Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @s0md3v

Somdev Sangwan

@s0md3v

May 24, 2022

🚨 ALERT 🚨

Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined.

The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials.

First lead: reddit.com/r/Python/comme…

Then with a github search of the heroku subdomain, I found out packagist.org/packages/haute… has been also compromised which has over 2M downloads.

This seems to be an attempt to mine AWS creds as per the phpass source: github.com/hautelook/phpa…

The attacker likely got access to the maintainers of these packages by spraying credentials over a huge list of high value user accounts.

Attacker's identity is obv but it would be irresponsible to take names without undeniable proofs.

Compromised packages have been reported.

Read 7 tweets

Somdev Sangwan

@s0md3v

May 5, 2021

"I have nothing to hide, why should I care about companies collecting my data?" - a thread 📃

First, let's talk about the kind of data that is collected.

Direct: Name, location, face, gender, profession, relationship status, things you have bought or wishlisted, your messages

Deduced: approx income, favorite activities, sleeping schedule, political/religious views, medical issues, academic qualification, if you have pets, types of content you like, screen time, if you have kids, if you moved recently etc.

Now, how do they use this data?

For showing you ads based on your personality, research, training their AIs to deduce more things, influencing masses, selling the data to another company etc.

Now, coming back to the original question. Why should one care? There are at least two good reasons.

Read 7 tweets

Somdev Sangwan

@s0md3v

May 2, 2020

postMessage - a thread

Each open tab in your browser is called a "window object" including iframes.

postMessage is a JS feature that lets these windows talk to each other without caring about Same Origin Policy restrictions.

To understand it well let's create two webpages...

...named send.html & recieve.html

send.html contains another page recieve.html in an iframe and sends a message to it using postMessage.

The first argument of postMessage is the message and the second is the origin we want to sent he data to. If we set it to *, it will...

...send the data to anything that's in the iframe.

Now let's talk about receive.html, if it receives a message, it writes it to the document.

You can test it yourself, the code is here:

send.html: gist.github.com/s0md3v/d5a91bf…
recieve.html: gist.github.com/s0md3v/80ef108…

Read 8 tweets

Somdev Sangwan

@s0md3v

Sep 10, 2019

Learn Regex in 4 tweets :)

cat matches cat
ca+t matches caaaaaaaaaaaat but not ct
ca*t matches caaaaaaaaaaaat and also ct
ca{2,4} matches caat, caaat and caaaat
c(at)+ matches catatatatatat
c(at|orn) matches cat and corn
c[ea] matches cat and cet
c[ea]+ matches caaaat and ceeet

c[A-C0-9] matches cAt, cBt, cCt, c8t etc.
c.t matches cat, c&t, c2t (any char between c and t)
c.+t matches c3%x4t (any number of any chars)
c.*t matches c3%x4t and as well as ct
^ denotes start of a string, $ denotes the end
^a+cat will match aaacat in aaacat but not in bbaaacat

cat$ will match cat in aaacat but not in aaacats
^cat$ will match only and only this string i.e. cat

\d is for digits, \w for alphanumeric chars, \s is for white space chars & line breaks
\D is for non-digits, \W for non-alphamueric chars and \s is for non-white space chars

Read 12 tweets

Share this page!

Enter Twitter Thread URL to Unroll

Somdev Sangwan

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @s0md3v

Somdev Sangwan

Somdev Sangwan

Somdev Sangwan

Somdev Sangwan

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!