• 0 Posts
  • 30 Comments
Joined 2 years ago
cake
Cake day: June 10th, 2024

help-circle



  • But in all seriousness, they’re still unmaintaible slop

    They are definitely more user-friendly and community-maintainable than the closed-source originals.

    Originals are either binaries you can’t modify, or completely black-box inaccessible software someone else runs which you only interact with.

    Having some source code which does almost the same thing, even if it’s buggy, is much better than having nothing at all.

    Of course AI has its own issues and the resulting software is pretty bad. It is a great starting point to be improved tho.










  • Operator overloading is awesome in a functional language. Haskell allows for a lot of creative stuff with operators, but since they can’t have side effects, must conform to predictable types, and have specific requirements they are somewhat understandable. Idris is also very ergonomic when it comes to operators.

    C++ allowing a library to override the + operator with system("rm -rf /") is a lot less awesome.







  • all i can say is that i need to log into outlook to log into teams, because logging into teams directly is broken, but the cross site cookie work…

    Thankfully I don’t even have an MS account, but I do implore you to check out the cookies and see for yourself that they will have a specific list of domains they are valid for.

    Open the browser developer menu on an Outlook tab (F12), navigate to “Storage” → “Cookies” (may be named slightly differently in different browsers), and look at the “Domain” column in the table.

    and reading stuff like adFection really doesn’t instill confidence in opening random websites.

    The problem there is website operators selling their adspace to a literal israeli spyware company, which meant injecting adversarial javascript into their own pages. It was not a case of “user opening a random link”, rather it was the website operator themselves forwarding the user malicious JS from the “ad company”. As a user there’s generally nothing you can do to prevent this kind of attack where the website itself was compromised; besides, without another vulnerability/attack vector the impact will be limited to the website in question.


  • No, you generally should not be worried about that.

    Generally the worst thing that a website can get from you just opening a URL is (1) whether or not you’re logged in to google/facebook/etc, (2) your advertisement profile/who you are, (3) roughly where you are. All those are privacy issues, not a security issue, hence not very related to the “cybersecurity course”, and only the first one is tangentially related to being logged in.

    You should of course use various anti-tracking measures, e.g. an adblocker, “resist fingerprinting” in Librewolf, user agent faker, a good VPN, etc. That will reduce the exposure to all 3 issues above, but once again those are not security problems.

    You should also never download random bullshit to your computer. Having an actual file on disk outside the browser sandbox could indeed be an issue. You could simply forget where it came from and decide to execute it one day, or there could be some bug in some app on your OS which could trigger a code execution exploit.

    However, if your browser shares authentication details with random websites like what you are describing, you should stop using it immediately.