Do It by Code
Project IDX Project IDX is an AI-assisted workspace for full-stack, multiplatform app development in the cloud. With support for a broad range of frameworks, languages, and services, alongside integrations with your favorite Google products, IDX streamlines…
Google is done migrating all projects made in Project IDX to its Firebase Studio
Do It by Code
how to change your commits' old email if you have lost access to that old email? git filter-repo --email-callback ' if email == b"old_email@example.com": return b"new_email@example.com" else: return email ' (if you are on windows, consider using "git…
977 commits invalidated
(thanks to a certain someone who caused this)
(thanks to a certain someone who caused this)
time mocking library for python
https://github.com/adamchainz/time-machine
https://pypi.org/project/time-machine/
written in C
https://github.com/adamchainz/time-machine
https://pypi.org/project/time-machine/
written in C
An even funnier way to disable windows defender. (through WSC api)
https://github.com/es3n1n/defendnot/
How it works:
btw, at first he used Avast's dll files to call WSC api, but now he reverse-engineered the way WSC works, a "clean" implementation in fact
blog post
https://github.com/es3n1n/defendnot/
How it works:
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
The initial implementation of no-defender used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
btw, at first he used Avast's dll files to call WSC api, but now he reverse-engineered the way WSC works, a "clean" implementation in fact
blog post
Hyperparameter Optimization (Hyperopt):
It's an automated way to explore many different combinations of some parameters to find a set that performs the best according to a specific goal.
1. It uses smart algorithms (not just random guessing) to try different parameter values from the ranges you define in your code.
2. For each combination it tries (called an "epoch" or "trial"), it runs a quick backtest.
3. It keeps track of which combination gave the "best" result based on your chosen function(s).
It's an automated way to explore many different combinations of some parameters to find a set that performs the best according to a specific goal.
1. It uses smart algorithms (not just random guessing) to try different parameter values from the ranges you define in your code.
2. For each combination it tries (called an "epoch" or "trial"), it runs a quick backtest.
3. It keeps track of which combination gave the "best" result based on your chosen function(s).
CVE-2024-42367: In aiohttp, compressed files as symlinks are not protected from path traversal (risk: 6.3/10)
Static routes which contain files with compressed variants (.gz or .br extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links.
Affected versions: < 3.10.2
Links:
- CWE-61: UNIX Symbolic Link (Symlink) Following
- GitHub Advisory
- Patch
- VersionEye
#vulnerability #cve #python #aiohttp
Static routes which contain files with compressed variants (.gz or .br extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links.
Affected versions: < 3.10.2
Links:
- CWE-61: UNIX Symbolic Link (Symlink) Following
- GitHub Advisory
- Patch
- VersionEye
#vulnerability #cve #python #aiohttp
If you think about it, why would you put so much faith in the tool you are using, in the first place?
maybe it's because you have no faith in yourself...and that's a pretty serious problem.
The tool matters considerably less than the individual using it; the skills, and most importantly, the intent of the individual using it.
maybe it's because you have no faith in yourself...and that's a pretty serious problem.
The tool matters considerably less than the individual using it; the skills, and most importantly, the intent of the individual using it.
👍1
Xarray
N-D labeled arrays and datasets in Python
https://xarray.dev/
N-D labeled arrays and datasets in Python
Xarray is an open source project and Python package that introduces labels in the form of dimensions, coordinates, and attributes on top of raw NumPy-like arrays, which allows for more intuitive, more concise, and less error-prone user experience.
Xarray includes a large and growing library of domain-agnostic functions for advanced analytics and visualization with these data structures.
https://xarray.dev/
BroadcastChannel API: The Secret Message Bus Between Browser Tabs
https://medium.com/@ajblog7070/broadcastchannel-api-the-secret-message-bus-between-browser-tabs-7a8485732051
https://medium.com/@ajblog7070/broadcastchannel-api-the-secret-message-bus-between-browser-tabs-7a8485732051
Erlang/OTP SSH CVE-2025-32433
Severity: 10/10
Users are advised to update to OTP-27.3.3 (for OTP-27), OTP-26.2.5.11 (for OTP-26), or OTP-25.3.2.20 (for OTP-25) to mitigate this issue.
- PoC1
- PoC2
- offsec
#cve #vulnerability
Severity: 10/10
A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.
The server fails to properly enforce the SSH protocol sequence, allowing an attacker to send certain protocol messages before authentication is completed.
Users are advised to update to OTP-27.3.3 (for OTP-27), OTP-26.2.5.11 (for OTP-26), or OTP-25.3.2.20 (for OTP-25) to mitigate this issue.
- PoC1
- PoC2
- offsec
#cve #vulnerability
This Printer company served you malware for months, called them false positives
Article, Comments
Article, Comments
(photo is for SnipVex malware)
G Data's research showed that the Bitcoin address linked to SnipVex had received about 9.3 BTC before activity stopped on March 3, 2024. The widespread infection found across Procolored's downloadable files means it's plausible that the malware spread through a developer's workstation or the company's build servers.
ESP32-DIV
https://github.com/cifertech/ESP32-DIV
Btw you can easily do replay attack with this device to e.g. remote doors (if they are vulnerable to replay attacks)
and yes, even if they have encryption, as long as they are still vulnerable to replay attack, it will work on them
A powerful open-source multi-band wireless toolkit built on the ESP32. This device supports Wi-Fi, BLE, 2.4GHz, and Sub-GHz frequency bands and is designed for wireless testing, signal analysis, jammer development, and protocol spoofing.
https://github.com/cifertech/ESP32-DIV
Btw you can easily do replay attack with this device to e.g. remote doors (if they are vulnerable to replay attacks)
and yes, even if they have encryption, as long as they are still vulnerable to replay attack, it will work on them