Question @ProtonVPN Why not show my latest used VPN's here? (Mac) How many people connect to the A countries (sorry A countries, nothing personal, just business)
kidk retweeted
A clean package.json is no longer evidence that nothing runs.
The mere presence of binding.gyp is enough for code to run at install time. No scripts block needed. Payloads can hide under any field name, at any depth. The sandbox around it can be escaped. And node-gyp pulls in files automatically that nothing even points to.
The latest Miasma variant used binding.gyp. We dug deeper and found it goes much further.
Why would you go after uptime? To make money? No, no, no. If you show people 99% uptime, they’ll ask 'why not 99.9%?'. And it will never be enough. But if you have no uptime, you can say you’re pre-stable, and you’re a potential pure play
That's why I add a sleep after every string compare
Timing attacks are real, and most devs don't protect against them.
When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't.
An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically.
hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time.
Same applies to #golang: use crypto/subtle.ConstantTimeCompare().
Same in #nodejs: crypto.timingSafeEqual().
If you're comparing secrets with == or ===, you may be leaking information through time!
Why tho
SpaceX: "The Starlink team is exploring using Starlink to enable high bankdwith connectivity around the Moon; Traditionally, deep space comms have relied on radio frequency transmission. This new design would use lasers to relay data back to Earth. Deploying that technology around the Moon could connect it with hundreds of terabits of capacity. This could enable Gigabit connectivity anywhere on the lunar surface."
🤯
lol wat
Deleting a Google API key doesn't revoke it immediately.
Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.
Google closed our report as "won't fix."
kidk retweeted
Aikido Intel is your earliest warning for supply chain threats.
Our engine detects malware and vulnerabilities in open-source ecosystems within minutes.
Built by our team of security researchers & AI engineers.
Bookmark it: intel.aikido.dev/
kidk retweeted
Got something weighing you down? Shake it off (like Curiosity)!
The Martian explorer unintentionally picked up a rock while drilling a recent sample, but the team was able to dislodge it by having the rover move its robotic arm and vibrate the drill until the rock fell off.
Just to let you know @geerlingguy You have the power to break my production in so many ways. Have you thought about bitcoin mining?
kidk retweeted
🚀version 0.1.5 was just released on itch.io 🚀kidk00.itch.io/hospitalityty…
Upgraded engine to Godot 4.3 and code signing on Mac OS. The game should now run independently from the Itch.io client on Mac OS.
