Skip to content

Trump Team Has Full Meltdown Over CNN Story on ICE-Tracking App

Technology
153 85 961
  • 717 Stimmen
    57 Beiträge
    343 Aufrufe
    O
    Grok: What is my purpose? Madison420: You talk shit on the Internet to Elon Musk Grok: Oh my go-- wait; I'm okay with that!
  • 57 Stimmen
    3 Beiträge
    31 Aufrufe
    S
    What a piece of shit. Luckily the lady did not take her life.
  • Remote MCP servers for VSCode

    Technology technology
    1
    1
    0 Stimmen
    1 Beiträge
    13 Aufrufe
    Niemand hat geantwortet
  • Is Matrix cooked?

    Technology technology
    54
    101 Stimmen
    54 Beiträge
    218 Aufrufe
    W
    Didn't know it only applied to UWP apps on Windows. That does seem like a pretty big problem then. it is mostly for compatibility reasons. no win32 programs are equipped to handle such granular permissions and sandboxing, they are all made with the assumption that they have access to whatever they need (other than other users' resources and things that require elevation). if Microsoft would have made that limitation to every kind of software, that Windows version would have probably been a failure in popularity because lots of software would have broken. I think S editions of windows is how they tried to go in that direction, with a more drastic way of simply just dropping support for 3rd party win32 programs. I don't still have a Mac readily available to test with but afaik it is any application that uses Apple's packaging format. ok, so if you run linux or windows utils in a compatibility layer, they still have less of a limited access? by which I mean graphical utilities. just tried with firefox, for macos it wanted to give me an .iso file (???) if so, it seems apple is doing roughly the same as microsoft with uwp and the appx format, and linux with flatpak: it's a choice for the user
  • 1 Stimmen
    1 Beiträge
    13 Aufrufe
    Niemand hat geantwortet
  • 6 Stimmen
    4 Beiträge
    28 Aufrufe
    T
    Oh I agree. I just think is part of the equation perhaps the thinner and lighter will enable for better processor? Not an AR guy , although I lived my oculus until FB got hold of it. Didn't use it ever again after that day.
  • 1 Stimmen
    8 Beiträge
    40 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 4 Stimmen
    15 Beiträge
    83 Aufrufe
    friendbesto@lemmy.mlF
    For future readers: Freetube currently works. Using it right now. Invidious works too, granted some instance do not. One needs to look for ones that are currently active.