Feross Aboukhadijeh

https://feross.org though I mostly blog at https://socket.dev these days.

A couple of my favorite technical blogs - https://openai.com/blog/ - https://ai.googleblog.com - http://antirez.com/ - https://research.facebook.com/blog/ - https://martin.kleppmann.com/archive.html - https://devblogs.microsoft.com/oldnewthing - https://www.allthingsdistributed.com/ - https://jvns.ca/ - https://www.johndcook.com/blog - http://feross.org/ - https://ridiculousfish.com/blog/ - https://blog.andrewcantino.com/ - https://nickcraver.com/blog/ - https://blog.codinghorror.com I have been also building an engineering blog aggregator called https://diff.blog to make it super easy to disover and follow blogs. Would love if you folks can give it a try :)

A fun historical example: https://feross.org/gcc-ownage/ But yes, generally, UB manifests as "the compiler is allowed to assume this doesn't happen" and the bad stuff is a consequence of doing things following those assumptions, not the compiler going "oops well lol UB time to screw with this person."

This is one of the reasons why I always join a Zoom call from my phone, by calling their international numbers [1]. Recruiters sometimes ask me to turn my video on during interviews… I politely decline and move on to other opportunities. Their app is so privacy invasive, I cannot understand why people keep using it, specially considering 2018 vulnerability [2]. Feross Aboukhadijeh talks about Zoom security problems in Stanford’s CS253 Web Security course [3][4]. [1] https://zoom.us/zoomconference [2] https://www.tenable.com/blog/tenable-research-advisory-zoom-unauthoriz… [3] https://web.stanford.edu/class/cs253/ [4] https://feross.org/

@feross published an experiment on funding mechanisms on opensource. https://feross.org/funding-experiment-recap/ My suggestions for now would be BountySource (great for micro-financing on issues) and GitCoin (great for crypto-payments)

The rationale from the author of the package who adding advertising is enlightening and definitely worth reading. https://feross.org/funding-experiment-recap/

The author gave a talk on this: https://www.dotconferences.com/2017/12/feross-aboukhadijeh-the-most-an… Some great links present there. https://feross.org/webcam-spy/ https://feross.org/html5-fullscreen-api-attack/ https://feross.org/ http://www.filldisk.com/ https://developer.mozilla.org/en-US/docs/Web/API/Window/open

Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work? I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.

Also noteworthy: Using the HTML5 Fullscreen API for Phishing Attacks http://feross.org/html5-fullscreen-api-attack/ Mozilla Full-screen API Security Review https://wiki.mozilla.org/Security/Reviews/Firefox10/CodeEditor/FullScr…

http://feross.org/fill-disk/ He explains here that most browsers (except Firefox) don't follow the standard close enough, and ignore the exception for subdomains, i.e. 1.filldisk.com, 2.filldisk.com, etc.

There's a rule in HTTPS everywhere https://www.eff.org/https-everywhere for your site. It redirects feross.org to https://www.feross.org which currently doesn't work.

Admittedly, this is a bit of an exaggerated conclusion. It is definitely possible that some subset of top CS MIT students would get anxious about coding interviews and would go to interviewing.io to hone their skills. However, the following types of top students are significantly less likely to practice on interviewing.io, for example: - Seniors who have already done internships at top companies (Google, FB, Stripe, etc) - People who excelled at programming contests and generally enjoy algorithmic challenges: IOI, TopCoder, Project Euler, etc. - People who have built awesome open-source projects that got significant recognition. For example, Feross Aboukhadijeh was a Stanford student who built Youtube Instant and immediately received an internship offer from Youtube founder Chad Hurley [1]. I doubt people like him would need to practice on interviewing.io - In general, students who are regarded as top n% of MIT/Stanford/CMU CS are inundated with recruiting pitches (I speak from experience as a CS graduate from one of these universities. Most of us constantly received an overwhelming number of e-mails from recruiters, many of them offering to get us to get fast-tracked in the interview process). Granted, not every top CS student at MIT/Stanford/CMU has done competitive programming or built really cool stuff that's widely recognized. But a significant percentage of the top n% of students do have this kind of background (admittedly, this is somewhat of a circular…

