Gonçalo Valério @dethos@s.ovalerio.net

Vue.js documentary:

https://www.youtube.com/watch?v=OrxmtDw4pVI

#javascript #frontend #vue #vuejs

"HTTP Desync Attacks"

https://www.youtube.com/watch?v=w-eJM2Pc0KI

🤔

#security #infosec #http

"The impact of SSL certificate revocation on web performance" also worth reading.

https://nooshu.github.io/blog/2020/01/26/the-impact-of-ssl-certificate-revocation-on-web-performance/

#web #performance

"Don't touch my clipboard"

https://alexanderell.is/posts/taking-over-my-clipboard/

"Even if the certificate has an OCSP staple ... Chrome always sends a blocking request to the Certificate Authority's server when connecting to a website that uses an EV certificate and this request can take hundreds of milliseconds. To make things worse, if the CA's server is down, your users see an error page instead of your website."

https://www.aaronpeters.nl/blog/ev-certificates-make-the-web-slow-and-unreliable/

#tls #pki #ocsp #security #performance

"Understand Group by in Django with SQL"

https://hakibenita.com/django-group-by-sql

#django #python #sql

"CSS data exfiltration via a single injection point"

https://research.securitum.com/css-data-exfiltration-in-firefox-via-single-injection-point/

#security #infosec

Nice example of why we should never trust user input:

https://about.gitlab.com/blog/2019/11/29/shopping-for-an-admin-account/

#security

"... a remote attacker within proximity can silently execute arbitrary code with the privileges of the Bluetooth daemon as long as Bluetooth is enabled. No user interaction is required ..."

https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/

#security #infosec #android

"Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access"

https://www.perimeterx.com/tech-blog/2020/whatsapp-fs-read-vuln-disclosure/

#security #infosec

> Did you consider removing the installation and Google-specific tracking headers (x-client-data) that Google Chrome is sending to Google properties ?

> It's a unique ID to track a specific Chrome instance across all Google properties.

https://github.com/w3ctag/design-reviews/issues/467#issuecomment-581944600

#privacy #security #web #chrome

Security Flaw in Trezor Hardware Wallets

https://blog.kraken.com/post/3662/kraken-identifies-critical-flaw-in-trezor-hardware-wallets/

#security #infosec #cryptocurrencies #hardwarewallets

"buffer overflow in sudo when pwfeedback is enabled"

https://seclists.org/oss-sec/2020/q1/48

#security #infosec #sudo

"Does Your Domain Have a Registry Lock?"

https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/

#dns #security

"Stop using ridiculously low DNS TTLs"

https://00f.net/2019/11/03/stop-using-low-dns-ttls/

#dns

[CVE-2019-14615]

"When an application uses the GPU, some private data inevitably get stored in GPU. We find the graphics driver fails to wipe them after the application finishes, so the data preserve in the GPU. Therefore, an attacker can run a GPU spyware to steal these private data."

https://github.com/HE-Wenjian/iGPU-Leak

#security #infosec #intel #gpu