Adventures in Dystopia
1.96K subscribers
515 photos
50 videos
7 files
288 links
Download Telegram
nice list of playgrounds (much more there):
◦ Floating point: Float Exposed by Bartosz Ciechanowski
◦ Unicode: Unicode analyzer from fontspace
◦ Unicode: What unicode character is this? from babelstone
◦ CBOR: CBOR playground
• Nginx: Nginx playground
Understanding Modern Storage APIs: A systematic study of libaio, SPDK, and io_uring
————————————————————————
TLDR: nice research, SPDK still faster than io_uring
Thanks you, mrs. ¶¶¶¶¶¶¶¶¶¶
🔥2👍1
Just added "Taxonomy of procrastination" to "Reading list" (literally, never read it latter)
NEAReans, be careful with browser-based authentication (not ledger), for example even wallet.near.org can send your private key to sentry.io (cloud bug analytics system).
Where the admins of sentry and the developers of wallet.near.org will have access to it.

I reported to NEAR:

Hello.

I have another bug (minor this time) in wallet.near.org (previous still unpaid for more
than one year)

During the auto-import process, the sentry was logging the # part of the URL (with the secret key
). You have connected sentry, which by default sends.

When I open https://wallet.testnet.near.org/auto-import-secret-key#kalloc.near/SECREY_KEY_ENCODED_
BASE58, I found that the app sends to sentry full URL with # part.

You connected sentry.io, the cloud version of a very cool bug analytics service. But, you send users private keys to the cloud version, I think you should add middleware and replace important (to users) data with placeholders. Sentry administrators and your developers with access to Sentry would be able to steal users' keys.


And got reply

Hello!

Thank you for submitting your report.

The mentioned issue may be exploited only if the Sentry service will be compromised, so the impact of this issue is highly theoretical. The report will be closed as Informative with additional reputation points.

Have a nice day and good luck with future findings.

Update: issue accepted, and a fix is scheduled.
Update 2: previous bug paid, respect to NEAR!
🔥11👍1🤯1
🔥7👍1