kidk

[kidk @kidk]

Why would you go after uptime? To make money? No, no, no. If you show people 99% uptime, they’ll ask 'why not 99.9%?'. And it will never be enough. But if you have no uptime, you can say you’re pre-stable, and you’re a potential pure play

[m@ttias ⚡️ @mattiasgeniar]

Let's play a game: guess the unicorn 😂

[kidk @kidk]

random time ofc

[kidk @kidk]

That's why I add a sleep after every string compare

[Alexandre Daubois @alexdaubois]

Timing attacks are real, and most devs don't protect against them.

When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't.

An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically.

hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time.

Same applies to #golang: use crypto/subtle.ConstantTimeCompare().
Same in #nodejs: crypto.timingSafeEqual().

If you're comparing secrets with == or ===, you may be leaking information through time!

[kidk @kidk]

@tmeire_ and macOS is not notch aware 🙃

[kidk @kidk]

Why tho

[Sawyer Merritt @SawyerMerritt]

SpaceX: "The Starlink team is exploring using Starlink to enable high bankdwith connectivity around the Moon; Traditionally, deep space comms have relied on radio frequency transmission. This new design would use lasers to relay data back to Earth. Deploying that technology around the Moon could connect it with hundreds of terabits of capacity. This could enable Gigabit connectivity anywhere on the lunar surface."

🤯

[kidk @kidk]

@reprise_99 Well someone woke up today and chose violence 😂

[kidk @kidk]

lol wat

[Aikido Security @AikidoSecurity]

Deleting a Google API key doesn't revoke it immediately.

Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.

Google closed our report as "won't fix."

[kidk @kidk]

@Eliaarika @AikidoSecurity As the technical product manager on the product. I don't need to know what you do, I don't want to know what you do and I definitely don't want to talk to legal 😂 We focused hard on privacy for this.

[kidk @kidk]

@Eliaarika @AikidoSecurity Not self hosted. We do have our open source solution that doesn't require a central server https://t.co/56hw73MMCL

Yup GDPR complaint as ALL blocking happens on your local machine. More info here: https://t.co/AbpLmLgHoF

[kidk @kidk]

@tmeire_ Nice. Mind just posts "will not fix" and closes ticket. Covers about 90% of my workload.

[Aikido Security @AikidoSecurity]

Aikido Intel is your earliest warning for supply chain threats.

Our engine detects malware and vulnerabilities in open-source ecosystems within minutes.

Built by our team of security researchers & AI engineers.

Bookmark it: https://t.co/utLseYtAra

[NASA Mars @NASAMars]

Got something weighing you down? Shake it off (like Curiosity)!

The Martian explorer unintentionally picked up a rock while drilling a recent sample, but the team was able to dislodge it by having the rover move its robotic arm and vibrate the drill until the rock fell off.

[kidk @kidk]

Fact checked 😂

[Jason Howerton @jason_howerton]

The Bible is the most studied, scrutinized & fact-checked book in history. It has 340,000 cross references spanning thousands of years and dozens of authors, all telling the same story.

No archaeological find has ever disproven the Bible.

The Bible is real.

[kidk @kidk]

@NathaSupertramp Damn, dat valt theegen.

[kidk @kidk]

@tmeire_ https://t.co/rCXlcMYNYP 😘

[kidk @kidk]

@tmeire_ @DanielLockyer @newrelic Ah lol ok

[kidk @kidk]

@tmeire_ @DanielLockyer @newrelic Yup. 👍 will forward it

[kidk @kidk]

@Steve_Fowler_ @GeertBaeke @svpino True, but lets be honest, neither can most humans 😂

[kidk @kidk]

@Steve_Fowler_ @GeertBaeke @svpino Not sure why you’re asking that but yes.

[kidk @kidk]

@GeertBaeke @svpino I fear the reverse is true. When I use AI it works for 90% of cases but the last 10% is hard to figure out and is usually a corner case that requires in depth knowledge. To be fair AI helps to figure it out but often doesn't give a complete solution.