Find similar content

http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/ #security This should have been obvious to me for a longer time, but until earlier today I did not really realize the severity of the issues caused by str.format on untrusted user input. It came up as a way to bypass the Jinja2 Sandbox in a way that would permit retrieving information that you should not have access to which is why I just pushed out a security release for it. However I think the general issue is quite severe and needs to be a discussed because most people are most likely not aware of how easy it is to exploit.

#security page 1 - 2 - 3 - 4 Click here to return to the ⚒ Resource Index ⚒ Security Culture - Basics for Protests https://t.me/RevToolboxRedux/2165 https://t.me/RevToolboxRedux/2166 - PDF version Security and Counter-Surveillance - Information Against the Police State https://t.me/RevToolboxRedux/2559 What To Do When You're Arrested https://t.me/RevToolboxRedux/2585 Surveillance Self Defense in Public Spaces https://t.me/RevToolboxRedux/2755 Movement Defense Means All of Us - A guide to building resilient movements and countering repression. https://t.me/RevToolboxRedux/2070 No Badjacketing - The State Wants To Kill Us, Let's Not Cooperate (important article) https://t.me/RevToolboxRedux/2915 Why Misogynists Make Great Informants https://t.me/RevToolboxRedux/2916 Digital Communication Protocols Beyond Telegram https://t.me/RevToolboxRedux/3338 Police Infiltrators - the ultimate betrayal https://t.me/RevToolboxRedux/2502 Privacy/Security Resource list https://t.me/RevToolboxRedux/12 Some tips on staying secure online https://t.me/RevToolboxRedux/157 Elicitation - subtly soliciting information https://t.me/RevToolboxRedux/167 Telegram tips for group/channel admins (old) https://t.me/RevToolboxRedux/198 Breaking News Consumer's Handbook https://t.me/RevToolboxRedux/209 Antifascism is Self Defense https://t.me/RevToolboxRedux/264 Digital security resources for activists https://t.me/RevToolboxRedux/267 Know Your Rights - A Crashcourse 4 Protesters (Don't Shoot PDX) https://t.me/RevToolboxRedux/273 Best Practices for Signal Threads https://t.me/RevToolboxRedux/280 The Riot is One Night But Metadata is Forever https://t.me/RevToolboxRedux/293 Never Talk to the Cops https://t.me/RevToolboxRedux/294 Before Posting Ask Yourself - does this pose a risk? https://t.me/RevToolboxRedux/295 Surveillance Self Defense (EFF) https://t.me/RevToolboxRedux/309 How To Make It Harder for Cops to Do Their Jobs https://t.me/RevToolboxRedux/310 Beating FBI Surveillance https://t.me/RevToolboxRedux/319 How To Find Hidden Cameras https://t.me/RevToolboxRedux/334 DIY Faraday Bag (untested) https://t.me/RevToolboxRedux/327 Guide to IMSI Catchers (Fake Cell Towers) https://t.me/RevToolboxRedux/337 Covering Cameras w/ Umbrellas https://t.me/RevToolboxRedux/369 Getting Started - Telegram Anonymity https://t.me/RevToolboxRedux/370 Tails OS Leaflet https://t.me/RevToolboxRedux/378 Car Brigade Techniques https://t.me/RevToolboxRedux/407 Beware Swoopers https://t.me/RevToolboxRedux/431 Spread Good Info! S.A.L.U.T.E. https://t.me/RevToolboxRedux/436 Anarchist Direct Actions - A Challenge for Law Enforcement https://t.me/RevToolboxRedux/462 What To Do If You Are Stopped by the Police https://t.me/RevToolboxRedux/465 Criptica. Resistencia Digital (espanol) https://t.me/RevToolboxRedux/467 Which Apps Are Secure and End-to-End Encrypted? https://t.me/RevToolboxRedux/495 When the Police Knock on Your Door https://t.me/RevToolboxRedux/517 Dress for Success - Disguise without Bloc https://t.me/RevToolboxRedux/518 Look Out for Fascist Entryism https://t.me/RevToolboxRedux/520 What to Do If You Receive an Unsolicited Message https://t.me/RevToolboxRedux/528 PDX Decentralized Comms Ruleset https://t.me/RevToolboxRedux/536 Only Networks Can Defeat Networks - decentralized digital struggle https://t.me/RevToolboxRedux/607 The Basics of Firearm Safety https://t.me/RevToolboxRedux/643 Assertive Intervention and Deescalation Tools and Tips https://t.me/RevToolboxRedux/646 Faraday Bag from CLDC https://t.me/RevToolboxRedux/652 How to Lock Your SIM Card https://t.me/RevToolboxRedux/683 How to Spot NYPD Unmarked Cars https://t.me/RevToolboxRedux/685 Digital Safety at Protests https://t.me/RevToolboxRedux/687 Crossing the U.S. Border - crimethinc https://t.me/RevToolboxRedux/742 Gentleman's Guide to Forum Spies and Spooks https://t.me/RevToolboxRedux/750 Atlas of Surveillance - Documenting Police Tech https://t.me/RevToolboxRedux/784 2 Twitter Alternatives https://t.me/RevToolboxRedux/786

