joernchen

GitHub RCE by Environment variable injection Bug Bounty writeup

Disclaimer: I'll keep this really short but  I hope you'll get the key points.

GitHub blogged a while ago about some internal tool called gerve:
https://github.com/blog/530-how-we-made-github-fast

Upon git+sshing to github.com gerve basically looks up your permission
on the repo you want to interact with. Then it bounces you further in
another forced SSH session to the back end where the repo actually is.

domenic

What to Read After The Thrawn Trilogy?

The first post-Return of the Jedi book series anyone should read is The Thrawn Trilogy: namely Heir to the Empire, Dark Force Rising, and The Last Command, all by Timothy Zahn. They are an excellent introduction to the "New Republic era" of the Star Wars Expanded Universe (EU), and notably they were the first books written in real-world time to explore this era.

But after that, what should you read?

Background: The Eras of the Expanded Universe

First, be aware that the post-Return of the Jedi EU is broken up into three main eras:

densone

<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
<service_bundle type="manifest" name="haproxy">
  <service name="pkgsrc/haproxy" type="service" version="1">
    <create_default_instance enabled="false" />
    <single_instance />
    <dependency name="network" grouping="require_all" restart_on="error" type="service">
      <service_fmri value="svc:/milestone/network:default" />
    </dependency>
    <dependency name="filesystem" grouping="require_all" restart_on="error" type="service">

dominictarr

a Stream spec

---

##UPDATE

I've now moved this stuff into it's own repo and added an executable checker, and some nifty diagrams of the stream state transitions state diagrams

This gist is no longer being maintained. goto dominictarr/stream-spec

---

bnoordhuis

/*
 * Copyright (c) 2011, Ben Noordhuis <info@bnoordhuis.nl>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

aikar

<?php
function echof()
{
    call_user_func_array('AppCommUtility::echof', func_get_args());
}

/**
 * *************************************************************************
 *   PHP5 Application Communication System
 *   *************************************

creationix

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include "uv.h"
#include "http_parser.h"

static uv_stream_t server;
static http_parser_settings settings;

static uv_buf_t refbuf;

kylef

<?xml version='1.0'?>
<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>
<service_bundle type='manifest' name='export'>
  <service name='network/http' type='service' version='0'>
    <instance name='nginx' enabled='false'>
      <dependency name='network' grouping='require_all' restart_on='error' type='service'>
        <service_fmri value='svc:/milestone/network:default'/>
      </dependency>
      <dependency name='filesystem-local' grouping='require_all' restart_on='none' type='service'>
        <service_fmri value='svc:/system/filesystem/local:default'/>