barubary

@barubary@infosec.exchange

Indoor European. I know #regex. I write #code (in #C or #Haskell or #Perl or #JavaScript or #bash).

This profile is from a federated server and may be incomplete. Browse more on the original instance.

GossiTheDog, (edited ) to random
@GossiTheDog@cyberplace.social avatar

The three million toothbrush botnet story isn’t true.

Here’s the original source of the story: https://archive.is/2024.01.30-203406/https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480

It’s simply a made up example. It doesn’t exist. It starts talking about NoName Ddosia, too, which also isn’t toothbrushes.

barubary,

@GossiTheDog This one is nice, too:

Das globale Management von Fortinet hat nun zurückgerudert mit seinem Statement, das an verschiedene internationale Medien gesendet wurde. Dieses auch an CH Media zu schicken, hat die Firma unterlassen. Auch sonst liegt uns bisher kein weiteres Statement von Fortinet vor.

"Fortinet's global management has now backtracked with its statement that was sent to various international media outlets. The company neglected to also send this to CH Media. We have not yet received any further statements from Fortinet."

drahardja, (edited ) to random
@drahardja@sfba.social avatar

Oh hey, the Attorney General of Indiana has published a snitch line for schools that teach LGBTQ+ issues, or make Woke materials available to their students!

Here’s the URL. Use it responsibly. Don’t use it to report Godzilla flying the Trans flag or anything like that, ok?

https://in.accessgov.com/attorneygeneral/Forms/Page/attorneygeneral/education-transparency-form/1

barubary,

@phil_stevens @Chip_Unicorn @drahardja @skinnylatte Or a zip file that unpacks to ... itself: https://alf.nu/ZipQuine

foone, (edited ) to random
@foone@digipres.club avatar

I've no longer got a job, and I'm also kinda completely broke.

So if anyone has a few extra dollars they can donate to help me, that'd be very appreciated.

https://ko-fi.com/fooneturing

barubary,

@foone I tried, but Paypal says my credit card cannot be used for making payments, which is bullshit because no other website has an issue with it, including Amazon. (Also, they want my phone number for some reason.) Do you have any other payment channel that doesn't involve Paypal?

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

Fortinet SSL VPN pre-auth RCE, exploitation in wild. Patch now. CVE-2024-21762

https://fortiguard.fortinet.com/psirt/FG-IR-24-015

I understand this is very easy to exploit, and applies to unsupported versions too.

barubary,
barubary, to random

@thunderbird Just updated Thunrderbird. Got a web page asking for donations. Page design is kinda sus (doesn't tell you who's behind it, there are no links with more info or "about us", etc., not sure this is even legal in Germany), but I decided to click the Donate button anyway. Got nothing; button doesn't work, just reloads the page. Might want to fix that.

castarco, to til
@castarco@hachyderm.io avatar

#TIL Today I learnt that adding ? after * transforms a #regex expression from being "greedy" into "lazy" (important for performance, safe validators, and protection against DoS attacks).

I don't know how I missed this bit of knowledge for so long. :blobfoxbox:

barubary,

@castarco Oh, that doesn't count. The regex finds a match, so there is no catastrophic backtracking.

(As for semantic correctness, both regexes are wrong.)

barubary,

@castarco PS: You can easily get the opposite result by changing the test string: https://regex101.com/r/pRY7Gw/1

(3720 steps for <script>.*?</script>, 30 steps for <script>.*</script>)

barubary,

@castarco Can you show me an example of a regex where non-greedy matching reduces the number of alternatives tried?

barubary,

@castarco I don't see how it protects against DoS attacks. The DoS problem is caused by badly written regexes that take "forever" to fail, so the regex engine is busy trying all possible variations to make the regex match a given string (assuming a standard backtracking implementation).

Making quantifiers non-greedy (by appending ?) does not change the number of ways a regex can match, nor does it shortcut the matching process. It simply changes the order in which alternatives are tried.

In the case of X*, the normal order is to try to match as many X's as possible and only "give back" matches if the rest of the regex fails to match. With X*?, the regex engine will try to match as few repetitions as possible (i.e. 0 at first) and only consume more if the rest of the regex fails to match. In either case all possibilities are tried before giving up.

samir, to random
@samir@functional.computer avatar

You know it's web scale when your tarball is base64-encoded and embedded in a JSON string.

barubary,

@samir Oh, I know this one. Like when you download a custom "image pack" for an HTML game, and the format turns out to be executable JavaScript that registers functions that set .innerHTML of some elements to HTML code with img elements whose src attribute is a data:image/jpeg;base64,... string.

barubary, to haskell

Today I spent a few hours trying to track down a problem deep in a helper module of a complex production application written in . Among other things, it involves threads, a monad transformer stack (3 or 4 levels deep, I think?), an SQL database, and HTTP calls to an external service.

In the end, I managed to boil one issue in the code down to the following crucial lines:

forever_mpl :: Monad m => m a -> m b<br></br>forever_mpl m = fix (m >>)<br></br><br></br>forever_mpf :: Monad m => m a -> m b<br></br>forever_mpf m = fix (self -> m >> self)<br></br>

In theory, both of these should be equivalent to forever from the base library. However ...

