TL;DR - CSP nonces aren't as effective as they seem to be against DOM XSS. You can bypass them in several ways. We don't know how to fix t...
Claire Keane

Love Begins
h
wallacepolsom
Aqua Utopiaď˝ćľˇăŽĺşă§č¨ćśăç´Ąă

romaâ
ojovivo
trying on a metaphor
Monterey Bay Aquarium
Mike Driver
Acquired Stardust
d e v o n

I'd rather be in outer space đ¸
Keni
YOU ARE THE REASON
Game of Thrones Daily
art blog(derogatory)

çĽćĽ / Permanent Vacation
seen from United States

seen from United States

seen from United States

seen from United States

seen from Finland

seen from Malaysia
seen from United States

seen from United States

seen from United States
seen from United States
seen from United States
seen from TĂźrkiye

seen from Malaysia
seen from United States
seen from United States
seen from United States

seen from Malaysia

seen from Spain
seen from Indonesia

seen from South Africa
@allanshone
TL;DR - CSP nonces aren't as effective as they seem to be against DOM XSS. You can bypass them in several ways. We don't know how to fix t...

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
Neat tricks with windows scripting and hiding command execution
The AWS Command Line provides all the functionality necessary to script and automate your AWS usage. Just like the browser based Console, detail can be manageâŚ
Add a quick overview of some tips and ideas to keep in mind when using the AWS command line tools, especially when learning
Paper by Timothy Libert.
Abstract:
âThis article provides a quantitative analysis of privacy compromising mechanisms on one million popular websites. Findings indicate that nearly nine in ten websites leak user data to parties of which the user is likely unaware of; over six in ten websites spawn third-party cookies; and over eight in ten websites load Javascript code from external parties onto usersâ computers. Sites which leak user data contact an average of nine external domains, indicating users may be tracked by multiple entities in tandem. By tracing the unintended disclosure of personal browsing histories on the web, it is revealed that a handful of American companies receive the vast bulk of user data. Finally, roughly one in five websites are potentially vulnerable to known NSA spying techniques at the time of analysis.â
Read more: Full text in PDF.
And people ask me why I use browser extensions like uMatrix that block third+ party inclusions.
App Transport Security check
Iâve put together a quick script that can be used to check if URL is compliant with app transport security:
http://www.whatsbeef.net/wabz/appts.php?url=https://facebook.com
Just throw a URL on the end.

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
To many users, security begins and ends with anti-virus and malware protection and regular software updates. But there is much more to security, and the more you understand the reasoning behind it,...
A good read on why Linux is generally more secure, and how it came to and continues to be. Compromising user convenience allows for greater power and openness, but also tighter control and flexibility.
Barangaroo!!
Finally open to the public again, had a walk around during lunch and it should be a great spot once the trees grow a bit and the place settles a bit. Definitely a good investment!
Minification is great for bandwidth saving, much like compression, but when youâre dealing with code, there are times when these processes can turn against you and modify your source to function differently.
"Stop reverse engineering our code, already.â
A note on why it can be good to involve the community, and to be a little more open and level-headed. Itâs also a good example of how to not cover your tracks, and by trying to do so only open yourself up to further scrutiny and intrusion.
Itâs interesting to note how the people doing the right thing can be the ones taking the blame or being treated like the bad people, rather than being thanked for their help and improving products and infrastructure.
When the devices that connect you to the internet are already compromised, it wonât matter what websites you visit or connections you make. Itâs always important to keep firmware and software up to date, to prevent exploits like these from being usable.

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
Ubiquiti Networks Inc in its SEC filings reveal they were the victim of a social engineering attack resulting in the loss of $39 million
Social engineering is a constant issue, it requires more attention than it receives. People need to be a little more paranoid day-to-day about the communication theyâre involved in.
Yahooâs Pays $1M+ to Network Vulnerability Reporters
By:Â Ramses Martinez, Senior Director, Interim CISO
2015 has been a pivotal year for the Yahoo Bug Bounty program. Our community engagement is at an all time high and our team is able to triage and fix bugs faster than ever. In the last year, the program evolved from a community sourced method of finding vulnerabilities to a key component of our application security program. One great example is how our Bug Bounty has become a feedback loop to determine the effectiveness of our application security controls. Our team uses each vulnerability report as a way to measure the impact of our developer training, effectiveness of scanning tools, and efficacy of source code reviews. This approach, over time, will lead to more secure applications and more secure Yahoo users. Â
Below are some key data points from our Bug Bounty program to date, which weâll continue to update to help the security community understand the efficacy of this work and help focus research in this space:
To date, weâve paid out +$1M to security vulnerability reporters.
Submissions since the inception of the program have now reached the 10,000 mark.
Approximately 1,500 of these 10,000 reports have resulted in a bounty payout.
The current monthly validity rate of submissions is around 15%, an increase from 10% at the end of 2014.
More than 1,800 reporters have participated in the program, about 600 of these have reported verifiable bugs.
50% of the submissions are from the top 6% set of contributorsÂ
87% of researchers submit less than 10 bugs, this equates to about 34% of all submissions.
A major improvement to our Bug Bounty program has been the implementation of a reputation system. This process is designed to award points to researchers after reporting a verifiable security bug. The number of points is also affected by the amount of the bounty the reporter is paid. Â
The reputation system has made our list of top vulnerability reporters more meaningful by illustrating not only the number of reports they have submit, but the severity value we assigned to each. The reputation system also gives researchers a quantifiable way to compare their skills with the rest of the participants in the program.
Our Bug Bounty program would be nothing without our amazing, and dedicated, contributors. An example of one of these individuals is Sean Melia, our top contributor in 2015: https://hackerone.com/meals. I recently had a chance to speak with Sean and asked what motivated him to do vulnerability research, he answered:
âThe aspect of solving a puzzle or reaching a goal has always been something I strive to do. I started on a whim and after enough determination I was able to find some interesting bugs that were worth my time and investment. I hope bug bounty programs continue to expand and improve since itâs a great opportunity for corporations and security researchers to work together.â
Thank you to our entire security community for your ongoing support and dedication. We look forward to continuing to improve our Bug Bounty program in the second half of 2015.
From the introduction to the complaint:
âWhen a consumer uses his Android mobile phone to read the Financial Timesâ story about the Commissionâs SO against Google, he unknowingly receives 17 ânetwork requestsâ from sites and services other than the FT, all attempting to open invisible connections to his device. Seven of these requests â including three from Google itself â come from problematic sites and services that invisibly track the user in order to make a comprehensive profile of his personal information as he uses applications and browses the web. This tracking not only violates personal privacy, but also leaves users vulnerable to malware and identity theft.â
The Internet's visual storytelling community. Explore, share, and discuss the best visual stories the Internet has to offer.
These fascinate me! The presentation with the equation overlayed on the original image is great, an aspect of creativity I would love to have.
Content Security Policy (CSP) is an additional layer of security protection that can significantly reduce the risk and impact of web injection attacks like XSS on modern browsers. At Yahoo we are serious with enabling CSP on all major properties and have made significant progress towards thatâŚ

Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch ⢠No registration required ⢠HD streaming
Hackday timelapse at Yahoo7 from March 2015
This was a fun hackday! Makes me sad though how little I'm at my desk
Sometimes, the best security is useless if the practices and processes donât facilitate the usage