barubary

@barubary@infosec.exchange

Indoor European. I know #regex. I write #code (in #C or #Haskell or #Perl or #JavaScript or #bash).

This profile is from a federated server and may be incomplete. Browse more on the original instance.

jan, to random
@jan@toot.io avatar

ActivityPub servers: 26k+

AT proto servers: 1

What is the current status of federation?

"We do not currently support PDS federation on the production network but it is now possible to federate in the developer sandbox."

https://github.com/bluesky-social/pds

barubary,

@jan "Mom, someone federated in the developer sandbox!"

benzucker, to RegEx German
@benzucker@maly.io avatar

Any wizards here?
Is there a way to match multiple linebreaks regardless of the content but only if the number of linebreaks exceeds a value like 5?

barubary,

@benzucker Probably? I can't really tell what you're looking for.

barubary,

@benzucker n(.*n){3}

nonfedimemes, to random
@nonfedimemes@wetdry.world avatar
barubary,

@nonfedimemes I'm pretty sure both are parody accounts.

barubary, to random

@foone I made something. It's inspired by something you mentioned once, I believe: https://gate.uber.space/dkq/cgi-bin/xencode?q=%F0%9F%8F%B3%EF%B8%8F%E2%80%8D%E2%9A%A7%EF%B8%8F

castarco, to til
@castarco@hachyderm.io avatar

#TIL Today I learnt that adding ? after * transforms a #regex expression from being "greedy" into "lazy" (important for performance, safe validators, and protection against DoS attacks).

I don't know how I missed this bit of knowledge for so long. :blobfoxbox:

barubary,

@castarco I don't see how it protects against DoS attacks. The DoS problem is caused by badly written regexes that take "forever" to fail, so the regex engine is busy trying all possible variations to make the regex match a given string (assuming a standard backtracking implementation).

Making quantifiers non-greedy (by appending ?) does not change the number of ways a regex can match, nor does it shortcut the matching process. It simply changes the order in which alternatives are tried.

In the case of X*, the normal order is to try to match as many X's as possible and only "give back" matches if the rest of the regex fails to match. With X*?, the regex engine will try to match as few repetitions as possible (i.e. 0 at first) and only consume more if the rest of the regex fails to match. In either case all possibilities are tried before giving up.

barubary,

@castarco Can you show me an example of a regex where non-greedy matching reduces the number of alternatives tried?

barubary,

@castarco Oh, that doesn't count. The regex finds a match, so there is no catastrophic backtracking.

(As for semantic correctness, both regexes are wrong.)

barubary,

@castarco PS: You can easily get the opposite result by changing the test string: https://regex101.com/r/pRY7Gw/1

(3720 steps for <script>.*?</script>, 30 steps for <script>.*</script>)

timlegge, to Perl

@Perl, Published a timeline and write up of the recent module vulnerabilities in parsing spreadsheets.

https://blogs.perl.org/users/timothy_legge/2024/02/vulnerable-perl-spreadsheet-parsing-modules.html

barubary,

@timlegge Broken link/mangled formatting: "A detailed write up of the vulnerability and Proof of Concept (PoC) is available at https://github.com/haile01/perlspreadsheetexcelrcepoc"

sluttymayo, to random
@sluttymayo@jorts.horse avatar

i have an idea to make computers even worse, let's make it where a file can also be a directory. i mean going beyond the nix "everything is a file" paradigm. i'm saying, /bin/bash is still bash but you can also just store jpegs in /bin/bash/cat_pics

barubary,

@sluttymayo What, like Windows alternate data streams? C:Windowsnotepad.exe:kitty.jpg

foone, (edited ) to random
@foone@digipres.club avatar

I've no longer got a job, and I'm also kinda completely broke.

So if anyone has a few extra dollars they can donate to help me, that'd be very appreciated.

https://ko-fi.com/fooneturing

barubary,

@foone I tried, but Paypal says my credit card cannot be used for making payments, which is bullshit because no other website has an issue with it, including Amazon. (Also, they want my phone number for some reason.) Do you have any other payment channel that doesn't involve Paypal?

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

Fortinet SSL VPN pre-auth RCE, exploitation in wild. Patch now. CVE-2024-21762

https://fortiguard.fortinet.com/psirt/FG-IR-24-015

I understand this is very easy to exploit, and applies to unsupported versions too.

barubary,
samir, to random
@samir@functional.computer avatar

You know it's web scale when your tarball is base64-encoded and embedded in a JSON string.

barubary,

@samir Oh, I know this one. Like when you download a custom "image pack" for an HTML game, and the format turns out to be executable JavaScript that registers functions that set .innerHTML of some elements to HTML code with img elements whose src attribute is a data:image/jpeg;base64,... string.

drahardja, (edited ) to random
@drahardja@sfba.social avatar

Oh hey, the Attorney General of Indiana has published a snitch line for schools that teach LGBTQ+ issues, or make Woke materials available to their students!

Here’s the URL. Use it responsibly. Don’t use it to report Godzilla flying the Trans flag or anything like that, ok?

https://in.accessgov.com/attorneygeneral/Forms/Page/attorneygeneral/education-transparency-form/1

barubary,

@phil_stevens @Chip_Unicorn @drahardja @skinnylatte Or a zip file that unpacks to ... itself: https://alf.nu/ZipQuine

unixbhaskar, to linguistics
@unixbhaskar@mastodon.social avatar
barubary,
defcesco, to random

I'm disclosing three remote code execution (RCE) 0 days for KiTTY. KiTTY is a fork of PuTTY and has 20 million+ downloads. The vulnerability was introduced in the original release and is stable and reliable on Windows 11-Windows XP. Your sysadmin who likes cats and needs PuTTY is probably using it. The lead developer of KiTTY never replied after multiple contacts (see Timeline).

