123400+ entries in 0.076s
mircea_popescu: hanbot o shit yeah! you just cracked
this nut wide open.
mircea_popescu: anyway, you're on
to something here douchebag ; work on it, with serious dedication, by
the
time you're as old as
the rest of
these guys you'll prolly be more valuable
than
them.
mircea_popescu: i
thought
the whole "memory security" shit sandwich just got blown
to smithereens coupla weeks ago.
douchebag: I plan on learning more about low level memory exploitation in
the future, however it's a bit more difficult
these days due
to stack canaries and other protections
to prevent
that sort of stuff from happening.
mircea_popescu: but yes, fucking up
the empire's "technology" ie, websites, is a perfectly fine entry point
towards actual life.
douchebag: Ohh right, I understand. I agree, however
to me I
treat web application pentesting as almost a sort of game or puzzle, in my opinion it is rather entertaining challenge
to be able
to modify a web applications behavior in a way
that leads
to
total comprimise.
mircea_popescu: i would definitely put up with
this in exchange for all-svg.
shinohai: Some of us do like
to lul about it when it happens, notwithstanding.
a111: Logged on 2018-01-07 20:28 mircea_popescu: he also wrote a lisp-is-faster-than-c item back in
the days
the microsoft hired hands were pissing all over o'reilly&marc "my middle name is cocksucker" andressen's java
douchebag: What do you mean by sv-powered
tech?
mircea_popescu: notreally ; republic mostly despises
the sv-powered "tech" ; you'll find pmarca's notion of "the web" doesn't carry much water, or interest, among actually competent computer folk.
douchebag: Does anyone else in
this chat into web application pentesting?
☟︎ douchebag: Last night I found a rather interesting vulnerability in a website for a bug bounty, second
time I've been able
to leverage SSRF
to XXE, very fun stuff.
douchebag: Alright forsure, if I were
to find something how would you want me
to disclose
the information
to you in a secure manner?
douchebag: mircea_popescu: I'm a little bored at
the moment and I'm looking
to practice my web application pentesting skills, would you mind if I
took a look at your site and
try
to identify any potenial vulnerabilities?
phf: (there's yet another solution is
to actually provide a binary patcher,
that uses some minimal delta algorithm
to patch files, while also providing
the patching details in plain
text. so you could say
that
the result is readable in a sense
that it
takes file FOO and replaces bits #10 #1343 #325435 etc)
mircea_popescu: phf
there's no direction re proper cuz of first principle issues, i dun want
to make dumb part of
the history.
phf: mircea_popescu: it's not clear
to me what "properly handle" is, given
the many conversations on
the subj.
there's no reason why it couldn't if
there was some direction as far as proper. i'm personally leaning
towards
the idea
that binary blobs shouldn't be in vpatch (as per latest
thread on subj), but it's a non-pragmatic
take
☟︎ hanbot: mircea_popescu
they're further down in
the vpatch. ugh.
phf: you're going
to run into png's
that are admin interface ux elements
that you can't just delete
mircea_popescu: let people provide
their fucking own avatar favicon etc.
phf: third solution,
that's latest conversation in logs on subj is
that perhaps binary blobs don't really belong in a vdiff which is a human readable code container, and should just be packed separately into e.g. a signed
TAR archive and unpacked into place as a second pass
phf: second solution
that was entertained by ascii was
to base64 encode binaries and have a second pass with something like makefile
to pack
them back into place
phf: the oldest solution, by i believe mp, is "replace all
the mp-wp images with
their svg equivalents"
phf: hanbot:
there's no policy on
this, it's an unsolved problem with lots of different solutions
mircea_popescu: BingoBoingo how
the hell can
that
thing contain NO numeric characters ?! do it properly, x - y - z - k = q.
phf: did you get
the source directly from mp, or did i republish it? i remember being asked for
the source and putting it up at some point, but i don't remember by whom and
too lazy
to log in
this case
shinohai: Hmmm ... I may have put it in
there
to
test or something.
