Skip to content

Instantly share code, notes, and snippets.

@wisq
wisq / gist:2356189
Created April 11, 2012 01:33
Why chowning /usr/local is bad

So let's say you're trying to write an app that will get root privs on someone's Macbook. Okay, there's a few different ways to go about this.

One, you could just run an application that asks for their login password and hope they're stupid enough to supply it. You'll catch some newbies but a lot of people will notice something's wrong, and if you're trying to spread before anyone notices, it's game over.

Two, you could create your own "sudo" and put it somewhere in their $PATH, including altering their login to point their $PATH to a new directory somewhere. But firstly, you're relying on someone running sudo eventually (many people never touch the command line), and secondly, some people are still going to notice.

So here's your third option. You only infect people who are running Homebrew, who have their /usr/local chowned to them. Why is this handy? Because /usr/local is in the default system-wide path. You can bet there's some script that runs with root privileges, that has /usr/local/bin o

@wisq
wisq / gist:521731c3395810cb23db
Created November 17, 2015 00:56
Multifox .vimperatorrc snippet
command! home js set_multifox_profile("3");
command! work js set_multifox_profile("2");
" Get the multifox version hash by looking inside the multifox XPI file.
" (Look at the hash it uses in its own imports.)
:js << EOF
Components.utils.import("resource://multifox-88f97b0/commands.js");
function set_multifox_profile(id) {
event = {
target: {
--- extrabiomes.cfg-client 2013-04-09 19:17:45.000000000 -0400
+++ extrabiomes.cfg-server 2013-03-04 18:48:06.000000000 -0500
@@ -1,176 +1,139 @@
# Configuration file
####################
-# biome
+# block
####################
#!/usr/bin/env ruby
ENCODINGS = `iconv -l`.split(/\s+/)
PAIRS = ENCODINGS.permutation(2)
def iconv(input, from, to)
output = IO.popen(["iconv", "-f", from, "-t", to, :err => :close], "w+") do |fh|
fh.print(input)
fh.close_write
fh.read.force_encoding("ASCII-8BIT")
#!/usr/bin/env ruby
require 'pp'
DEBUG = false
class Board
class Impossible < StandardError; end
class Solved < StandardError; end
#!/usr/bin/env ruby
require 'tempfile'
KNOWN_HOSTS = ENV['HOME'] + '/.ssh/known_hosts'
read_fh, write_fh = IO.pipe
command = ['ssh', '-oStrictHostKeyChecking=yes'] + ARGV + ['echo', 'Successful connection.']
// ==UserScript==
// @name RPS mixed-content defuckifier
// @namespace rps-img-https
// @include https://www.rockpapershotgun.com/*
// @version 1
// @grant none
// ==/UserScript==
var images = document.getElementsByTagName('img');
var length = images.length;

MGSV's online system

Why does online suck?

  • Whenever you connect online, it redistributes your resources between offline and online.
    • Generally, a small amount will remain offline and all the rest will go online.
  • If you spend stuff for online stuff, it comes out of your online resources.
  • If you spend stuff for regular (offline) stuff, it typically comes out of your offline resources.
    • This can leave you deeply in the negative if you're ever offline.
  • Being negative is very bad and can lead to staff leaving.
% ruby -rbcrypt -e '(1..100).each { |len| abort "max len is #{len}" if BCrypt::Password.create("a" * len) == "a" * (len+1) }'
max len is 72
zsh: exit 1 ruby -rbcrypt -e
ruby -rbcrypt -e 9.12s user 0.06s system 99% cpu 9.192 total
% ruby -rbcrypt -rpp -e 'pp (1..100).map { |len| goodpass = "a" * len; badpass = "a" * (len+1); pass = BCrypt::Password.create(goodpass); [len, pass == goodpass, pass == badpass] }'
[[1, true, false],
[2, true, false],
[3, true, false],
[4, true, false],
@wisq
wisq / Rakefile
Created October 27, 2016 01:03
Basic Ruby+git test-before-commit workflow, testing only the changes being committed
task(default: [:link_hooks, :test])
task :link_hooks do
sh 'ln', '-nsf', '../../hooks/pre-commit', '.git/hooks/pre-commit'
end
task :pre_commit do
require 'open3'
Dir.mktmpdir do |tmpdir|