• 1 Post
  • 89 Comments
Joined 2 years ago
cake
Cake day: June 23rd, 2024

help-circle

  • By default, the Credentials provider does not persist data in the database. However, you can still create and save any data in your database, you just have to provide the necessary logic, eg. to encrypt passwords, add rate-limiting, add password reset functionality, etc.

    That is exactly the complexity I wouldn’t want. With just SSO it is enough to send a redirect URL to the browser and on the callback set a cookie. No js needed. If your service gets compromised and someone leeks the credentials, just log everyone out.













  • Its timing based. When piped a script, bash executes each line completly before taking the next line from the input. Curl has a limited output buffer.

    1. Operation that takes a long time. Like a sleep, or if you want it less obvious. A download, an unzip operation, apt update, etc.
    2. Fill the buffer with more bash commands.
    3. Measure on the server if at some point curl stops downloading the script.
    4. Serve a malicious payload.


  • Has the same vibes as anthropic creating a C compiler which passes 99% of compiler tests.

    That last percent is really important. At least that last percent are some really specific edge cases right?

    Description:
    When compiling the following code with CCC using -std=c23:

    bool is_even(int number) {
       return number % 2 == 0;
    }
    

    the compiler fails to compile due to booltrue, and false being unrecognized. The same code compiles correctly with GCC and Clang in C23 mode.

    Source

    Well fuck.