« first day (3083 days earlier)      last day (1860 days later) » 

11:00 PM
wait, what
what's the catch? and is this publicly documented anywhere?
 
@paul23 No. Thats not true. There are times to use 403.
 
@paul23 From a security standpoint, you want probes to fail.
 
@forresthopkinsa No. I haven't found it anywhere. I found while doing some tests. Not sure if its been fixed but I would assume not.
 
A successful probe is when you test a few inputs, and you find one input that gives a different output (i.e. /user/123 gives 404, but /user/1 gives 403)
 
@JBis If I'm understanding the severity of this correctly, then I think @MadaraUchiha should permanently delete those messages
 
11:03 PM
Which indicates that I may further try to attack /user/1 because I now know that "something is there"
I'm going to purge that :D
 
@forresthopkinsa Should I report to apple? I had this conversation here about a year ago I think.
 
@JBis If they don't have a bug bounty program, I would not.
Not because of "boo they don't wanna pay me" or any some such, but it's entirely possible that they'd press charges against you for hacking them, even though you were benevolent and reported it.
 
@MadaraUchiha Hey. Why not leave it up? If someone wants to exploit, let them. Maybe apple will start a bounty program when they see they are loosing out on holes in their precious security reputation.
 
Research their disclosure policy well before you make a move.
@JBis Or maybe they would press charges against Stack Overflow (or just file a takedown notice) for promoting hacks against them vOv
This is not a topic to be taken lightly, there are disclosure protocols for a reason.
 
thats some bullshit. I'll sue em back for defamation.
@MadaraUchiha Kinda smart.
 
11:09 PM
@MadaraUchiha Yet if everything is "blocked" it still isn't possible to find anything. And like I said if events/awesome-event would give 404 it could still be found by trying to register events and then finding which events do or do not exist. Using unique random generated keys like event/adfjlhak2332 is also not recommended by google as they prefer "good names" in uris.
 
Tread lightly. I've heard horror stories before, and it differs by country and by company.
 
Although this (which is bullshit by the way like it not like he had any skill):
> “I was just trying to call my friend, Nathan, to see if he wanted to play Fortnite,” he said, describing how he discovered the bug. “He didn’t answer right away, so I just swiped up and added my friend Diego, which forced Nathan to instantly join the call. We could both hear each other without him ever having to click the accept button.”
> It’s not clear how much Grant Thompson can expect to claim from Apple — although it will reportedly go toward his college tuition savings.
 
@paul23 Depends
For example, say I have a helpdesk application where users can open support tickets
 
Also my favorite line
 
There's an endpoint /ticket/<id> which shows the correspondence for that ticket ID
 
11:12 PM
> For whatever reason, Apple failed to respond until the story was picked up by the media.
 
The best practice in that case, is for the <id> to not be globally unique, but unique for the user.
That is, I will see a different /ticket/1 than you, 1 would be the first ticket I ever opened, for example.
Now, I'm locked within my own ticket universe and can't search for /ticket/2 and hope that I might find someone else's ticket.
The naive alternative is to use GUIDs instead of numeric IDs, depending on how much you care about nice URLs (remember, we're talking about things that Google isn't supposed to index, because they're not supposed to be public, else you wouldn't care)
 
Still what would the knowledge of that "some other person has a ticket with id xyz" give you? You're still being denied from all access to that ticket: and even with per person unique ids one could be "semi confident" that "long time user ticket/1 exists.
Security would prevent you to give information about even which user owns that ticket or any endpoint/request containing that ticket id.
 
@forresthopkinsa I'll delete after you see this. But it still works:
 
Or is this to give another "backup" in case of a lingering security hole? (Thus giving some "obfuscation" to that).
@MadaraUchiha Actually "GUIDs" can be just as secure as anything else: if they're random enough one has just as much trouble of guessing another key as they are in guess a user-password combination.
 
