If this is the quality of research you can present at DefCon nowadays, I guess I should find some bullshit and send in a request to present to check that bucket list item off.
Literally if you have privileged code execution in the browser (which extensions usually do) of course you can do bullshit like this.
There's also no reason to steal the passkey since you can do things like send requests on the behalf of the user or modify the page to trick them into running something.
The bits about shadowing the JavaScript API they called out as critical, and like yes (JS is the work of the devil), but also that's how fucking JavaScript works.
You're giving a talk to some of the most technical people in the world, how the fuck did they even come close to the presenter stage here. It didn't go over anything new and if you knew anything about the topic at hand it reeked of bullshit.
Inside git's internal plumbing folder, git holds a file with the branch name and all of the references (files and changes) for that branch.
When you make a new branch git will update its internal plumbing checking to see if the new branch already exists, updates its references to the new branch if it doesn't (all held internally in a case sensitive way). It will then make that new branch file, git has already checked that the case senitive name for the branch doesn't exist internally, so it should be good to go.
Part of its process is creating that internal branch file... But wait!
Windows doesn't have case sensitive naming so when it tries to make that new branch file it will overwrite the old one (since it shouldn't exist by git's own reference!) All of the files and references for it now get nuked.
Now you're at best back to wherever that originally named branch came from, at worse your .git folder is properly borked.
Way ahead of you... I have a Brocade ICX6650 waiting to be racked up once I'm not limited to just the single 15A circuit my rack runs off of currently 😅
Hopefully 40G interconnect between it and the main switch everything using now will be enough for the storage nodes and the storage network/VLAN.
Confirmation of anecdotes or gut feelings is still science. At some point you need data rather than experience to help people and organizations change their perception (see: most big tech companies lighting billions of dollars on fire on generative AI).
Or... They do what they did last time the lifetime was cut down from 3-10 years down to 395 days... Just issue you a new certificate when the old one runs out and up to whatever the time period you bought it for...?
Let's Encrypt isn't the only CA to use ACME, you can auto renew with basically any CA that implemented it (spoiler: most of them have)
I remember walking out of that talk and thinking:
If this is the quality of research you can present at DefCon nowadays, I guess I should find some bullshit and send in a request to present to check that bucket list item off.
Literally if you have privileged code execution in the browser (which extensions usually do) of course you can do bullshit like this.
There's also no reason to steal the passkey since you can do things like send requests on the behalf of the user or modify the page to trick them into running something.
The bits about shadowing the JavaScript API they called out as critical, and like yes (JS is the work of the devil), but also that's how fucking JavaScript works.
You're giving a talk to some of the most technical people in the world, how the fuck did they even come close to the presenter stage here. It didn't go over anything new and if you knew anything about the topic at hand it reeked of bullshit.