barubary

@barubary@infosec.exchange

Indoor European. I know #regex. I write #code (in #C or #Haskell or #Perl or #JavaScript or #bash).

This profile is from a federated server and may be incomplete. Browse more on the original instance.

drahardja, (edited ) to random
@drahardja@sfba.social avatar

Oh hey, the Attorney General of Indiana has published a snitch line for schools that teach LGBTQ+ issues, or make Woke materials available to their students!

Here’s the URL. Use it responsibly. Don’t use it to report Godzilla flying the Trans flag or anything like that, ok?

https://in.accessgov.com/attorneygeneral/Forms/Page/attorneygeneral/education-transparency-form/1

barubary,

@phil_stevens @Chip_Unicorn @drahardja @skinnylatte Or a zip file that unpacks to ... itself: https://alf.nu/ZipQuine

GossiTheDog, (edited ) to random
@GossiTheDog@cyberplace.social avatar

The three million toothbrush botnet story isn’t true.

Here’s the original source of the story: https://archive.is/2024.01.30-203406/https://www.luzernerzeitung.ch/wirtschaft/kriminalitaet-die-zahnbuersten-greifen-an-das-sind-die-aktuellen-cybergefahren-und-so-koennen-sie-sich-schuetzen-ld.2569480

It’s simply a made up example. It doesn’t exist. It starts talking about NoName Ddosia, too, which also isn’t toothbrushes.

barubary,

@GossiTheDog This one is nice, too:

Das globale Management von Fortinet hat nun zurückgerudert mit seinem Statement, das an verschiedene internationale Medien gesendet wurde. Dieses auch an CH Media zu schicken, hat die Firma unterlassen. Auch sonst liegt uns bisher kein weiteres Statement von Fortinet vor.

"Fortinet's global management has now backtracked with its statement that was sent to various international media outlets. The company neglected to also send this to CH Media. We have not yet received any further statements from Fortinet."

foone, (edited ) to random
@foone@digipres.club avatar

I've no longer got a job, and I'm also kinda completely broke.

So if anyone has a few extra dollars they can donate to help me, that'd be very appreciated.

https://ko-fi.com/fooneturing

barubary,

@foone I tried, but Paypal says my credit card cannot be used for making payments, which is bullshit because no other website has an issue with it, including Amazon. (Also, they want my phone number for some reason.) Do you have any other payment channel that doesn't involve Paypal?

nonfedimemes, to random
@nonfedimemes@wetdry.world avatar
barubary,

@nonfedimemes I'm pretty sure both are parody accounts.

samir, to random
@samir@functional.computer avatar

You know it's web scale when your tarball is base64-encoded and embedded in a JSON string.

barubary,

@samir Oh, I know this one. Like when you download a custom "image pack" for an HTML game, and the format turns out to be executable JavaScript that registers functions that set .innerHTML of some elements to HTML code with img elements whose src attribute is a data:image/jpeg;base64,... string.

defcesco, to random

I'm disclosing three remote code execution (RCE) 0 days for KiTTY. KiTTY is a fork of PuTTY and has 20 million+ downloads. The vulnerability was introduced in the original release and is stable and reliable on Windows 11-Windows XP. Your sysadmin who likes cats and needs PuTTY is probably using it. The lead developer of KiTTY never replied after multiple contacts (see Timeline).

Advisory & Exploits:
https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004
https://blog.defcesco.io/CVE-2024-23749

barubary,

@defcesco Argh, these are just blatant security holes. There's nothing subtle here.
Let's declare a fixed-size buffer and then write an unchecked/arbitrary amount of data to it! Like char buf[1024]; strcpy(buf, input); - what could possibly go wrong?!

barubary, to haskell

Today I spent a few hours trying to track down a problem deep in a helper module of a complex production application written in . Among other things, it involves threads, a monad transformer stack (3 or 4 levels deep, I think?), an SQL database, and HTTP calls to an external service.

In the end, I managed to boil one issue in the code down to the following crucial lines:

forever_mpl :: Monad m => m a -> m b<br></br>forever_mpl m = fix (m >>)<br></br><br></br>forever_mpf :: Monad m => m a -> m b<br></br>forever_mpf m = fix (self -> m >> self)<br></br>

In theory, both of these should be equivalent to forever from the base library. However ...

In one place in the code, using forever_mpl (the first definition) works correctly: It repeats an action forever. But switching to forever_mpf (the second definition) makes the code hang instead (at 0% CPU). Why?!

I know the answer now, so here's a challenge: Can you think of a reason why these two definitions should behave differently? Can you implement a Monad instance with a >> that distinguishes between them somehow?

barubary, to random

Orphans can't become zombies.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

Fortinet SSL VPN pre-auth RCE, exploitation in wild. Patch now. CVE-2024-21762

https://fortiguard.fortinet.com/psirt/FG-IR-24-015

I understand this is very easy to exploit, and applies to unsupported versions too.

barubary,
timlegge, to Perl

@Perl, Published a timeline and write up of the recent module vulnerabilities in parsing spreadsheets.

https://blogs.perl.org/users/timothy_legge/2024/02/vulnerable-perl-spreadsheet-parsing-modules.html

barubary,

@timlegge Broken link/mangled formatting: "A detailed write up of the vulnerability and Proof of Concept (PoC) is available at https://github.com/haile01/perlspreadsheetexcelrcepoc"

jan, to random
@jan@toot.io avatar

ActivityPub servers: 26k+

AT proto servers: 1

What is the current status of federation?

