Recent content on Max.Computer
I’ll be showing my BitTorrent video collage at Long Winter tonight. $ cat last-days.nfo __ __ ____ ____ / / ____ ______/ /_ / __ \____ ___ _______ ____ / __/ / / / __ `/ ___/ __/ / / / / __ `/ / / / ___/ / __ \/ /_ / /___/ /_/ (__ ) /_ / /_/ / /_/ / /_/ (__ ) / /_/ / __/ /_____/\__,_/____/\__/ /_____/\__,_/\__, /____/ \____/_/ /____/ ________ ____ _ __ ____ /_ __/ /_ ___ / __ \(_)________ _/…
Last night, I was having a drink with a friend and he asked me what I liked about Clojure. Immutable data structures are coming in vogue outside Clojure, and they don’t need to be sold very hard. I don’t know a lot about virtual machine optimization, but I’ve always been swayed by the argument that with the amount of dollars and intellectual effort spent on JVM optimization in…
Update: 07/31/2014 Sonatype has reacted to this post and will soon be turning on SSL access for all users. Their blog post announcing this is here. I’m very happy that they are making this change, and the Java ecosystem is going to be more secure for it! That being said, if you’re reading this and are thinking of charging $10 to gauge the true demand for security features in your…
Last time, I showed some basic things you can do with delimited continuations. If you’re still confused about them (as I am!) another good tutorial is here. Let’s dive right in and build some more complicated control structures! Generators Let’s start by building what Python calls “Generators.” Ruby has Enumerators, which are pretty similar, but I’ll call it a…
For the past few days at Hacker School, I’ve been exploring continuations. Continuations are hard to describe. Basically, a continuation represents the execution state of a program at a point. Capturing the continuation and invoking it later allows you to come back to that point in the programs execution. Continuations can be used to implement complicated control flow constructs. If that was…
Today was presentation day at Hacker School. I have a 10 minute talk about “building a better doorbot” which was secretly a talk about exploiting stack buffer overflows. People seemed to enjoy it. The slides are available here, and the source code is here.
For three weeks now, I’ve been at Hacker School. Hacker School is hard to describe, they call themselves a “writer’s retreat for programmers.” Personally I prefer “programmer summer camp,” mostly because I have no idea what writer’s retreats are like. Basically it’s a collection of people working in a self-directed way to improve their skills as…
You can also find this post on my consultancy’s blog here Last fall, while performing some bespoke security research for one of our clients, I found a way to locate any Tinder user using trilateration. Here’s what the proof of concept looks like: I did a guest post over at the Include Security blog about how I was able to track the location of any Tinder user.
Last month, I helped organize a security conference in Toronto called BsidesTO. I’ve attended and volunteered at my fair share of conferences, but this is the first time I’ve had an integral role in throwing and event of this scale. One day, two floors, 14 speakers, and over 150 attendees. It was a blast. An exhausting blast. Bsides. is a brand for security conferences around the…
You can also find this post on my consultancy’s blog here Letterpress is an iOS game that came out a few weeks ago and immediately became popular enough to take down Apple’s GameCenter. It’s a cross between Scrabble and Go. The game is played on a board made out of 25 letters and players take turns building words in order to capture the letters they use. I was hopelessly addicted…
**You can also find this post on my consultancy’s blog here ** Vagrant is a great tool that allows you to easily spawn and configure lightweight VMs to use as development environments. Vagrant provides base installs of several flavours of Linux, and takes care of setting up networking and shared folders for you. Vagrant is really useful for managing your development environment, and I highly…
You can also find this post on my consultancy’s blog here Stripe recently ran a CTF focused on web application hacking. It ended yesterday, and I decided to write up my solutions. If you have any questions or find a bug in my solutions, you can reach me at max [at] state.io. First of all, I had an great time solving these challenges. Big thanks to the Stripe team for creating such a fun…
After the Ruby security apocalypse, we had to figure out if any of our projects at State Machinery were vulnerable and patch them. We realized that manually checking Gemfiles for vulnerable versions was tedious and prone to error, so we built Gemcanary to monitor your Gemfiles and email you if any vulnerabilities came out. Gemcanary was designed as a free service to drive traffic to our…
Name: Max Veytsman Age: days Employment: Appcanary Schooling (Computer Science): University of Toronto Schooling (Capitalism): Y Combinator Unschooling: Recurse Center Twitter: yes Github: yes Keybase: yes Linkedin: if you insist
In 2015, we transitioned our consultancy into a product company and I switched my title from the ambiguous “partner” to the equally ambiguous but more startupy “founder.” Appcanary tracks vulnerabilities in open source software, and notifies you if one of your dependencies needs to be upgraded. We were part of Y Combinator in the summer of 2015, and I’ve been writing…
The main public repository for Java-ecosystem packages is Maven Central. I discovered that when you installed Java packages using a tool like maven or ant, they were served unencrypted over HTTP, without any sort of cryptographic verification of their contents. Anyone who has control over a wifi router could trick Java developers into downloading compromised Jars and run arbitrary code on their…
For two and a half years, I ran a boutique consultancy. We provided a mix of security and development services, meaning that on any given day I could be developing and MVP, hacking into someone’s network, or debugging legacy software.
I discovered that Tinder would return distances between users with extremely high precision. This is a problem because it allows you to deduce the exact location of a Tinder user by measuring their distance to three known points (this is called trilateration). I made a demo application to geolocate Tinder users in order to demonstrate to Tinder how serious of an issue this was. They fixed the…