Skip to content

Florida sues some of the biggest porn platforms( XVideos, XNXX, BangBros, GirlsGoneWild, GTFlix TV and more) accusing them of not complying with the state's age verification law

Technology
200 116 65
  • 0 Stimmen
    1 Beiträge
    4 Aufrufe
    Niemand hat geantwortet
  • So, Linus Torvalds is a jerk

    Technology technology
    3
    0 Stimmen
    3 Beiträge
    9 Aufrufe
    D
    https://github.com/corollari/linusrants?tab=readme-ov-file#linusrants
  • The Internet is for Extremism - by Jeremiah Johnson

    Technology technology
    9
    1
    84 Stimmen
    9 Beiträge
    118 Aufrufe
    L
    I've been saying this for years. glad someone wrote about it.
  • AMD warns of new Meltdown, Spectre-like bugs affecting CPUs

    Technology technology
    9
    1
    198 Stimmen
    9 Beiträge
    115 Aufrufe
    anyoldname3@lemmy.worldA
    This isn't really the same kind of bug. Those bugs made instructions emit the wrong answer, which is obviously really bad, and they're really rare. The bugs in the article make instructions take different amounts of time depending on what else the CPU has done recently, which isn't something anyone would notice except that by asking the kernel to do something and measuring the time to execute affected instructions, an attacker that only had usermode access could learn secrets that should only be available to the kernel.
  • Trump Team Has Full Meltdown Over CNN Story on ICE-Tracking App

    Technology technology
    153
    780 Stimmen
    153 Beiträge
    4k Aufrufe
    N
    Now GrapheneOS the privacy based Android OS is calling them out https://bsky.app/profile/grapheneos.org/post/3lt2prfb2vk2r He really must be thinking just about himself, and not that Apple had the info.
  • 208 Stimmen
    63 Beiträge
    891 Aufrufe
    F
    They're coming for our VPNs soon enough, be sure of that. Here in Australia they've already flagged wanting to ban them.
  • 1 Stimmen
    8 Beiträge
    77 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 44 Stimmen
    4 Beiträge
    52 Aufrufe
    G
    It varies based on local legislation, so in some places paying ransoms is banned but it's by no means universal. It's totally valid to be against paying ransoms wherever possible, but it's not entirely black and white in some situations. For example, what if a hospital gets ransomed? Say they serve an area not served by other facilities, and if they can't get back online quickly people will die? Sounds dramatic, but critical public services get ransomed all the time and there are undeniable real world consequences. Recovery from ransomware can cost significantly more than a ransom payment if you're not prepared. It can also take months to years to recover, especially if you're simultaneously fighting to evict a persistent (annoyed, unpaid) threat actor from your environment. For the record I don't think ransoms should be paid in most scenarios, but I do think there is some nuance to consider here.