Robert Hansen

@RSnake

CTO, CISO, defender of others' privacy, Advisor, often found joking.

bitdiscovery.com
Beigetreten Juli 2008
142 Fotos und Videos Fotos und Videos

Tweets

Du hast @RSnake blockiert

Bist du sicher, dass du diese Tweets sehen willst? Das Ansehen von Tweets wird @RSnake nicht entblocken.

  1. Angehefteter Tweet
    9. Sept. 2021

    Your security program summarized (probably):

    11 Antworten 61 Retweets 344 Gefällt mir
    Rückgängig machen
  2. 7. März

    Ouch, the Ruble is getting crushed! “So far, the pair is up 17.92% at 145.90 and faces the next hurdle at… Mars?”

    Rückgängig machen
  3. 6. März

    If you enjoy hearing about hypersonic vehicles, rail guns and check this out:

    1 Gefällt mir
    Rückgängig machen
  4. 2. März

    It’s easy to forget China right now, but I wouldn’t.

    As we focus on Ukraine, we must also keep an eye on China. and I discuss on his new podcast.
    1 Retweet 7 Gefällt mir
    Rückgängig machen
  5. hat retweetet
    23. Feb.

    Great presentation I had no idea how really crazy nan was in python

    Diagnosing is extremely hard; not for (Robert Hansen) CTO of - he's found a new class of them. Join us next week Wed 2/23 Noon PST to hear his talk during LA Chapter monthly virtual meeting. RSVP now at
    1 Retweet 2 Gefällt mir
    Rückgängig machen
  6. hat retweetet
    17. Feb.

    Diagnosing is extremely hard; not for (Robert Hansen) CTO of - he's found a new class of them. Join us next week Wed 2/23 Noon PST to hear his talk during LA Chapter monthly virtual meeting. RSVP now at

    , , und
    5 Retweets 7 Gefällt mir
    Rückgängig machen
  7. 16. Feb.

    NaN Injection is just another example of this. It’ll be years before Python has any kind of meaningful response to it (if ever). Meanwhile well-meaning developers will never get guidance or better code to support them. This will leave a legacy of bad code in its wake.

    2 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  8. 16. Feb.

    While true, I prefer architectural level problems, they are the seeds from which CVEs spawn from. I think at a minimum, there has to be a special place for when we find things like “Intranet Port Scanning” which takes the browser companies 18 years to fix.

    1 Antwort 2 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  9. 16. Feb.

    This reminds me of when I was talking to a woman at Microsoft who was handing out tee-shirts of CVEs on the back and I asked which one was mine. She paused and said, “You don’t write the kind of exploits that get CVEs.”

    2 Antworten 1 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  10. 16. Feb.

    This seems like an odd choice of words. Insecure code patterns that the language provides no built-in support to protect against and no default guidance for is absolutely “an issue”.

    1 Antwort
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  11. 16. Feb.

    Regarding NaN Injection here’s the CVE response: ‘After further analysis this is now considered not an issue: "Python is a fully featured programming language, it allows you to write all kinds of programs, including insecure ones." The reject request was sent to Mitre.’

    3 Antworten 1 Retweet 4 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  12. 5. Feb.

    The answer is 0.8999999999999999 similar to how (.1 + .1 + .1) * 20000000000000000 is 6000000000000001.0 Floating points are unsafe when doing comparisons. Moral of the story is don't trust floats in Python without additional work.

    1 Antwort 4 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  13. 3. Feb.

    In Python 3, if the following math equals .9 >>> 0.1 * 9 .9 What do you think this will equal? >>> 0.3 * 3

    2 Antworten 2 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  14. 3. Feb.

    The answer is… “inf” (infinity). Basically there is an upper bounds of where Python can handle floats, and > 1e+308 turns into inf. So, if your code’s math goes too high it becomes all consuming.

    2 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  15. 2. Feb.

    In Python 3 if multiplication of two large floats is: >>> 1e+154 * 1e+154 1e+308 What do you think the following will evaluate to? >>> 1e+154 * 1e+155

    3 Antworten 1 Gefällt mir
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  16. 2. Feb.

    The answer is False due to floating point issues with an exponent as large as 23. Do you expect mathematical truth in your programming languages? >>> int(2.0*10**23) 199999999999999983222784 >>> int(2e23) 199999999999999983222784 >>> int(2*10**23) 200000000000000000000000

    1 Retweet
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  17. 2. Feb.

    Anything past the first few search results on Google, is for all intents and purposes, the deep web.

    1 Antwort 5 Retweets 14 Gefällt mir
    Rückgängig machen
  18. 1. Feb.

    In Python 3, if the following is true: >>> int(2.0*10**23) == int(2e23) True What do you think this will evaluate to? >>> int(2*10**23) == int(2e23)

    1 Antwort
    Diesen Thread anzeigen
    Diesen Thread anzeigen
    Rückgängig machen
  19. hat retweetet
    31. Jan.

    Well, thanks for completely breaking my brain today. Y'all, you GOTTA watch and if you are smart enough to understand it just ponder NaN and the madness that it is. I feel like we've seen this before: -- This is magic.

    1 Antwort 2 Retweets 7 Gefällt mir
    Rückgängig machen
  20. hat retweetet
    13. Jan.

    It's been way too long since I had my pal on the podcast, so we remedied that today to talk about his wild new research into NaN injections and other stuff.

    2 Retweets 2 Gefällt mir
    Rückgängig machen
  21. 12. Jan.

    Wow - only took the browser companies 18 years to figure out intranet port scanning + CSRF was a real problem. ;)

    Chrome will add a feature this year that will block internet sites from accessing systems on local networks, such as routers, servers, or other internal corporate resources Called Private Network Access, this system will roll out with Chrome 98 and 101
    Diesen Thread anzeigen
    11 Retweets 21 Gefällt mir
    Rückgängig machen

@RSnake hat noch nichts getwittert.

Das Laden scheint etwas zu dauern.

Twitter ist möglicherweise überlastet oder hat einen vorübergehenden Schluckauf. Probiere es erneut oder besuche Twitter Status für weitere Informationen.

    Vielleicht gefällt dir auch

    ·