BC DEPENDENCYCHAINATTACK
Saved by @m4rc0v0nh4g3n

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies

👇Check the thread after reading for a few bonus

 Scope:

Other than the mentioned .NET bug, only one other team said the finding was out of scope, using this as a reason to reduce the bounty from P1 to P2.

We've also purposely avoided reporting to at least one program that had "internal or development services" listed as OOS
Pytosquatting:

In Python, the 'install' name of a package can be different from the 'import' name. This allows for an unique type of typosquatting attack by uploading under unclaimed import names on PyPI, where it can be downloaded by developers, or even automated tools.
I tried this out against some Google open source projects and it actually got me inside two *.corp.google.com machines.

However, just like typosquatting, this mostly relies on one-off mistakes. Google did not accept it as a valid vuln, and I fully agree with their assessment.
Fun fact: those packages are long gone from PyPI but for some reason they are still up on some sort of Chinese mirror, and I still get various callbacks from China to this day.
Finally, a brief look at how each package hosting service responded after seeing the test packages:

* npm - initially deleted a few, stopped after my intentions were clarified
* PyPI - deleted all packages, made it clear that testing this is not allowed
* RubyGems - no reaction

You May Also Like

Jaya_Upadhyaya
Jaya_Upadhyaya
@Jayalko1
HORANADU ANNAPOORNESHWARI, CHIKMAGALUR (KAR)
#bharatmandir

Annapoorneshwari is the Devi of nutrition and food. The literal meaning of Annapoorneshwari is “Feeding one and all”. Anyone who comes here is offered meals and shelter within the premises.
@LostTemple7


Maharshi Agastya is believed to have done pratishtha here.

Once, Shiva and Parvati had an argument. Shiva declared everything in the world including food to be Maya or illusion. To prove him wrong, Devi Parvati disappeared resulting in entire Earth becoming still.


Taking pity, Devi appeared as Annapoorna and relieved everyone.
Another belief is that once Shiva beheaded Brahma and his skull got stuck in Shiva’s hand. He was cursed that till the skull is not full of food or grains, it will remain stuck to his hands.


Shiva went everywhere and asked for food but the skull was never full. He finally came here and Maa Annapoorna filled the skull with grains and reversed Shiva’s curse.

It is believed that who ever visits Devi Annapoorna here will never be without food in their lives.
ALL
Brian Cates
Brian Cates
@drawandstrike
Great article from @AsheSchow. I lived thru the 'Satanic Panic' of the 1980's/early 1990's asking myself "Has eveyrbody lost their GODDAMN MINDS?!"


The 3 big things that made the 1980's/early 1990's surreal for me.

1) Satanic Panic - satanism in the day cares ahhhh!

2) "Repressed memory" syndrome

3) Facilitated Communication [FC]

All 3 led to massive abuse.

"Therapists" -and I use the term to describe these quacks loosely - would hypnotize people & convince they they were 'reliving' past memories of Mom & Dad killing babies in Satanic rituals in the basement while they were growing up.

Other 'therapists' would badger kids until they invented stories about watching alligators eat babies dropped into a lake from a hot air balloon. Kids would deny anything happened for hours until the therapist 'broke through' and 'found' the 'truth'.

FC was a movement that started with the claim severely handicapped individuals were able to 'type' legible sentences & communicate if a 'helper' guided their hands over a keyboard.
CULTURE
Advertisement
The New York Times
The New York Times
@nytimes
Stan Lee’s fictional superheroes lived in the real New York. Here’s where they lived, and why. https://t.co/oV1IGGN8R6


Stan Lee, who died Monday at 95, was born in Manhattan and graduated from DeWitt Clinton High School in the Bronx. His pulp-fiction heroes have come to define much of popular culture in the early 21st century.

Tying Marvel’s stable of pulp-fiction heroes to a real place — New York — served a counterbalance to the sometimes gravity-challenged action and the improbability of the stories. That was just what Stan Lee wanted. https://t.co/rDosqzpP8i


The New York universe hooked readers. And the artists drew what they were familiar with, which made the Marvel universe authentic-looking, down to the water towers atop many of the buildings. https://t.co/rDosqzpP8i


The Avengers Mansion was a Beaux-Arts palace. Fans know it as 890 Fifth Avenue. The Frick Collection, which now occupies the place, uses the address of the front door: 1 East 70th Street.
CULTURE
SK
SK
@sk_diary1
#sculpture #story -

Chandesha-Anugraha Murti - One of the Sculpture in Brihadeshwara Temple at Gangaikonda Cholapuram - built by Raja Rajendra Chola I

This Sculpture depicts Bhagwan Shiva along with Devi Paravathi blessing Chandeshwara - one of the 63 Nayanmars.

#Thread


Chandeshwara/Chandikeshwara is regarded as custodian of Shiva Temple's wealth&most of Shiva temples in South India has separate sannathi for him.

His bhakti for Bhagwan Shiva elevated him as one of foremost among Nayanmars.
He gave importance to Shiva Pooja&protection of cows.


There are series of paintings, illustrating the #story of Chandikeshwar in the premises of
Sri Sathiyagireeswarar #Temple at Seinganur,near Kumbakonam,TN

Chandikeshwara's birth name
is Vichara sarman.He was born in the village of Senganur on the banks of River Manni.


His Parent names were Yajnathatan and Pavithrai.
Vichara Sarman was a gifted child and he learnt Vedas and Agamas at a very young age.
He was very devout and would always think about Bhagwan Shiva.

One day he saw a cowherd man brutally assaulting a cow,Vichara Sarman could not tolerate this. He spoke to cowherd: ‘Do you not know that the cow is worshipful & divine? All gods & Devas reside in https://t.co/ElLcI5ppsK it is our duty to protect cows &we should not to harm them.
ALL
Nyck de Vries
Nyck de Vries
@nyckdevries
Lately there have been various rumours in the media about myself and Jumbo in relation to Williams. To clarify things, Jumbo is not and will not invest any money in my career. 1/2

Of course we’re collectively looking at career opportunities, however this is certainly not our philosophy and strategy. I hope to announce my future plans soon, be patient 😉 2/2
SPORT