Re: [Full-disclosure] A question for the list - WordPress plugin inspections

2014-02-19 Thread Seth Arnold
On Wed, Feb 19, 2014 at 06:40:51PM +, Harry Metcalfe wrote: We write and publish light-touch inspections of WordPress plugins that we do for our clients. They are just a guide - we conduct some basic checks, not a thorough review. Would plugins which fail this inspection be of general

Re: [Full-disclosure] Ubuntu, duckduckgo, and additional info

2014-01-15 Thread Seth Arnold
On Wed, Jan 15, 2014 at 05:47:24AM -0700, silence_is_b...@hushmail.com wrote: I see thank you. My distribution.id nuke did nothingany way to disable this? It's all about choice after all right ;) Depends upon the browser. For Firefox, see:

Re: [Full-disclosure] Ubuntu, duckduckgo, and additional info

2014-01-14 Thread Seth Arnold
On Tue, Jan 14, 2014 at 05:41:42AM -0700, silence_is_b...@hushmail.com wrote: Any particular reason when setting duckduckgo as the default search and searching from the url bar we get an additional nugget of info sent? Case in point: GET /?q=add+duckduckgot=canonical HTTP/1.1 [...] I

Re: [Full-disclosure] EasyPHP 12.1 - Remote code execution of any php/js on local PC

2012-12-03 Thread Seth Arnold
On Mon, Dec 03, 2012 at 06:44:24PM -0500, Jeffrey Walton wrote: Yes, we have responsibility, but no enough time to make a new release. ... This failure will never used by real hackers because it's better to found something in Acrobat or other wildspread soft. ... So stop crying, kiddy.

Re: [Full-disclosure] bash path normalization bug

2012-11-19 Thread Seth Arnold
On Thu, Nov 15, 2012 at 10:09:56PM +0200, Andris Berzins wrote: $ bash --versionbr /GNU bash, version 4.2.8(1)-release (x86_64-pc-linux-gnu)br /br /$ bash --versionbr /GNU bash, version 4.0.28(1)-release (i386-pc-solaris2.8)br /br /Bash fails to normalize path starting starting with // and

Re: [Full-disclosure] Security risks of doing business with China?

2012-11-02 Thread Seth Arnold
On Thu, Nov 01, 2012 at 08:43:10AM +, Dan Ballance wrote: I greatly respect the collective knowledge about security matters on this list. What do you make of this BBC report? Here in the UK we are seeming happy to do business with China, but other countries are blocking over alleged

Re: [Apparmor-dev] Re: [Full-disclosure] Re: [SC-L] Re: [Owasp-dotnet] RE: 4 Questions:Latest IE vulnerability, Firefox vs IE security, User vs Admin risk profile, and browsers coded in 100% Managed V

2006-04-07 Thread Seth Arnold
On Thu, Apr 06, 2006 at 12:01:06PM -0400, Brian Eaton wrote: Does cap_setuid give a program enough authority to break out of the AppArmor profile? Not directly, no; however, because a process with this capability can forge credentials over unix domain sockets it is possible that it could entice