Hacker Newsnew | past | comments | ask | show | jobs | submit | phonethrowaway's commentslogin

I'm so excited for this: https://www.kickstarter.com/projects/bigme/bigme-worlds-firs...

Basic color support for syntax highlighting is what I've been waiting for...


It looks interesting, is there some information that describes whether this runs an upstream Linux kernel without version-locked binary blobs?

It says it runs Android, and thus the above makes the difference on whether I one rely on 2 years of updates or 20 years of updates.


it doesn't say meta, duh


Facebook still owns Facebook.


flask-security is a trivial addon.


they don't even address shell escape injection which is definitely possible...


I am not sure I follow. I can't find a scenario where the logged data would either be directly executed or would result in pulling attacker-specified data from the network.


Author here. I in my article I didn't touch on 'log poinsoning'[1], what they could be referring to.

Vulnerability to log poisoning really depends on _what_ you do with your logs. If you display them on a webpage, beware of XSS. And -- I suppose -- if you use them in shell commands, beware of shell command injection.

In the article my focus was on vulnerabilities specific to Python's logging library.

EDIT

as an added point: I don't think preventing log poisoning should be responsibility of the logger. It'd be madness to try and escape all possible bad interpretations (HTML, shell, SQL, etc) of the data. About as crazy as PHP's automatic escaping of strings...

[1] https://owasp.org/www-community/attacks/Log_Injection#code-e...


The farm bill made all hemp derived products legal federally at long as they contain only trace amounts of Delta 9 THC. Delta 8 and THC-O/acetate are legal. Not as strong, slightly different, but it gets the job done... kinda. Check it out... if you can. Check your state laws.


I could easily get the real thing here, it’s not exactly weed unfriendly, but due to the nature of the thing I don’t want to risk losing my child to the system for even one puff. I’m pretty much just fine sober, but I hope reason wins here soon and they legalize it fully, until then I prefer not to take any risky shortcuts.


Old isn't janky... hmm... to me janky means duct tape and bubble gum.


This basically only runs on A: old hardware + operating system (no go, need to do other workstation tasks at that company), or B: a windows 7 virtual machine with DOS compat set up, anything else isn't working, windows 7 validation servers were recently taken down leaving things in a precarious state of support. That's basically what I would call held together by duct tape at this point


Kind of like Docker, you mean?


Someone: Operating systems are too complicated.

Docker: rebuilds virtualized operating system


shell escapes are real attack vector too...


the point is it's a feature, not an exploit. control and escape codes are a thing for a reason.

it's worse with web stuff though... and it's a real vector.

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=terminal+es...

https://packetstormsecurity.com/files/162518/AWS-CloudShell-...

https://nvd.nist.gov/vuln/detail/CVE-2017-0899

https://github.com/InfosecMatter/terminal-escape-injections


The NSA doesn't need to illegally spy on Americans when an ally can do it for them and then share the data legally.

https://www.nationalarchives.gov.uk/ukusa/

https://en.wikipedia.org/wiki/Five_Eyes


That's not really how it works. Sure, it is also a way to circumvent such local legislature, but for that to work American allies would need to run actual surveillance structures in the US mainland proper out in the open..

You know, like the US does in the countries of it's "allies" like Germany [0]

Do you really think the US would allow German intelligence agencies to build whole complexes, plugged right into the US's largest IPX?

That's why this situation is not nearly as "symbiotic" as it's often made out to be. At best that applies to Five Eyes countries, and even there only to a very limited degree as no Five Eyes member as as much foreign presence as the US.

[0] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...


To this rhetorical question, a resounding “yes” answer. There is credible suggestion that GCHQ has been invited to operate US facilities on US soil for this explicit purpose.

https://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gch...


ASSESSEE NAME AND ADDRESS ARE NOT AVAILABLE ONLINE PER CA GOV CODE §6254.21


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: