• 1 Post
  • 263 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle












  • Exactly this, the .zip file extension is widely known, and now that it’s also a TLD, it can be confusing for some people. There’s no technical vulnerability, but the existence of .zip TLD just gives more ammo for phishing. For example, someone could register a domain name recent-bank-statements[.]zip (without brackets) and then have a subdomain for chase.com and send someone a link to https://chase.com.recent-bank-statements/[.]zip to “Download your bank statements”. If you’re not looking closely, you might not realize there is a . instead of a / and think that this link would go to chase.com When the site initiates a download of a zip file, you might trust the contents thinking it came from Chase and not a malicious link.



  • The code being public helps with spotting issues or backdoors.

    A recent example of this is to see the extent that the TALOS group had to do to reverse engineer Dell ControlVault impacting hundreds of models of Dell laptops. This blog post goes through all of the steps they had to take to reverse engineer things, and they note fortunately there was some Linux support with publicly available shared objects with debug symbols, that helped them reverse the ecosystem. Dell has all this source code, and could have identified these issues much more easily themselves, but didn’t and shipped an insecure product leaving the customers vulnerable.



  • The short story i’ve heard it explained was that prior to the 1960’s when logarithm tables were the only option, if what you were calculating was not in the table, you rounded the measurements up so that the material or whatever was stronger, and you knew it would really hold the weight to be certain. Depending on how much rounding up happened during the design, this created lots of redundancy and strength, but was more expensive since you generally had to use more materials. With CAD, you could more easily model and calculate all the loads and optimize the design and material costs for the expected lifetime of the product, building, or whatever. This saved money and was preferred by bean counters, and resulted in designs lasting just enough, rather than older designs which sometimes seemed indestructible.