Advisory & Exploits:
https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004
https://blog.defcesco.io/CVE-2024-23749

barubary,

@defcesco Argh, these are just blatant security holes. There's nothing subtle here.
Let's declare a fixed-size buffer and then write an unchecked/arbitrary amount of data to it! Like char buf[1024]; strcpy(buf, input); - what could possibly go wrong?!

ethauvin, to haskell
@ethauvin@mastodon.social avatar
barubary,

@ethauvin Weird seeing Ruby's name explained without a single mention of Perl. "They knew they wanted to name the programming language after jewels" ... for no particular reason?

GossiTheDog, (edited ) to random
@GossiTheDog@cyberplace.social avatar

The three million toothbrush botnet story isn’t true.

Here’s the original source of the story: https://archive.is/2024.01.30-203406/https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480

It’s simply a made up example. It doesn’t exist. It starts talking about NoName Ddosia, too, which also isn’t toothbrushes.

barubary,

@GossiTheDog @mttaggart That says the toothbrush incident actually happened, despite sounding like a Hollywood scenario.

barubary,

@mttaggart @GossiTheDog Not a translation issue (I speak German). I think the article is just wrong. :-)

PS:
The crucial part is in the sentence right after the obscured bit: "... hat sich wirklich so zugetragen."

  • wirklich: really, actually
  • so: like this, thus
  • zutragen: to transpire, to happen, to befall
barubary,

@GossiTheDog This one is nice, too:

Das globale Management von Fortinet hat nun zurückgerudert mit seinem Statement, das an verschiedene internationale Medien gesendet wurde. Dieses auch an CH Media zu schicken, hat die Firma unterlassen. Auch sonst liegt uns bisher kein weiteres Statement von Fortinet vor.

"Fortinet's global management has now backtracked with its statement that was sent to various international media outlets. The company neglected to also send this to CH Media. We have not yet received any further statements from Fortinet."

evanprodromou, to random

During World War I, the Ottoman Empire collectively blamed the millions of Armenians in their territory for attacks by Armenian resistance fighters. Around 1M non-combatants were killed by the Ottoman military — in many cases, by forced marches through the Syrian desert without food and water.

Denouncing this genocide doesn’t make you an Armenian resistance fighter or an advocate for their views. It just means you’re against genocide.

In 1994, in the wake of the Rwandan civil war, the president of Rwanda was killed. Military and government officials suspected the Tutsi-aligned Rwandan Patriotic Front and blamed the Tutsi and Twa people collectively. They organized the mass killing of Tutsi people; between 500,000 and 1M people were killed in the following three months.

Abhoring this murder doesn’t make you a partisan of the Rwandan Patriotic Front. It just means you’re a human, opposed to the systematic slaughter of humans.

On October 7 2023, Hamas’s military wing attacked and killed about 550 Israeli soldiers and as many Israeli civilians. They kidnapped, tortured and raped hundreds more. In response, Israel has denied food, water and medical supplies to the 2.3M people of Gaza, driven them from their homes to a tiny sliver of land near the Egyptian border, destroyed half of all residential buildings, killed 30,000 people and seriously injured 60,000 more. The International Court of Justice (ICJ) has called this action a plausible genocide.

Wanting this genocide to end with an immediate ceasefire doesn’t mean you support Hamas or want Israel to be destroyed. It means you’re opposed to mass killing and expulsion of people from their homeland.

Is it exactly the same as these other examples? Absolutely not. Genocide never is. But you can be on the side of humanity against the destruction of the people of Gaza and it doesn’t make you an advocate for the views or actions of Hamas.

https://evanp.me/2024/02/04/taking-sides-in-a-genocide/

barubary,

@Extra_Special_Carbon OK, how does building bunkers under hospitals create casualties?

barubary,

@Extra_Special_Carbon I have no idea. Why are you asking me?

(Also, I asked first, and my question is not about Hamas or Israel, but about something you said.)

barubary,

@Extra_Special_Carbon So far I haven't supported a single thing Hamas does, let alone everything Hamas does. My question was strictly about clarifying what exactly you're trying to say, i.e. the structure of your argument.

If you're unwilling to discuss that, I can just say "oh, so you support genocide" and we're done here.

eskensaskia, to random German
@eskensaskia@mastodon.social avatar

Wir sind die Brandmauer! In Berlin und anderswo sind auch heute hunderttausende Demokrat*innen auf den Straßen. Wir haben eine Botschaft für die AfD und ihre rechtsextremen Netzwerke: Wir sind die Mehrheit. Wir sind stabil solidarisch. Und wir lassen uns unser Land nicht kaputtmachen.
📷 Fionn Große

barubary,

@eskensaskia Und was machst du beruflich so?

  • All
  • Subscribed
  • Moderated
  • Favorites
  • anitta
  • mdbf
  • khanakhh
  • Youngstown
  • everett
  • slotface
  • rosin
  • vwfavf
  • hgfsjryuu7
  • kavyap
  • osvaldo12
  • thenastyranch
  • DreamBathrooms
  • PowerRangers
  • Leos
  • magazineikmin
  • Durango
  • GTA5RPClips
  • InstantRegret
  • tacticalgear
  • cubers
  • ngwrru68w68
  • ethstaker
  • cisconetworking
  • tester
  • modclub
  • normalnudes
  • provamag3
  • All magazines