Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "timing attacks"
-
What do you do when your redirect doesn’t go where you tell it?
Clearly I’m missing something.
I stepped through the code, following the failure path of Sheogorath’s Recaptcha. It fails as expected, and hits this redirect before doing anything else:
`return redirect_to new_user_session_path`
I verified that this redirects to the “/users/sign_in” path, and it returns so the server doesn’t even try to authenticate the user. It just nopes out as it should to prevent timing attacks.
But somehow instead of doing that and redirecting as it should, it signs the user in and redirects somewhere else entirely: the role select page, which only happens after authenticating an admin user. It never even hits my breakpoint after the recaptcha check! It never authenticates!
I think what I’m missing is my old reality where things made sense.3 -
A new system developed at CSAIL was shown to have stronger security guarantees than Intel's existing approach for preventing so-called "timing attacks" like Meltdown and Spectre, made possible by hardware vulnerabilities.
Image courtesy of Graz University of Technology
6 -
I wanna go back to the age where a C program was considered secure and isolated based on its system interface rathe than its speed. I want a future where safety does not imply inefficiency. I hate spectre and I hate that an abstraction as simple and robust as assembly is so leaky that just by exposing it you've pretty much forfeited all your secrets.
And I especially hate that we chose to solve this by locking down everything rather than inventing an abstraction that's a similarly good compile target but better represents CPUs and therefore does not leak.21 -
Biggest interview of my entire life is coming up on Thursday. I really need this to go well - it's more than double my current salary, at a time where I'm really starting to struggle to make ends meet. There's an actual "team", and from my interactions with them over the last four interviews, I think they're cool people. It's still a little unusual, because although there's a team or cohort of seniors that I'd be joining, every senior developer is still somewhat siloed, leading their own juniors. I'd also get to be remote 75% of the time, which I think I've realized is a "must have" benefit.
I don't know if it's coincidental or just bad timing then that I've been having episodes of pretty intense vertigo and panic attacks far more frequently than normal lately - even before I had this interview lined up. I realized recently that I must have some kind of anxiety disorder. I don't know if that's from the military, or just from being fucked up via my own missteps. But I can't keep having these attacks.
Anyone who's willing to share - I don't really have anyone to ask. How do you deal with this type of thing? I went to see a shrink last year, but he just gave me pills that replaced these issues with others.10 -
I never imagined a cyberattack would strike at the center of our law firm's financial operations. We had set aside $420,000 in Bitcoin as a client settlement fund—a security buffer painstakingly earned through years of trust and prudence. Suddenly, one day, our networks fell victim to a coordinated cyberattack that locked our accounts, leaving our funds inaccessible like treasures in an electronic vault without a key. The timing was disastrous; client settlements were imminent, and our reputation depended on our ability to bring about justice in and out of court. Desperation mixed with determination. I summoned a legal tech colleague, and he soothingly described Tech Cyber Force Recovery. He said they were not just tech wizards; they were covert professionals who understood the subtleties of high-stakes legal environments. I called them immediately because our client's trust was at risk and our firm's reputation was on the line. Since we initially engaged Tech Cyber Force Recovery, their staff has been nothing short of discreet and professional. They set to work on our case with the level of attention that only forensic accountants can provide, rummaging through digital histories, blockchain transaction ledgers, and all metadata that might trace our money. Their efforts were diligent and respectful of the delicate nature of what we did as if each transaction was a delicate piece of evidence in a high-profile case. For 14 heart-stopping days, there were daily reports told to me in plain, understandable English. They worked with external cybersecurity professionals and even with the regulatory bodies to ensure that all measures were taken to get our money back without compromising our firm's confidential data. My hopes were revived with each report. Finally, on the fourteenth day, I received the news that elevated my heart: our balance locked in was restored in full. Not only did Tech Cyber Force Recovery recover our Bitcoin, but they also provided us with priceless guidance in protecting our systems from future attacks. In the process, they not only recovered our money but regained the trust of our customers. Today, when I'm standing in a courtroom or sitting in a boardroom, I speak with greater conviction, knowing that no matter what cyber affliction struck us, there are experts who can restore order and trust.
Thanks for a great job done tech cyber force recovery
TELEGRAM +156172636971
