Why would you go after uptime? To make money? No, no, no. If you show people 99% uptime, they’ll ask 'why not 99.9%?'. And it will never be enough. But if you have no uptime, you can say you’re pre-stable, and you’re a potential pure play
Timing attacks are real, and most devs don't protect against them.
When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't.
An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically.
hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time.
Same applies to #golang: use crypto/subtle.ConstantTimeCompare().
Same in #nodejs: crypto.timingSafeEqual().
If you're comparing secrets with == or ===, you may be leaking information through time!
SpaceX: "The Starlink team is exploring using Starlink to enable high bankdwith connectivity around the Moon; Traditionally, deep space comms have relied on radio frequency transmission. This new design would use lasers to relay data back to Earth. Deploying that technology around the Moon could connect it with hundreds of terabits of capacity. This could enable Gigabit connectivity anywhere on the lunar surface."
🤯
Deleting a Google API key doesn't revoke it immediately.
Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.
Google closed our report as "won't fix."
@Eliaarika@AikidoSecurity As the technical product manager on the product. I don't need to know what you do, I don't want to know what you do and I definitely don't want to talk to legal 😂 We focused hard on privacy for this.
@Eliaarika@AikidoSecurity Not self hosted. We do have our open source solution that doesn't require a central server https://t.co/56hw73MMCL
Yup GDPR complaint as ALL blocking happens on your local machine. More info here: https://t.co/AbpLmLgHoF
Aikido Intel is your earliest warning for supply chain threats.
Our engine detects malware and vulnerabilities in open-source ecosystems within minutes.
Built by our team of security researchers & AI engineers.
Bookmark it: https://t.co/utLseYtAra
Got something weighing you down? Shake it off (like Curiosity)!
The Martian explorer unintentionally picked up a rock while drilling a recent sample, but the team was able to dislodge it by having the rover move its robotic arm and vibrate the drill until the rock fell off.
The Bible is the most studied, scrutinized & fact-checked book in history. It has 340,000 cross references spanning thousands of years and dozens of authors, all telling the same story.
No archaeological find has ever disproven the Bible.
The Bible is real.
@GeertBaeke@svpino I fear the reverse is true. When I use AI it works for 90% of cases but the last 10% is hard to figure out and is usually a corner case that requires in depth knowledge. To be fair AI helps to figure it out but often doesn't give a complete solution.