Posts

2022-12-21: PDFServer - Our Summer Internship at LANL

Image
This summer (summer of 2022), we (Himarsha Jayanetti, Gavindya Jayawardena, and Yasith Jayawardana) got the opportunity to intern at the Los Alamos National Laboratory (LANL) under the Graduate Research Assistant Program . Himarsha and Yasith worked as a part of the Library's Research and Prototyping Team  (Proto Team) under the supervision of Drs. Martin Klein and Shawn M. Jones . Gavindya was supervised by Brian Cain on the Institutional Scientific Content (ISC) Team. Each of us was responsible for one of the three main components that make up the "PDFServer". What is the PDFServer? PDFServer is a prototype to support LANL's Review and Approval System for Scientific and Technical Information (RASSTI) , which is the starting point for collecting LANL’s documented scientific output and it provides workflows for authors and reviewers. The overall architecture of the PDFServer is displayed in Figure 1. We selected Laravel 9.11 , which is a PHP web application framewo...

2022-12-12: Twitter DM Videos Are Accessible to Unauthenticated Users

Image
  @Whitekitty2012  DMing  @BKitty2020  an image -- Twitter works very hard to protect this image from access by third parties.  @Whitekitty2012 DMing @BKitty2020 a video -- unlike the image above, this video has no HTTP protection. We have created a simple example that demonstrates that while Twitter goes to great lengths to protect images shared in direct messages (DMs), the videos shared in DMs enjoy no such protections (see also: 2022-12-22 update ).  Both image and video URLs are named based on hashes and would be difficult if not functionally impossible to guess:   Image URL:  https://ton.twitter.com/i/ton/data/dm/1600870219324465156/1600870190459256832/KM0EBzij.jpg:small Video URL:  https://video.twimg.com/dm_video/1600877027330064385/pl/320x180/Vn4h39llbQ0jfr1D.m3u8?container=fmp4   However, if the URLs are somehow leaked (e.g., guessing, reverse engineering, brute force, exported through  HAR files , intercepted by  p...