Eppie — open protocol encrypted p2p email => https://eppie.io => https://github.com/Eppie-io Eppie is a next-gen providerless email that allows its users to own their accounts, addresses and data. In addition to its own p2p network Eppie can communicate with other popular decentralized networks, like Ethereum, and is capable of interacting with conventional IMAP/SMTP email. It is beautiful and easy to use, just like a normal email client. Features: 🌎 Works on all platforms: Windows, MacOS, Linux, iOS, Android 🕶 Privacy-first: there's no such thing as optional encryption 🚀 P2P messaging: without servers nobody's holding your hand anymore 🔑 Identity manager: key management is a breeze 💾 Decentralized backup: your data is safe and only yours 🤙 Ultimate interoperability: Eppie can communicate with Ethereum, Bitcoin and more 📬 IMAP/SMTP compatible: connect to Gmail, Microsoft Outlook etc. 🦄 Proton Mail Authentication: Eppie is the first native desktop client capable of that 🔐 PGP encryption: stay safe even with conventional email 🤖 Local AI agents NOTE: the project is early in development, not all of the features are publicly availabe via @dcntr #email#p2p

Web fingerprinting is worse than I thought. #article#privacy @thedevs http://thedevs.link/chlPQn

#security 我计算器怎么弹出来了.webp

#security Libbitcoin Explorer 使用了 PRNG 而非 CSPRNG 作为随机数初始源，导致私钥强度不够可能被攻击者猜出。 Libbitcoin Explorer 开发者否认这是一个bug。 编者评：开发者行为很奇怪，据披露文件说在 v2.3.0 (2017年) 的时候还是使用的 std::random_device + std::uniform_int_distribution 来作为随机数源的（也不安全）， v3.0.0 之后就改成 get_clock_speed() + std::mt19937 作为随机数源了。这个刻意的修改我认为应该是故意削弱随机数发生器的安全性。 https://milksad.info/disclosure.html

Safe Space (A safe space for your digital valuables.) Safe space is an app that creates a separate place on your android device to store valuable files. This storage location is not visible to other apps and is encrypted by the system by default. Features: * Store files in a secure storage location that is not visible to other apps and is secured by device encryption and system authentication (Biometric and PIN/Pattern/Password) * Open Images, Audio, Video, PDF documents and plain text documents * Create simple text notes without leaving the app * Dark and light mode * ability to copy and move files * Import from and export files to external storage without storage permissions * Completely offline with no telemetry and data collection https://f-droid.org/packages/org.privacymatters.safespace #cloud#Android#Security#Privacy #EncryptedFiles

https://pyup.io/safety/ Safety checks your dependencies for known #security vulnerabilities. Don't ship insecure code. #Django

Accidental $70k Google Pixel lock screen bypass. #article#security @thedevs https://thedevs.link/Ov4U4b

How to SSH properly. #article#security @thedevs https://kutt.it/mi309r