🚨 ALERT 🚨

Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined.

The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials. First lead: reddit.com/r/Python/comme…

Then with a github search of the heroku subdomain, I found out packagist.org/packages/haute… has been also compromised which has over 2M downloads.

This seems to be an attempt to mine AWS creds as per the phpass source: github.com/hautelook/phpa…

"I have nothing to hide, why should I care about companies collecting my data?" - a thread 📃

First, let's talk about the kind of data that is collected.

Direct: Name, location, face, gender, profession, relationship status, things you have bought or wishlisted, your messages Deduced: approx income, favorite activities, sleeping schedule, political/religious views, medical issues, academic qualification, if you have pets, types of content you like, screen time, if you have kids, if you moved recently etc.

Now, how do they use this data?

postMessage - a thread

Each open tab in your browser is called a "window object" including iframes.

postMessage is a JS feature that lets these windows talk to each other without caring about Same Origin Policy restrictions.

To understand it well let's create two webpages... ...named send.html & recieve.html

send.html contains another page recieve.html in an iframe and sends a message to it using postMessage.

The first argument of postMessage is the message and the second is the origin we want to sent he data to. If we set it to *, it will...

Learn Regex in 4 tweets :)

cat matches cat
ca+t matches caaaaaaaaaaaat but not ct
ca*t matches caaaaaaaaaaaat and also ct
ca{2,4} matches caat, caaat and caaaat
c(at)+ matches catatatatatat
c(at|orn) matches cat and corn
c[ea] matches cat and cet
c[ea]+ matches caaaat and ceeet c[A-C0-9] matches cAt, cBt, cCt, c8t etc.
c.t matches cat, c&t, c2t (any char between c and t)
c.+t matches c3%x4t (any number of any chars)
c.*t matches c3%x4t and as well as ct
^ denotes start of a string, $ denotes the end
^a+cat will match aaacat in aaacat but not in bbaaacat