@paul23 You make everything as secure as possible, and every layer should give the attacker as little ground and information as possible
@paul23 GUIDs are generally more secure than numeric IDs because they are not susceptible to ±1 probes
But they incur some downsides too (mostly performance issues with database keys and indices)
 
11:26 PM
Biggest downside to me is that the ORM my predecessor chose requires numeric (incremental) ids as primary keys. And I always feel filthy having information twice in a database: and a UID (it's not about graphics :P) would mean that I have two columns whose sole purpose is to "uniquely identify the data". In direct contrast to the "one source of truth".
 
@paul23 indeed, but I have seen some companies do this
Use GUIDs for public facing APIs, and the more efficient numeric IDs for internal calls
 
I've programmed everything up to now that I can just add those things within an hour or so (explicitly abstracted the whole key-getting away on backend, and frontend wouldn't care - other than the type system), I "just feel gross doing it".
Per user unique numeric is actually a good idea, though it actually requires a bit of actual programming work (instead of just adding a column to the database).
 
tbh they should have cyber security PSAs. Like I see "DONT JUUL" everywhere but never anything about HTTPS or phishing
 
get big tobacco to lose revenue over it and you will
 
@paul23 Hmm, I can see it done with just adding a column to the table, and adding a UNIQUE constraint on the userTicketId + userId
@JBis OWASP is your best friend.
 
11:36 PM
@rlemon How about companies that loose millions due to security issues?
 
pale in comparison to the tobacco companies 😛
 
@MadaraUchiha ORM doesn't "support" that, making so I'd either have to manually run sql code (which makes unit test quite a bit harder) or do the checks -and incrementing the numeric- on webserver level.
I don't have the heart quite yet to tell my boss that I think it's better to stop using sails though. I shocked him last september already when I said "ok I'm going to use react/vue/angular whether you like it or not, I don't see any point in going forward with sencha.
 
@JBis unbelievable
@rlemon you've been using a lot of emoji lately
 
dark theme has emojis
 
:P
I don't see it
 
11:49 PM
space after to convert
:P[space] === 😋
 
😛 neat
 
the mapping is odd for some of them. I didn't create it, stole it on github
:+1: and all of that works tho
 
(y) doesn't work
that's the only one that matters
👍 will have to do
 
it's common smileys then :foo: codes
 
this seems like a great opportunity for custom emotes
 
11:52 PM
I had a script that basically added the same deal, but you could make custom replacements. maybe I should revisit that
had a neat little popup window to preview them too
 
!!gif yes
 
@forresthopkinsa That didn't make much sense. Maybe you meant: sippy
 
blame c#
:P
 
@forresthopkinsa That didn't make much sense. Use the !!/help command to learn more.
 
I reallystarted to dislike emojis once they started to interfere why my ability to create lists, and each alphabetical list suddenly had some smiley with sunglasses as second item.
 
11:53 PM
they kept complaining about the command not working so I removed it
 
damn
I see
well screw those guys
@paul23 that just means you need to use more tildes
 
lol. I mean it was going down a bunch, but it was a proxy of another gif service
so not worth it for me to care enough to maintain or fix on demand
 
can't it just directly use the giphy api
 
there wasn't an api
pretty sure I had to post
 
!!sippy
 
11:56 PM
@DavidKamer That didn't make much sense. Maybe you meant: sippy
 
I think there is now
 
wth
 
it was never actually giving giphy results.
 
what in the world
 
11:57 PM
can someone explain what I just did?
 
well I'd suggest making a new command that uses the official giphy api, but I hear the guy that maintains the repo doesn't ever merge PRs
 
rightgif.com is what I was pulling from
 
his parents are very disappointed about it
that looks neat
 
*nifty
that looks nifty
 
neato burrito*
 
11:59 PM
cool beans **
 
I'm really into all these new adjectives you guys
keep em coming
nifty makes me sound like jordan maron
 
schwifty
 

« first day (3083 days earlier)      last day (1860 days later) »