As we all know security through obscurity only buys you time like the article points out. Please correct me if I'm wrong but a pretty simple solution exists here. I run SSH over port 22 and do the following which I think is a pretty reasonable and safe solution (again, please correct me if I'm wrong): 1. Configure a decent firewall, edit iptables and disable anything you aren't or don't plan to use. 2. Disable root login completely. 3. Install fail2ban just in case and set it to block IPs of failed attempts for 2 to 24 hours 4. Use key based authentication and disable SSH logins using passwords altogether. I'd recommend going a step further on number 4 and put a strong password on your key. A lot of people believe that key based authentication in and of itself is enough but if you somehow leak your keys and there's no password on them then an attacker has just easily gained access to your machine. Now I'm guilty of not using a password with my keys because like a lot of people it feels like it defeats the purpose but you can actually set things up so that you only need to enter your password once and it won't ask you for it again for a while just like the sudo "grace period" which lets you sudo without a password after you've entered it once. I do plan to give my keys a password and stop being so lazy in the very near future. I know the Linode library as well as a few posts that have made it to the front page here explain how to do this. Here are the…

> including generating a program that segfaults or something else. UB = run nethack or Emacs: https://feross.org/gcc-ownage/ We should have kept this behaviour. It would make UB a lot more unpalatable and easy to find.

I've never heard of it doing rm -rf, but apparnetly it did try to launch nethack under certain unknown preprocessor conditions: https://feross.org/gcc-ownage/?1?1 https://gcc.gnu.org/pipermail/gcc/2002-January/074450.html

The C standard is accomodating as always: https://feross.org/gcc-ownage/

Yes, an LLC is the simplest way to protect yourself from personal liability, and a good idea if you plan on providing any sort of goods or services to others. You should form an LLC in the state where you live. Here's a nice guide for how to do this in California: https://feross.org/form-california-llc/

feross (creator of this project and submitter of this thread) didn't mention his background/experience/pedigree but I can point out that he knows his shit. Check out his resume: https://feross.org/resume I became aware of his existence after I realized he was clever enough to set up a bot to watch new posts on https://web.dev (I used to be content lead for that site) and automatically post every new thing here on HN

Here is the experiment on terminal ads case https://feross.org/funding-experiment-recap/

don't many traditional clients support webtorrent as well? https://feross.org/libtorrent-webtorrent/

And Feross himself is a perfect example of one who is trying out different ways to be a full-time open source developer: https://feross.org/funding-experiment-recap/ Having companies and individuals supporting him: https://feross.org/thanks/ As well as offering actual support contracts: https://feross.org/support/

This is highly unrelated, sorry, but does anyone know the zsh theme used in that post (https://feross.org/images/funding-screenshot.png)? I didn't see anything like it in the list of zsh themes (https://zshthem.es/all/). The colored arrows look very appealing if they're contextual, like if they denote the status of git files (deleted/edited/added).

Found it: >When GCC identified “bad” C++ code, it tried to start NetHack, Rogue, or Towers of Hanoi. Failing all three, it would just print out a nice, cryptic error message. https://feross.org/gcc-ownage/

Even worse, the pathetic 5mb limit is trivially bypassed, so it's really just an annoying but ineffective restriction: http://feross.org/fill-disk/

We actually (almost) have that. It is called gcc. A long time ago, when encountering "undefined" behavior, it would try to launch Nethack[1]. (It is valid behaviour, according to the spec.) Seriously, ask around. There was a multi-month fat-chewing about gcc's pathological interpretation of "undefined" earlier this year on the Cryptography list, and tends to come up anywhere C programmers with an interest in security drink. [1] http://feross.org/gcc-ownage/?1?1

The warning is a bit annoying, but without it attacks like this would be harder to spot: http://feross.org/html5-fullscreen-api-attack/ (it's just a proof-of-concept, no malicious payload)

>What abuse? phishing attacks. https://en.wikipedia.org/wiki/Phishing http://feross.org/html5-fullscreen-api-attack/ >I think it's a similar risk to letting people walk down the footpath. No, that's a really shitty analogy. It's more similar to a personal location-tracking mobile device where a lot of people store private and sensitive information, on which you can access web pages and install apps that have the ability to read that information, sometimes in ways beyond what the user expects.

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obviously fake. It doesn't work already with current security tech: 1) browsers ask for fullscreen permission (with big unmissable dialogs) 2) emulated fake layout is very different from real layout (missing all per-user specific browser settings, e.g. bookmarks or extension buttons or any theme customizations, also font rendering looks different) 3) emulated fake browser UI doesn't respond to interactions in the same way as native UI

Check out the first sentence/paragraph of this post: http://feross.org/html5-fullscreen-api-attack/ (from https://news.ycombinator.com/item?id=4629906)

You can do it with spoofmac - http://feross.org/spoofmac/ It should be easy to wrap some Applescript around it to make it automatic.