Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Daniel Cuthbert Profile picture
@dcuthbert
Sep 11, 2020 • 5 tweets • 3 min read • Read on X
Arnaud Montagard's images of America are just to die for. They remind me of William Eggleston and do nothing to stop my desire to do a proper road trip from coast to coast avoiding the main roads. ImageImageImageImage
As expected with such a compelling body of work, his first book is sold out and I'm a bit gutted but you snooze and you lose. Image
For now, his website will suffice

arnaudmontagard.com

Brilliant eye #photography
Dearest America.

Try not to descend into civil war after November. A large number of us foreigners do like your country and your people (well, not all of them) and we'd like to come back to get a Winnebago and drive all those crazy states away from the main cities.

Love us.
It goes without saying that his tool of choice is possibly *the* best camera and lens setup ever made: The Mamiya 7

@arnaudmontagard Un travail incroyable, merce!

Now to find your book!!!! Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Daniel Cuthbert

Daniel Cuthbert Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @dcuthbert

Daniel Cuthbert Profile picture
Apr 11
Strap in, we's going on a ride, a static analysis ride. I recently came across this paper, which looked at a wide variety of SAST tools against a number of Java apps.

Java being the choice of enterprise, and often not the best Java approaches out there, so it's a good choice Image
First up, what did they use and what did they benchmark it against?

They looked at free tools, tools that specifically supported Java and most importantly, are being actively maintained. Image
The target was the @owasp project, a good choice imho. They also looked for Java apps with bugs with disclosed CVEs which was around 680 programs.

This gives them a fair amount of apps to look at, which is goodowasp.org/www-project-be…
Read 21 tweets
Daniel Cuthbert Profile picture
Oct 11, 2023
Bugs happen but it's rare you see a bug that grabs you so hard and makes you nod like a little dog..

CVE-2023-44487 did that for me

good god what a bug and here's why
First up is understanding the key differences between HTTP 1.1 and 2, especially how requests work

HTTP 1.1 is a text-based protocol that uses a single connection for each request/response pair. Every time you request the / from , it will be a diff request NSA.gov
Image
for each element of that page (CSS, images etc)

HTTP 2 is a binary protocol that utilises multiplexing, which allows multiple requests and responses to be sent simultaneously over a single connection

much better. more efficient. many wows Image
Read 16 tweets
Daniel Cuthbert Profile picture
Jun 9, 2023
An interesting new feature found in @Apple’s latest privacy and security report is that of Link Tracking Protection and I’ve not stopped thinking about this Image
First up it’s pretty cool. My views on the pervasive nature of the tracking industry are not something I’ve hidden away: it’s an ugly industry with no real oversight, so any efforts to put a finger in their eye is one to applaud

The approach by Apple is interesting
First up is the deeper inspection (I’m assuming client only) that intercepts any url and does a regex on it to strip out utm and other crap added to the url

If it works like that, I’m impressed. However, how much stuff will it break in the process? I guess time will tell
Read 6 tweets
Daniel Cuthbert Profile picture
Jun 9, 2023
Here’s the thing right: if you are building any application/binary or indeed something that takes input and uses that to form the basis of further functions/actions, you kinda need to think about robustness.

Imagine a HTTP POST request to /remote/portal/bookmarks
What is needed is Content-Length, which indicates the size of the corresponding body. This is how the web works, so to send and indeed accept a zero byte body is odd and you’d check for that right?

Bueller? Right??
Well it seems not and there’s a brilliant write up of why this was a problem that caused a segfault in a SSL VPN appliance by Aliz Hammond over at @watchtowrcyber

labs.watchtowr.com/fortinet-and-t…
Read 9 tweets
Daniel Cuthbert Profile picture
Jun 7, 2023
It was 1998 and I was helping build this newfangled web thing for the Financial Times, called ft.com

We had a handful of Solaris boxes and oracle DBs (it was secure they said) but we were running out of IPv4 addresses in our allocation.
The daily routine used to be monitor checkpoint FWs and add new rules to stop silly attempts at scanning Solaris, adding rules to allow apache to talk to oracle and so on. Then Cisco came out with this box that meant we could use a handful of IPv4 and then rfc1918 in our DC
Holy shit, this means they couldn’t see our database servers anymore! Pete, this changes everything

All was going so damn well until that bloody rain forest puppy releases this paper taking about hurting SQL servers. Wtf is xp_cmdshell and why can you see internal servers??
Read 4 tweets
Daniel Cuthbert Profile picture
Jan 24, 2023
When the twitter dump came out, I enjoyed having a “theoretical” chat with John about how you “theoretically” would weaponise this. It’s not a new topic per se, we did abuse this in yesteryear but it doesn’t make it any softer a threat.
The post looks into the stuff you could “theoretically” do with expired domains and the likes. thecontractor.io/blog/malinheri…
Because we’ve tied our digital existence to emails and domain names, they become the Crown Jewels. Compromise that and the Tower of London is no longer yours. This is made harder with custom domains and mail servers, as if you give up that domain (I mean it’s not like we collect)
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(