Skip to content

Instantly share code, notes, and snippets.

View oreoshake's full-sized avatar
:octocat:
I used to make it easier to develop this site securely

Neil Matatall oreoshake

:octocat:
I used to make it easier to develop this site securely
View GitHub Profile
rough match? character character's ethnicity actor actor enthnicity Birthplace
🛑 Vega Spannish Jay Tavare Native American Navajo Nation
🛑 Sagat Thai Wes Studi Cherokee Oklahoma
🛑 E. Honda Japanse Peter "Navy" Tuiasosopo Samoan USA (California)
🛑 Ryu Japanese Byron Mann Chinese Honk Kong
🛑 Bison Brazilian? Thai? British? Raul Julia Puerto Rico Puerto Rico
🛑 Blanka Brazilian Robert Mammone Australian? Australia
🛑 Zangeif Russian Andrew Bryniarski American USA
🛑 Guile American Jean Claude Van Damme Belgian Belgium
@oreoshake
oreoshake / benchmark.rb
Created January 28, 2022 07:06
Large files and ruby
require "benchmark-memory"
require "benchmark"
require "benchmark/ips"
TEST_FILE = ARGV.first
# TODO this might not be ideal but is a good start (apostrophes aren't at the beginning of a word for example, hyphens can't be at the beginning or end, there may be more punctuation to consider)
WORD_SPLIT = /[\w'-]+/
def lazy_grep
@oreoshake
oreoshake / stats.rb
Last active June 14, 2020 19:41
A simple script to keep tabs on an organizations use of default branches. It requires a personal access token for private repos.
# End qualified immunity
# End cash bail
# Defund the police
# Invest in addiction treatment, education, and healthcare
#
# Donate: https://www.naacpldf.org/support/fiscal-responsibility/
#
# git branch -m master main
# git push -u origin main
# Change the default branch (and updated the protected branch)
if current_user&.samesite_lax_enabled?
SecureHeaders.use_secure_headers_override(request, :samesite_lax)
end
@oreoshake
oreoshake / application_controller.rb
Last active April 20, 2020 21:51
secure_headers basic use
class ApplicationController < ActionController::Base
def add_csp_exceptions
append_content_security_policy_directives(self.class::CSP_EXCEPTIONS)
end
end
@oreoshake
oreoshake / creds.js
Last active February 28, 2020 21:21
creds = new PasswordCredential({id: username, password: "foo"})
await navigator.credentials.store(creds)
// ... then
navigator.credentials.get({
password: true,
mediation: "optional",
id: username, // no prompt or prompt with one user
})
@oreoshake
oreoshake / calendar-to-remarkable.scpt
Last active March 30, 2019 20:16
script to generate my daily calendar and send the file to my reMarkable table
# This script assumes you have set up a "Print to ReMarkable" automator print plugin script
# Follow https://github.com/juruen/rmapi/blob/master/docs/tutorial-print-macosx.md
# crontab -e and add:
# */15 * * * * osascript /path to your script.scpt >> some log file
# «class menI» Print to ReMarkable of «class menE» PDF of «class menB» PDF of window Print of «class pcap» Calendar
# You will probably run into permission errors when editing the crontab and when the job actually runs
tell application "Calendar"
@oreoshake
oreoshake / implicit_override.rb
Created January 3, 2019 20:47
Just some examples of me using factory_bot wrong
# Traits can be used as implicit factory attributes but if a value is set in a
# a factory, a trait cannot override that value. If you explicitely pass the trait,
# it overrides as expected.
require 'factory_bot'
FactoryBot.define do
factory :foobot do
foo { "parent" }
override

GitHub's bug bounty workflow with chatops and slack integration

We make heavy use of bounty platform features such as common responses, interstitials, and chatops so we can respond, filter, and manage reports. This is the actual workflow that is described at a high level on the GitHub Engineering blog

Passive commands

These commands won't change any state but they can be helpful when working with the other commands.

  • .bounty responses [common_response_id] lists or shows common responses. Many of the commands accept a common_response_id that will be used to deliver consistent messaging to researchers.
  • .appsec-new will show all reports that have not been triaged.

New report comes in

@oreoshake
oreoshake / unblockall.rb
Last active May 3, 2018 00:58
Deletes your blocks. Is really slow. Will probably hit rate limits quickly.
require 'twitter'
client = Twitter::REST::Client.new do |config|
config.consumer_key = ENV["CONSUMER_KEY"]
config.consumer_secret = ENV["CONSUMER_SECRET"]
config.access_token = ENV["ACCESS_TOKEN"]
config.access_token_secret = ENV["ACCESS_TOKEN_SECRET"]
end
USER_ID = < your user id >