Hacker News Reader

I think it's a reference to this blog post https://journal.stuffwithstuff.com/2015/02/01/what-color-is-...

vmarqueton Double Blind Passwords a.k.a. Horcruxing

I think the term "peppering" is mostly used for server side manipulation of the password, which the user is unaware of.

It would be very confusing to reuse this term for what is described in this article, so a new term like "Horcruxing" can be relevant. I like it.

vmarqueton Ask HN: Freelancer? Seeking Freelancer? (October 2019)

SEEKING WORK | Full Stack Engineer specialized in Ruby on Rails and InfoSec | Paris or remote

I have 5+ years of experience with Ruby on Rails. I also have a diploma and work experience in Information Security (but I am completely open about working in other fields). Strong entrepreneurial mindset and happy to participate to my client/employer company at every level, not just technical.

I have experience in refactoring apps for easier maintenance and evolution, and in upgrading legacy apps (I have migrated an app from Rails 2 to Rails 5 without issues). I take extra care for UX and design when implementing new features, and try to maximise developer happiness by using the most efficient tools available (exemple: static type-checking with TypeScript instead of JS, etc).

Stack:

* Backend: Ruby on Rails, Python

* Frontend: ReactJS with TypeScript or JavaScript

* Mobile: React-Native

* Also: good knowledge of SQL, Bash, C, Electron, ..., and willing to learn Elixir

Contact:

* Email: vincent.marquet1 [at] gmail.com

* Github: https://github.com/vmarquet

* Stack Overflow: https://stackoverflow.com/users/3486743/vmarquet

vmarqueton Google shuttering domain fronting, Signal moving to souqcdn.com

Note that domain fronting is not only usefull to circumvent Internet censorship, it's also used by malware.

With domain fronting, you can exfiltrate data from a company by making the connection appear to go to a legitimate google service (ex: drive.google.com), whereas it actually is going to a server hosted on google cloud services and controlled by an attacker.

vmarqueton Large crack in East African Rift is evidence of continent splitting in two

lemonde.fr published an article [1] yesterday, in which they debunk this news. A seismologist at Southampton University says [2] that it's unrelated to the rifting.

[1] https://www.youtube.com/watch?v=4QJ8MmbAC_o (in French)

[2] https://twitter.com/seismo_steve/status/977258571716091904

vmarqueton The Dex File Format

For a quick reference of the Dex file format, Ange Albertini (known for PoC||GTFO) made a poster: https://github.com/corkami/pics/blob/master/binary/DalvikEXe...

All his posters are pretty amazing: https://github.com/corkami/pics/blob/master/binary/README.md

vmarqueton Ask HN: Who is the target audience for ~$1000 software?

This. For more information, see this post https://training.kalzumeus.com/newsletters/archive/enterpris... by patio11.

vmarqueton Minideb – A small image based on Debian designed for use in containers

In addition to the "minimalist" aspect, this image seems to offer better practices on a security level than official Debian images. From their README: "The images are built daily and have the security release enabled, so will contain any security updates released more than 24 hours ago."

A recent analysis showed that the debian:latest image is "updated roughly every month" https://anchore.com/blog/look-often-docker-images-updated/

vmarqueton Sockey – A P2P multiplayer soccer game based on WebRTC

Oh you're right! I searched for something after the login screen but I missed this before. Thank you.

vmarqueton Sockey – A P2P multiplayer soccer game based on WebRTC

Unfortunately, as many game creators, they seem to believe that everybody in the world has qwerty keyboards, which is not the case. Using the A, W, S and D letters does not make sense on azerty keyboards (up and down reversed). Why can't we use keyboard arrows to move?

Too bad, the game would have been really fun to play if controls were usable for me.

vmarqueton Show HN: Manage your cost of app subscriptions in one place

Just curious, does it list itself in the list of app subscriptions? :)

Anyway, great product!

vmarqueton Ask HN: How did you get started in Network Security/Penetration Testing?

A way to validate that you're genuinely interested in penetration testing and to learn is to do challenges on sites like https://www.root-me.org/ for example. It's not necessarily realistic challenges, meaning there can be challenges on vulnerabilities you're very unlikely to see in real life, but you'll always learn something If the challenge does not teach you on some kind of vulnerability, at least it will teach you about how to think and do research, which is the most valuable.

I've seen companies filter candidates based on their score on such platforms. For example, for a junior position in penetration testing, they asked for at least 3000 points on root-me (but it was a few years ago, the number of challenges on the site has increased so it would make sense if they had increased their minimum points requirement).

Compared to certifications, it has two enormous advantages: it's fun, and it's free. I've started that way and never regretted it. I've not needed a certification to land a penetration testing job in a serious company (this was in France though, I don't know much about practices in other countries).

vmarqueton Let’s kill no-reply

"Don’t make me hunt for a way to ask it."

And this post makes me hunt google to find what "kthxbye" means...

vmarqueton 72% of Consumers Don't Know What Net Neutrality Is

I thought this was quite high, since the net neutrality issue had a lot of coverage in the media, see for example the two John Oliver talks about it:

https://www.youtube.com/watch?v=fpbOEoRrHyU https://www.youtube.com/watch?v=92vuuZt7wak

vmarqueton Oded Wins the Knuth Prize

Knuth's checks have their own wikipedia page: https://en.wikipedia.org/wiki/Knuth_reward_check

vmarqueton Ways to Invoke a Function in JavaScript

And the weirdest way of all to do a console.log(1):

    [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]](([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(+![]+[![]]+([]+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

How: http://www.jsfuck.com/

As a side note, jsfuck is usefull for bypassing filters who try to prevent the exploitation of XSS vulnerabilities.

vmarqueton #c0ffee is the color

I'm surprised no one yet has mentionned the famous stack overflow question: https://stackoverflow.com/questions/8318911/why-does-html-th....

TLDR; For legacy reasons, some words produce valid colors even if they don't respect the standard color formats. For example, "chucknorris" produces red.

vmarqueton Storing Drinking-Water in Copper Pots Kills Contaminating Bacteria (2012)

Little known fact: lead might be one of the reasons of the decline of the Roman Empire, because they used it inside the pipes carrying water. https://en.wikipedia.org/wiki/Lead_poisoning#History

vmarqueton How Uber could end up as Silicon Valley's most spectacular crash

Isn't Uber like a Ponzi scheme in some way? They use investors money to subsidize drivers so that prices are low and they get more users, and with more users they are valued better and get more investors money. When investors money or/and user growth stops, prices go up, people stop using it, and the system collapses (or at least the user base shrinks).