Categories
programming security

Hoax Email Blast Abused Poor Coding in FBI Website

One of the FBI website had a web form that allowed arbitrary content to be sent from a legitimate FBI domain – passing all DMARC, DKIM, SPF. This isn’t even a hack – anyone could have done it using their web browser. But it could have serious consequences had the attacker had more nefarious motives.

The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for…

Source: Hoax Email Blast Abused Poor Coding in FBI Website

Categories
programming security

The Invisible JavaScript Backdoor – Certitude Blog

Earlier, we had a group which abuse Unicode bi-directional mechanism to deceive the reader about the actual ordering of source code, leading to clever hiding of backdoor in plain sight.

Now we have yet another novel method to include a backdoor in source codes. The attack vector makes use of Unicode characters that are invisible, but which are valid characters in variables names.

The attack requires the IDE/text editor (and the used font) to correctly render the invisible characters. At least Notepad++ and VS Code render it correctly (in VS Code the invisible character is slightly wider than ASCII characters). The script behaves as described at least with Node 14.

Source: The Invisible JavaScript Backdoor – Certitude Blog

Categories
programming

GitHub Copilot · Your AI pair programmer

This looks super impressive and is potentially game-changing. Auto-completion has been around for ages, since the early days of Visual Assist, to Visual Studio Autocomplete. This is another level. It works like GPT-3 in that it tries to suggest whole section of code or a complete function based on comments and other signals. This will be something that companies will pay for. Based on HN comments, alpha testers gave it rave reviews. It’s currently in technical preview. Can’t wait for general availability.

GitHub Copilot works alongside you directly in your editor, suggesting whole lines or entire functions for you.

Source: GitHub Copilot · Your AI pair programmer

Categories
programming

PostgreSQL on ARM-based AWS EC2 Instances: Is It Any Good? – Percona Database Performance Blog

ARM-based Graviton2 consistently outperforms Intel x86-based processors in PostgreSQL test by Percona, and it’s 25% cheaper. If your workload is not x86-specific there’s no reason not to switch.

The rise of ARM-based processor is gaining momentum and it seems like Intel is seriously playing catch-up here.

With the second gen of Graviton2 instances announced, we decided to take a look at the price/performance from the standpoint of running PostgreSQL.

Source: PostgreSQL on ARM-based AWS EC2 Instances: Is It Any Good? – Percona Database Performance Blog

Categories
internet programming

Troy Hunt: Promiscuous Cookies and Their Impending Death via the SameSite Policy

Yet another potentially breaking change on the web. This time round it involves cookie handling (in the upcoming Chrome 80). The objective is to close off a class of attacks known as CSRF (cross-site request forgery). Expect other browsers to follow suit.

… any websites you’re responsible for that are passing cookies around cross domain by POST request and don’t already have a SameSite policy are going to start misbehaving pretty quickly

Source: Troy Hunt: Promiscuous Cookies and Their Impending Death via the SameSite Policy

Categories
programming

How to Build Good Software

A break from the usual articles on cybersecurity. This is a good article that talks about the problems of software development and some strategies for mitigating them:

  • starting simple
  • focussing on the problem
  • iteration
  • spending time between expanding features and reducing complexity

Software has characteristics that make it hard to build with traditional management techniques; effective development requires a different, more exploratory and iterative approach.

Source: How to Build Good Software

Categories
internet programming security

unCaptcha: A Low-Resource Defeat of reCaptcha’s Audio Challenge

CAPTCHA is almost ubiquitous in today’s web applications and an extremely popular CAPTCHA implementation is Google’s, namely reCaptcha. reCaptcha provides an audio version for visually-impaired users. Researchers manage to make use of free speech-to-text services to defeat audio reCaptcha.

unCaptcha: Talk is cheap in defeating reCaptcha

Source: unCaptcha: A Low-Resource Defeat of reCaptcha’s Audio Challenge

Categories
bug programming

24-core CPU and I can’t type an email (part one)

When software doesn’t behave as expected, it can be really difficult to find out why. In this case, someone experienced an odd hanging problem while using GMail on his powerful computer and decides to investigate. Read on for all the gory details.

…I was just engaging in that most mundane of 21st century tasks, writing an email at 10:30 am. And suddenly gmail hung. I kept typing but for several seconds but no characters were appearing on screen. Then, suddenly gmail caught up and I resumed my very important email. Then it happened again, only this time gmail went unresponsive for even longer.

Source: 24-core CPU and I can’t type an email (part one)

Categories
programming

Nibble Stew – a gathering of development thoughts: “A simple makefile” is a unicorn

Unicorn as in the mythical creature, not what VC’s think about.

Like every sentence that has the word “just”, this is at best horribly simplistic but mostly plain wrong. Let’s dive in more detail into this. If you look up simple Makefiles on the Internet, you might find something like this page. It starts with a very simple (but useless) Makefile and eventually improves it to this:

Source: Nibble Stew – a gathering of development thoughts: “A simple makefile” is a unicorn

Categories
programming

Turning Design Mockups Into Code With Deep Learning

At the current stage it could help front-end developers in some of the grunt work in converting design templates into code. Some would go further to think that it will eliminate web development jobs. That is certainly not the case, as modern websites are not static “pages” but more like applications. Someone will still need to design the behaviour and logic.

In this post, we’ll teach a neural network how to code a basic a HTML and CSS website based on a picture of a design mockup. Here’s a quick overview of the process:

Turning Design Mockups Into Code With Deep Learning