In my first post on intellectual denial of service attacks, I covered something I dubbed “bad infinitum,” a tendency for non-experts to overwhelm experts with repetitive, costly, and often unproductive demands for evidence or counter-argument to oft-debunked or misleading claims. Here, I’ll cover another of these intellectual attack vectors, which I’ll call “the map to nowhere.” An asymmetry exists in each of these attacks: easy to launch, hard to counter.
We live in an era that devalues conformity, while simultaneously preserving it in many interesting ways. Everyone is allowed to have an opinion. Divergent views produce conflict, however, and disagreement, argument, and debate define our current moment.
If we merely disagreed on matters of taste - our favorite color, music, movies, etc. - we could avoid such conflicts. Increasingly, though, we disagree on more fundamental ideas. Some deny the spherical shape of the Earth and the heliocentric model of the solar system (I highly recommend Behind the Curve, a movie about this movement). Arguments of all shapes and sizes spring up everywhere: capitalism vs. socialism, humanity’s role in climate change, on and on.
Anyone who read my post yesterday is probably confused by 1) this domain name and 2) my mention of it being my “first post”. This blog is a reboot of my previous site (where the older posts came from). I’m starting over in hopes that it will incentivize me to take blogging seriously again. This post will explain my plans for this blog, and with any luck, convince you to come along for that ride. I had imagined writing a longer and more thoughtful introduction, but events have conspired to force my hand. When in doubt, start.
It’s never a good time to suddenly find yourself jobless. But it’s never a bad time to evaluate your skills, your goals, and where you’re headed.
We all want to be a valued member of a winning team on an inspiring mission
- Graham Weston
It’s easy to get complacent after a few years in a good job. You tell yourself, “I’m doing such important work! We’re making so much progress! I love my team!” You’re churning out pull requests, responding to emails and Slack messages, burning through your JIRA backlog.
I’ve become somewhat obsessed with Pokemon GO since I started playing it, and I’ve been trying to cobble together a mental guide for how to be successful from a hodge-podge of sites, people I’ve met while playing the game, and some of my own experiences. Here’s what I’ve got so far. Items in red are ones I’m less sure of.
The panel at the bottom right tells you what Pokemon are near. 3 feet = far, 2 feet = nearby, 1 foot = close, none = very close
Have you ever logged onto Facebook to find “Recommended Friends” that you didn’t expect to see? Maybe someone you briefly met on Tinder, or a co-worker you hate? I think many people are unaware that, by default, the Facebook app on mobile devices automatically imports your contact list, continuously (this includes, so far as I can tell, every piece of information about them that you have stored).
I started noticing this a long time ago, but I sense that there are many who just assume Facebook is omniscient and don’t give it another thought. There are many reasons you may not want to give up this power, and so far as I can tell, the only way to stop importing this information is to delete the Facebook app from your phone. If anyone is aware of a specific privacy setting one can use to disable this behavior, leave a comment on this post!
(About) 425 days ago (at the time of this writing) I started scraping Hacker News via its shiny new API. And then I promptly forgot about it. That is, until I noticed my cronjob had been throwing errors constantly for a few weeks:
Traceback (most recent call last):
File "/home/dummy/projects/hn-cron/hn.py", line 62, in <module>
main()
File "/home/dummy/projects/hn-cron/hn.py", line 53, in main
log_line = str(details['id']) + "\t" + details['title'] + "\t" + details['url'] + "\t" + str(details['score']) + "\n"
KeyError: 'url'Instead of fixing anything, I just commented out the cronjob. But now I feel somewhat obligated to do at least a rudimentary analysis of this data. In keeping with my extreme negligence/laziness throughout this project, I hacked together a few bash commands to do just that.
The AddToAny Share Buttons WordPress Plugin was, until recently, vulnerable to a DOM-based cross-site scripting issue. The file in question is hosted on the author’s site, so you’re not vulnerable anymore (you’re welcome). If you just want the vulnerability details, go here. Now for the story of this bug.
This particular journey started with an email from XSSposed, a site intended to allow security researchers to responsibly report cross-site scripting issues in sites that don’t run formal bug bounty programs like those seen here. Having never heard of it before, I was immediately suspicious. I like the concept of bug bounties just fine, but I was a little surprised to learn that I had unknowingly opened one on my site.
At the risk of spoiling a somewhat-well-known XSS game, I want to share an XSS vector I had never thought of before it forced me to. The premise of this level was, essentially, that you couldn’t use any letters whatsoever in the attack vector, and you had to call alert(1).
So, without further ado, here it is:
""[(!1+"")[3]+(!0+"")[2]+(''+{})[2]][(''+{})[5]+(''+{})[1]+((""[(!1+"")[3]+(!0+"")[2]+(''+{})[2]])+"")[2]+(!1+'')[3]+(!0+'')[0]+(!0+'')[1]+(!0+'')[2]+(''+{})[5]+(!0+'')[0]+(''+{})[1]+(!0+'')[1]](((!1+"")[1]+(!1+"")[2]+(!0+"")[3]+(!0+"")[1]+(!0+"")[0])+"(1)")()What a mess, right?! What the hell are we doing here? Let’s take it piece-by-piece.
I recently hacked together a little 300-line bash script to manage my dotfiles called dot-man. Basically, it will let you manage your dotfiles in a git repository, and you can run it every so often to keep your local / remote dotfiles up to date.
Install is as simple as:
git clone git@github.com:cneill/dot-man.git
OR
git clone https://github.com/cneill/dot-man.gitLet me know what you think! You can find me on Twitter @ccneill.