit hash: https://github.com/search?q=hash%3A04e699c8bc970423f243eca3e...

By combining those two you could get a list of projects which are on GitLab and on Github. Using the created_at on both APIs you could figure out which one was there first and which one has been imported/pushed onto the other platform.

(you would of course miss all projects which have been already deleted on Github, although forks should still exists which should help in most cases)

Maybe I'm missing the obvious, but would you mind to elaborate how this strategy works?

In my experience it's mostly the same.

Since the demand exceeds the supply by far, most consultancies take on less experienced candidates, then train them and/or pair them with a more experienced colleague.

I've worked for several smaller consultancies focusing on different domains and technology stacks and always learned it on the job.

tl;dr: TLS inspection is just another tool in your toolbox to control your corporate network traffic. While it might help to avert infections and detect exfiltration traffic, it's by no means required by GDPR.

The reasoning for this is mostly:

Malware can use TLS to load malicious payloads and exfiltrate data + Data loss and data breaches are targeted by GDPR => Decrypting the traffic let's you detect the malicious activity and prevent the infection / notice the exfiltration, which can help you staying GDPR compliant.

IANAL, but as long as it's a black box and the traffic doesn't get stored nor is accessible, the logs don't contain any personal information and the users are in the know about this processing, it should be okay.

It's personal data according to GDPR, see this FAQ from the EU commission: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

They're excluded from the fines, but not from the regulation itself.

Possible improvement: Zip a file containing 400MB of null bytes and extract it into the module using an postinstall hook. Then use those nullbytes and only if they are all nullbytes return 'null'.

https://github.com/OWASP/owasp-mstg/blob/master/Document/0x0... has all the relevant information, including reversing apps using native libraries to hide functionality.

I've seen this being handles using an ESB in the middle (solutions like WSO2, MuleESB). The ESB receives all relevant events and triggers actions based on that.

Meanwhile on twitter: https://twitter.com/b0rk/status/993165679833567233

I'm by no means implying any malfeasance. I fully agree with your thesis about Apple's business model.

Depending on your threat model in regards to your privacy the assurances made by Apple may be enough.

To me, it doesn't really matter. As long as I have no proof or control over how my data is being processed, it's better to just assume the worst case and practice data minimisation.

Just pointing out the obvious: Absence of evidence is not evidence of absence.

The only eyeopening part would be the fact, that Apple doesn't store much about it's users, which isn't verifiable.

Also unique identifiers are not the only way to link data. And due to differential privacy the guarantees that the data cannot be linked decays over time (see https://news.ycombinator.com/item?id=15224312)

Same here in Germany.