Now Playing Tracks

Familiar PowerShell prompt (with Posh-Git)

Here is the Windows PowerShell version of the Bash prompt I use:

function prompt {
    $realLASTEXITCODE = $LASTEXITCODE

    # Reset color, which can be messed up by Enable-GitColors
    $Host.UI.RawUI.ForegroundColor = $GitPromptSettings.DefaultForegroundColor

    $currentPrincipal = New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent() )
    & {
        if ($currentPrincipal.IsInRole( [Security.Principal.WindowsBuiltInRole]::Administrator ))
        {
            Write-Host($env:username) -f red -nonewline
            Write-Host("@") -f red -nonewline
            Write-Host($env:computername) -f red -nonewline
            Write-Host(":") -nonewline
            Write-Host($pwd.ProviderPath) -f blue -nonewline

            Write-VcsStatus

            Write-Host('#') -nonewline
        } else {
            Write-Host($env:username) -f green -nonewline
            Write-Host("@") -f green -nonewline
            Write-Host($env:computername) -f green -nonewline
            Write-Host(":") -nonewline
            Write-Host($pwd.ProviderPath) -f blue -nonewline

            Write-VcsStatus

            Write-Host('$') -nonewline
        }
    }

    $global:LASTEXITCODE = $realLASTEXITCODE
    return " "
}

Use an Amazon S3 bucket per application / application and environment

I had a need to make sure that a particular application (technically a specific environment of an application) could only play in its own S3 bucket. I couldn’t find any examples of this in the IAM documentation, so I ended up finding a similar example on the AWS forums and making some changes. Here’s what I used:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketVersioning",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketLocation",
        "s3:GetBucketPolicy"
      ],
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME_HERE",
      "Condition": {}
    },
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME_HERE/*",
      "Condition": {}
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Condition": {},
      "NotResource": "arn:aws:s3:::YOUR_BUCKET_NAME_HERE/*"
    }
  ]
}

Hopefully this helps others :)

Samsung Android Protips

I am currently running Android 4.1 Jellybean (in the form of CyanogenMod 10) on my Samsung Infuse 4G. It’s pretty cool, and I really like Google Now. Of course, sometimes you end up breaking something when you’re not using the official firmware, and in my case, I ended up corrupting the EFS partition because my phone locked up. Not a big deal; I made a backup. But I spent more time diagnosing the issue because all of the lists of Samsung special key combinations didn’t work for me because they are meant for old devices.

Here’s the ones I needed the most:

  • *#*#INFO#*#* (*#*#4636#*#*) - brings up the testing screen with options “Phone information”, “Battery information”, “Usage statistics”, and “Wi-Fi information”. The phone information screen lets you set the preferred network type, do some tests, and get/set the SMSC (message center). I ended up using this to determine the EFS data was corrupt because none of the testing info at the top of the Phone information screen was filled in.
  • *#*#BAND#*#* (*#*#2263#*#*) - brings up “Service Mode” which lets you set the RAT, but I’m not sure what that means. In my case, it says RAT setting restricted.

Now that I’ve learned the pneumonic for these, I’ll probably not have to spend a couple hours Googling for the answer. But in case I forget them, it’s on my blog.

PayPal Bug Bounty - a lesson in not being a fuckup.

He doesn’t mention if the vulnerability was actually fixed, but if they can be affected by one SQL injection, then it’s going to be full of holes. Stop writing queries where you concatenate strings, people! Even if you are escaping. Instead, use prepared statements! Rails does this for free, mysqli in PHP does it, .NET can do it… It’s completely unacceptable to have this problem anymore.

l8security:

PayPal started their bug bounty program on June 21st 2012. When I saw that, I decided that the race was on. A new market place had opened, and I was going to get in on it. I had my first opportunity to take my first shots at finding a flaw on June 29th. On first thought, I assumed that a company…

To Tumblr, Love Pixel Union