In one place in the code, using forever_mpl (the first definition) works correctly: It repeats an action forever. But switching to forever_mpf (the second definition) makes the code hang instead (at 0% CPU). Why?!

I know the answer now, so here's a challenge: Can you think of a reason why these two definitions should behave differently? Can you implement a Monad instance with a >> that distinguishes between them somehow?

barubary, to ChatGPT

Maybe don't blindly (or at all) trust with your code. Transcript:

You
What's the output?

<?php<br></br>define("lol", "greetings");<br></br>$s = "Everyone!";<br></br>$lol = array(<br></br>  "8" => "Christmas",<br></br>  "010" => "Merry",<br></br>);<br></br><br></br>echo "$lol[010] ${lol[010] } ${ lol[010]}";<br></br>

ChatGPT
In the provided PHP code, you are defining a constant named lol and creating an array $lol with two elements. Let's break down what the echo statement will output:

  1. "$lol[010]": This part will not output as expected. In PHP, variables inside double-quoted strings are parsed, but array indices are not parsed correctly if they are not enclosed in curly braces. Therefore, this part will not output the value of $lol['010'].
  2. "${lol[010]}": This is a correct way to access an array element within a double-quoted string. The curly braces allow PHP to correctly parse the array and its index. This will output "Merry".
  3. "${ lol[010]}": This is similar to the previous part, but with a space after the opening curly brace. PHP is generally tolerant of such spaces, so this should also output "Merry".

However, there's an important note about the array indices: "8" will be interpreted as an integer index (8), but "010" is a bit tricky. In PHP, a number starting with a 0 is considered octal (base 8). However, since 010 is an invalid octal number (octal digits are 0-7), PHP will interpret it as a string index instead. Thus, '010' remains as the string "010".

Putting it all together, the output of the echo statement will be something like:

Notice: Undefined variable: lol in your_script.php on line X<br></br>Merry Merry<br></br>

This notice is generated because $lol[010] is not recognized as a valid array element in the first part of the echo statement. The other two parts correctly output the string "Merry".

benzucker, to RegEx German
@benzucker@maly.io avatar

Any #regex wizards here?
Is there a way to match multiple linebreaks regardless of the content but only if the number of linebreaks exceeds a value like 5?

barubary,

@benzucker n(.*n){3}

barubary,

@benzucker Probably? I can't really tell what you're looking for.

jan, to random
@jan@toot.io avatar

ActivityPub servers: 26k+

AT proto servers: 1

What is the current status of federation?

"We do not currently support PDS federation on the production network but it is now possible to federate in the developer sandbox."

https://github.com/bluesky-social/pds

barubary,

@jan "Mom, someone federated in the developer sandbox!"

nonfedimemes, to random
@nonfedimemes@wetdry.world avatar
barubary,

@nonfedimemes I'm pretty sure both are parody accounts.

barubary, to VintageOSes

Anyone have a copy of the fcntl man page?

timlegge, to Perl

@Perl, Published a timeline and write up of the recent module vulnerabilities in parsing spreadsheets.

https://blogs.perl.org/users/timothy_legge/2024/02/vulnerable-perl-spreadsheet-parsing-modules.html

barubary,

@timlegge Broken link/mangled formatting: "A detailed write up of the vulnerability and Proof of Concept (PoC) is available at https://github.com/haile01/perlspreadsheetexcelrcepoc"

barubary, to random
sluttymayo, to random
@sluttymayo@jorts.horse avatar

i have an idea to make computers even worse, let's make it where a file can also be a directory. i mean going beyond the nix "everything is a file" paradigm. i'm saying, /bin/bash is still bash but you can also just store jpegs in /bin/bash/cat_pics

barubary,

@sluttymayo What, like Windows alternate data streams? C:Windowsnotepad.exe:kitty.jpg

barubary, to Cats
barubary, to random

"I asked one of those AI things to set up a REST API in Python. First instruction was to install Ruby"

barubary, to random

Lead is fine for adults; otherwise all those rock bands wouldn't use it in their guitars.

barubary, to random

The trick that mathematicians haven't quite figured out yet is that you can combine multiple letters into "words" and use those to name things. Then you don't need five scripts and three separate fonts just to give everything its own unique letter.

barubary, to random

@foone I made something. It's inspired by something you mentioned once, I believe: https://gate.uber.space/dkq/cgi-bin/xencode?q=%F0%9F%8F%B3%EF%B8%8F%E2%80%8D%E2%9A%A7%EF%B8%8F

  • All
  • Subscribed
  • Moderated
  • Favorites
  • provamag3
  • kavyap
  • DreamBathrooms
  • modclub
  • magazineikmin
  • InstantRegret
  • khanakhh
  • thenastyranch
  • Youngstown
  • rosin
  • slotface
  • Durango
  • ngwrru68w68
  • ethstaker
  • JUstTest
  • mdbf
  • tacticalgear
  • tester
  • osvaldo12
  • GTA5RPClips
  • everett
  • cisconetworking
  • cubers
  • megavids
  • normalnudes
  • anitta
  • Leos
  • lostlight
  • All magazines