Skip to content

Instantly share code, notes, and snippets.

View chooper's full-sized avatar

Charles HooperLee chooper

22 followers · 20 following
View GitHub Profile
@chooper
chooper / redirect-to-xss.html
Created April 7, 2020 15:03
<!DOCTYPE html>
<!-- Demonstration of how a JavaScript redirect can be used as an XSS -->
<!-- For more more detail see https://subfn.net -->
<!-- Authored by Charles H ("subfn") <chooper@plumata.com> -->
<html>
<head>
<title>Testing JS redirect as XSS vector</title>
<script>
function goNext() {
current_url = new URL(window.location.href);
@chooper
chooper / README.md
Last active October 25, 2015 06:58
Work laptop setup

Work laptop setup

  1. System Prefs > Security & Privacy > Turn on filevault

  2. System Prefs > Trackpad > Scroll & Zoom > Uncheck “Scroll direction: Natural”

  3. System Prefs > Energy Saver > Turn off display after: 20 minutes

  4. Install security updates

@chooper
chooper / git-stats.sh
Last active August 29, 2015 14:20
Get the insertions and deletions for the last six months
#!/bin/bash
# Get the insertions and deletions for the last six months
git log --since 'last 6 months' --shortstat master > stats.log
@chooper
chooper / redis-multi-cred-proposal.md
Last active August 29, 2015 14:09
A proposal I'm working on for the redis mailing list to allow multiple configured passwords for the purpose of better supporting credrolls

Greetings,

I am writing today to propose that redis should be able to support more than a single password. I know that many authentication and authorization schemes have been raised here before, but what makes this proposal different is that this is expressly for the purpose of supporting credrolls. This, I believe, will lead to a simpler implementation that will maintain many of the current behaviors.

Background

Credrolls, or credential rotations, are difficult with the "single password only" scheme today. Currently, consumers of the redis server must expect to have failed requests for a short window while Redis passwords are being changed or they must be extended to be able to try multiple passwords when making requests. Today a credroll works by:

  1. Changing the redis password: requirepass newpassword

  2. Updating all of the consumers to use the new password

@chooper
chooper / steam-status.txt
Created March 30, 2014 00:21
sub@asdf:~$ time curl http://localhost:8080/?usernames=chuckbang,foxhop,japherwocky
[{"url":"http://steamcommunity.com/id/foxhop/","steamid":"76561197960708678","personaname":"Foxhop","summary":"No information given.","ingame":""},{"url":"http://steamcommunity.com/id/japherwocky/","steamid":"76561198049551053","personaname":"japherwocky","summary":"No information given.","ingame":"Team Fortress 2"},{"url":"http://steamcommunity.com/id/chuckbang/","steamid":"76561197961485911","personaname":"chuck!","summary":"No information given.","ingame":"Counter-Strike: Global Offensive"}]
real 0m0.468s
user 0m0.004s
sys 0m0.012s
@chooper
chooper / keybase.md
Created March 11, 2014 18:43

Keybase proof

I hereby claim:

  • I am chooper on github.
  • I am charleshooper (https://keybase.io/charleshooper) on keybase.
  • I have a public key whose fingerprint is D034 0F79 3E71 7C53 DAC9 0388 5829 17FE 9FAD DAA9

To claim this, I am signing this object:

@chooper
chooper / gnutls-lib-x509-verify.c
Created March 4, 2014 21:29
if (is_level_acceptable(cert, issuer, sigalg, flags) == 0) {
gnutls_assert(); /* this didn't exist before */
out =
GNUTLS_CERT_INSECURE_ALGORITHM |
GNUTLS_CERT_INVALID;
if (output)
*output |= out;
result = 0;
goto cleanup; /* or this */
}
@chooper
chooper / Gemfile
Last active August 29, 2015 13:56 — forked from jimdanz/customer_fetch.rb
source "http://rubygems.org"
gem "stripe"
@chooper
chooper / door-irb-output.log
Created November 1, 2013 20:53
Just some playing around with a state machine representing a door that can lock, with "locked" being a separate state from "closed"
sub@asdf:~/projects/fsm$ irb -I
irb(main):001:0> require './door.rb'
=> true
irb(main):002:0> front_door = Door.new
=> #<Door:0x00000001913ab0 @state="closed">
irb(main):003:0> front_door.open_
Transition: closed => open
=> true
irb(main):004:0> front_door.close
Transition: open => closed
@chooper
chooper / adams-heroku-values.md
Created June 1, 2013 00:01 — forked from adamwiggins/adams-heroku-values.md

Make it real

Ideas are cheap. Make a prototype, sketch a CLI session, draw a wireframe. Discussions around concrete examples, not handy-waving abstractions. Don't say you did something, provide a URL that proves it.

Ship it

Nothing is real until it's being used by a real user. This doesn't mean you make a prototype in the morning and blog about it in the evening. It means you find one person you believe your product will help and try to get them to use it.

Do it with style