phf:
http://btcbase.org/log/2018-01-21#1773562 << pretty sure
that's one of mine, it's either comments.diff or it could be a diff against
the baseline wp of
that vintage (i wanted
to see what kind of modifications exactly mp version introduced)
☝︎ mircea_popescu: it all comes back down
to "byte is machine word but idiots wanna do dumb shit", im pretty sure
mircea_popescu: basically, 32 bit had an int
type
that became incompatible with 64 bit for ~no reason
mircea_popescu: trinque i can
tell you it was a multi-week pain in
the ass
to clear
the shit out of eulora codebase.
trinque: my current wager is folks
that had it were using a gcc5, which is defaulted
to a later standard for C
☟︎ trinque: anyhow if anyone recalls specifically why int64_t was present on some systems and not others, I'd be interested for
the HISTORY file.
jhvh1: BingoBoingo:
The operation succeeded.
shinohai: Boffing purple drank is best way
to kill ALL retardation.
mod6 is having some fun stepping
through some ffa procedures
a111: Logged on 2018-01-20 15:43 mircea_popescu: spyked re pingback
thing, doesn't even have
to be
that hand-generated ; just walk
the db, extract all links, construct
the calls as shown and make curl calls. can be a bash script.
mircea_popescu: sometimes (often) wordpress manages
to lose a pingback ;
that
thing will walk your db, spit out properly formatted xml payloads for all links in all your (published) posts.
the resuilt can be run as a bash script
to catch up on any missed pingbacks.
hanbot: mircea_popescu, what is
this pingback-updater.php item?
shinohai: It all appears
to be code related
to comments.
BingoBoingo: <mircea_popescu> BingoBoingo do a few
trades with
the locals
to get a feeling of
the place an' report ; also gpgram me
the story of bbisp fiat holdings ab origine. << Will do
shinohai: Worth looking into
tho, I should grep and see if
this patch was applied at some point in
there.
Thanks for notifying!
shinohai: The only garbage I remember in
the one on my site was I changed icons in
the images/ directory, otherwise I believe as I received.
shinohai: I was unsure hanbot, I don't recall if I ever asked mp about it, or why it was included in
the copy I got originally.
mircea_popescu: t well because you only have
to pay for
the number of days and weeks
that
the equipment would be used.The back office library is like a gold mine of
thousand dollar methods used by
the leading earners in
the business.
mircea_popescu: Obedience
training should be calm, firm, [url=<snip>wholesalenfljerseyscheap.cc/]Cheap NFL Jerseys Wholesale[/url], quiet,[url=<snip>wholesalenfljerseyscheap.cc/]Cheap Jerseys Online[/url], and persuasive, rather
then demanding or sharp.
This is why; getting all
the information about most suitable nuts and bolts detroit company is important.Another benefit of renting construction equipment is
that you get
to manage your budge
mircea_popescu: yeah, in order
to show up i have
to approve it, so it's no accident.
mircea_popescu: that's
the past 5, covering a coupla days. so i guess it's more
than 1/day
hanbot: 10k marked spam comments means spammy ips are stored and attempted comments from same don't show up in admin, subjectively over
time it's seemed i need
to spend less
time mopping shitcomments. and i didn't post proper patches, but will.
mircea_popescu: it has a queue of items
to be reviewed (by default everything with a link goes in
there). so in
this sense it
takes some
training.
mircea_popescu: asciilifeform i dun expect it is possible for it
to not work if wp otherwise does work.
mircea_popescu: one
thing it does is <input
type="text" name="author18c6e55" with
that hash changing daily (or how often you please) ; another
thing it does is a "refuse from ips in spam list" ;
there's more i might nor recall right off.
mircea_popescu: there's a number of parts
to it! but it makes no foreign calls / doesn't rely on
the akismet bs, if you can run php oyu definitely should be able
to run it
mircea_popescu: my own notes say "he for some reason confused
the ip of
the people leaving comments with his own, went off
tangent ;
to be rediscussed later".
mircea_popescu: i have
the feeling we discuss
this periodically. what's dynamic ip
to do with it ?
mircea_popescu: asciilifeform he has an excellent point
though. it's fucking unseemly, EVERYONe must report
to google
they're reading loper ? come
the fuck on.