[F] [mOved] Mon langage est mieux que le tien - Page 165

Brunni (./4923) :
Ce qui est assez surprenant (mais j'ai envie de dire presque rassurant malgré tout) c'est comment Edge est monté

Brunni (./4923) :
Et oui la raison pour laquelle j'ai cette image c'est à cause de la dette technique incroyable que Firefox se traîne, et le fait qu'on a les mêmes discussions (dans notre département marketing) lorsqu'il s'agit de le supporter, qu'on avait y a 10 ans concernant IE 7. Ils n'arrivent juste pas à suivre, et je les comprends.

Zeph (./4928) :
Oui, ça fait des années que Chrome envoie ses propositions au W3C après les avoir déployées publiquement, donc devant le fait accompli c'est difficile de reculer ("vous pouvez refuser si vous voulez mais 50% des internautes ont déjà la fonctionnalité").

Je suis également curieux de savoir sur quels points Firefox est à la traine, je n'avais pas cette impression ?

Microsoft is scanning the inside of password-protected zip files for malwareArs TechnicaIf you think a password prevents scanning in the cloud, think again.

While analysis of password-protected files in Microsoft cloud environments is well-known to some people, it came as a surprise to Andrew Brandt. The security researcher has long archived malware inside password-protected zip files before exchanging them with other researchers through SharePoint. On Monday, he took to Mastodon to report that the Microsoft collaboration tool had recently flagged a zip file, which had been protected with the password “infected.”

"While I totally understand doing this for anyone other than a malware analyst, this kind of nosy, get-inside-your-business way of handling this is going to become a big problem for people like me who need to send their colleagues malware samples,” Brandt wrote. “The available space to do this just keeps shrinking and it will impact the ability of malware researchers to do their jobs.”

Fellow researcher Kevin Beaumont joined the discussion to say that Microsoft has multiple methods for scanning the contents of password-protected zip files and uses them not just on files stored in SharePoint but all its 365 cloud services. One way is to extract any possible passwords from the bodies of an email or the name of the file itself. Another is by testing the file to see if it’s protected with one of the passwords contained in a list.

“If you mail yourself something and type something like 'ZIP password is Soph0s', ZIP up EICAR and ZIP password it with Soph0s, it'll find (the) password, extract and find (and feed MS detection),” he wrote.

Brandt said that last year Microsoft’s OneDrive started backing up malicious files he had stored in one of his Windows folders after creating an exception (i.e., allow listing) in his endpoint security tools. He later discovered that once the files made their way to OneDrive, they were wiped off of his laptop hard drive and detected as malware in his OneDrive account.

Brunni (./4934) :
j'ai pas souvenir d'avoir installé une extension pour Fx.

Zerosquare (./4937) :
Un exemple récent que j'avais oublié de poster :

Microsoft is scanning the inside of password-protected zip files for malwareArs TechnicaIf you think a password prevents scanning in the cloud, think again.

[quote]While analysis of password-protected files in Microsoft cloud environments is well-known to some people, it came as a surprise to Andrew Brandt. The security researcher has long archived malware inside password-protected zip files before exchanging them with other researchers through SharePoint. On Monday, he took to Mastodon to report that the Microsoft collaboration tool had recently flagged a zip file, which had been protected with the password “infected.”

The registry.npmjs.com endpoint, Clarke says, will let registered developers publish packages using a PUT request to the appropriate URI.

"The issue at hand is that the version metadata (a.k.a. 'manifest data') is submitted independent from the attached tarball which houses the package's package.json," he explains. "These two pieces of information are never validated against one another and [this] calls into question which one should be the canonical source of truth for data such as dependencies, scripts, license, and more."

The tarball – a compressed archive of files – gets signed, but the name and version fields declared in the package.json file can be different from the name and version fields in the manifest because they're not validated.