HackerTrans
TopNewTrendsCommentsPastAskShowJobs

xnyhps

no profile record

Submissions

Bad things come in large packages: .pkg signature verification bypass on macOS

sector7.computest.nl
2 points·by xnyhps·vor 4 Jahren·0 comments

comments

xnyhps
·vor 3 Jahren·discuss
Will modern clients warn loudly if a server suddenly stops offering channel binding? Otherwise it is trivial to downgrade.
xnyhps
·vor 3 Jahren·discuss
I don't mind XML personally, but I understand why people dislike it. For XMPP specifically you have to use a streaming XML parser, which is quite a bit more complicated than the more common case of parsing XML into a tree and then traversing that tree. Not all XML libraries even have support for streaming parsers and if you start implementing XMPP with a non-streaming parser you'll end up with something really messy.

Streaming parsers give you a stream of events like "open tag 'message'", "attribute 'from'", "open tag 'body'", "close tag 'body'" and you need to gather those and translate them back into the top-level elements of the stream. This is pretty tedious, and if you do it wrong you may end up leaking memory (if you keep the entire tree around in memory) or even introduce vulnerabilities (similar to https://bugs.chromium.org/p/project-zero/issues/detail?id=22... ).
xnyhps
·vor 13 Jahren·discuss
Even WA doesn't roll their own key deriviation scheme, they use PBKDF2+SHA1.