"We do not currently support PDS federation on the production network but it is now possible to federate in the developer sandbox."

https://github.com/bluesky-social/pds

barubary,

@jan "Mom, someone federated in the developer sandbox!"

barubary, to random

Microservices are great if you hate types and just want to pass strings around.

eskensaskia, to random German
@eskensaskia@mastodon.social avatar

Wir sind die Brandmauer! In Berlin und anderswo sind auch heute hunderttausende Demokrat*innen auf den Straßen. Wir haben eine Botschaft für die AfD und ihre rechtsextremen Netzwerke: Wir sind die Mehrheit. Wir sind stabil solidarisch. Und wir lassen uns unser Land nicht kaputtmachen.
📷 Fionn Große

barubary,

@eskensaskia Und was machst du beruflich so?

barubary, to ChatGPT

Maybe don't blindly (or at all) trust with your code. Transcript:

You
What's the output?

<?php<br></br>define("lol", "greetings");<br></br>$s = "Everyone!";<br></br>$lol = array(<br></br>  "8" => "Christmas",<br></br>  "010" => "Merry",<br></br>);<br></br><br></br>echo "$lol[010] ${lol[010] } ${ lol[010]}";<br></br>

ChatGPT
In the provided PHP code, you are defining a constant named lol and creating an array $lol with two elements. Let's break down what the echo statement will output:

  1. "$lol[010]": This part will not output as expected. In PHP, variables inside double-quoted strings are parsed, but array indices are not parsed correctly if they are not enclosed in curly braces. Therefore, this part will not output the value of $lol['010'].
  2. "${lol[010]}": This is a correct way to access an array element within a double-quoted string. The curly braces allow PHP to correctly parse the array and its index. This will output "Merry".
  3. "${ lol[010]}": This is similar to the previous part, but with a space after the opening curly brace. PHP is generally tolerant of such spaces, so this should also output "Merry".

However, there's an important note about the array indices: "8" will be interpreted as an integer index (8), but "010" is a bit tricky. In PHP, a number starting with a 0 is considered octal (base 8). However, since 010 is an invalid octal number (octal digits are 0-7), PHP will interpret it as a string index instead. Thus, '010' remains as the string "010".

Putting it all together, the output of the echo statement will be something like:

Notice: Undefined variable: lol in your_script.php on line X<br></br>Merry Merry<br></br>

This notice is generated because $lol[010] is not recognized as a valid array element in the first part of the echo statement. The other two parts correctly output the string "Merry".

barubary, to random

The trick that mathematicians haven't quite figured out yet is that you can combine multiple letters into "words" and use those to name things. Then you don't need five scripts and three separate fonts just to give everything its own unique letter.

unixbhaskar, to linguistics
@unixbhaskar@mastodon.social avatar
barubary,
barubary, to random

@foone I made something. It's inspired by something you mentioned once, I believe: https://gate.uber.space/dkq/cgi-bin/xencode?q=%F0%9F%8F%B3%EF%B8%8F%E2%80%8D%E2%9A%A7%EF%B8%8F

sluttymayo, to random
@sluttymayo@jorts.horse avatar

i have an idea to make computers even worse, let's make it where a file can also be a directory. i mean going beyond the nix "everything is a file" paradigm. i'm saying, /bin/bash is still bash but you can also just store jpegs in /bin/bash/cat_pics

barubary,

@sluttymayo What, like Windows alternate data streams? C:Windowsnotepad.exe:kitty.jpg

ethauvin, to haskell
@ethauvin@mastodon.social avatar
barubary,

@ethauvin Weird seeing Ruby's name explained without a single mention of Perl. "They knew they wanted to name the programming language after jewels" ... for no particular reason?

castarco, to til
@castarco@hachyderm.io avatar

#TIL Today I learnt that adding ? after * transforms a #regex expression from being "greedy" into "lazy" (important for performance, safe validators, and protection against DoS attacks).

I don't know how I missed this bit of knowledge for so long. :blobfoxbox:

barubary,

@castarco Oh, that doesn't count. The regex finds a match, so there is no catastrophic backtracking.

(As for semantic correctness, both regexes are wrong.)

barubary,

@castarco Can you show me an example of a regex where non-greedy matching reduces the number of alternatives tried?

barubary,

@castarco I don't see how it protects against DoS attacks. The DoS problem is caused by badly written regexes that take "forever" to fail, so the regex engine is busy trying all possible variations to make the regex match a given string (assuming a standard backtracking implementation).

Making quantifiers non-greedy (by appending ?) does not change the number of ways a regex can match, nor does it shortcut the matching process. It simply changes the order in which alternatives are tried.

In the case of X*, the normal order is to try to match as many X's as possible and only "give back" matches if the rest of the regex fails to match. With X*?, the regex engine will try to match as few repetitions as possible (i.e. 0 at first) and only consume more if the rest of the regex fails to match. In either case all possibilities are tried before giving up.

barubary,

@castarco PS: You can easily get the opposite result by changing the test string: https://regex101.com/r/pRY7Gw/1

(3720 steps for <script>.*?</script>, 30 steps for <script>.*</script>)

benzucker, to RegEx German
@benzucker@maly.io avatar

Any #regex wizards here?
Is there a way to match multiple linebreaks regardless of the content but only if the number of linebreaks exceeds a value like 5?

barubary,

@benzucker n(.*n){3}

barubary,

@benzucker Probably? I can't really tell what you're looking for.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • provamag3
  • kavyap
  • DreamBathrooms
  • cisconetworking
  • magazineikmin
  • InstantRegret
  • Durango
  • thenastyranch
  • Youngstown
  • rosin
  • slotface
  • mdbf
  • khanakhh
  • tacticalgear
  • JUstTest
  • everett
  • modclub
  • Leos
  • cubers
  • ngwrru68w68
  • ethstaker
  • osvaldo12
  • GTA5RPClips
  • anitta
  • megavids
  • normalnudes
  • tester
  • lostlight
  • All magazines