nefarious | based programming language | Interpreter library

Maybe I'm approaching this entirely in the wrong way, but there seems to be a rather large security hole in Azure Devops Pipelines.

Our devops team has historically managed our builds, all the way back to on-prem TFS and through our journey to CI/CD. This is done so that we can standardize our builds and releases, track environment and toolset upgrades, because devops folks have better domain knowledge in this area, and to generally make life easier for developers. This is all good practice.

Now with Azure Devops and yaml pipelines, we have the ability to template out our builds (a wonderful thing, about time Microsoft caught up to this). But even with templating, "extends" templates, and security restrictions preventing developers from creating their own pipelines, the root file of it all (azure-pipelines.yml) is still stored in the application's source code repository.

So a developer isn't allowed to create a new pipeline, but they can edit the azure-pipelines.yml file all they want, which means erasing the templating/extends code our devops team wrote, and potentially injecting nefarious or otherwise unmanaged changes. Or even deleting the file altogether and ruining the pipeline. This is coconuts.

And before you say, "well, slap some branch policies on there and force code reviews/pull requests," that is entirely goofball for 2 reasons:

1. The dev ops team should not have to approve every single change in the branch, because code changes are not their domain. They should only need to approve the azure-pipelines.yml file and be left off the rest.
2. This would require a branch policy created manually on all our dozens of repos, not to mention every single branch inside those repos. Devs can also create their own branches, which completely circumvents any policies we may have.

And yea, we may have change history now, but that only helps after the fact. Not before a build environment gets destroyed.

In short, by inserting pipeline definitions into application repositories and not providing any way to smartly protect them, Azure YAML Pipelines allows developers free reign to wreak havoc in the devops' world.

Am I missing something here? How have people gone about keeping their yaml pipelines protected and managed? Surely there are strategies for organizations who have separate devops teams that need to protect their work. How do we protect/secure azure-pipelines.yml?

Pardon any confused terminology in the title, but imagine I want to have a little macro to mark structs I create as usable for some nefarious purpose. I write this little module:

I have a foreground service that I launch via startForegroundService.

All works great.

The only thing I am unable to figure out is how to / if its possible to customize the "...is running in the background' notification.

The notification I am sending over to startForeground looks like this:

Using the DomSanitizer service in Angular 2+ is it possible to sanitize the html but leave in the css.

For example this :

Suppose I want to check that a particular H5 file is the one I think it is, and hasn't had some dataset altered while I wasn't looking. I've already turned on the Fletcher-32 filter. I'm wondering if there's some way to access the checksum stored in the H5 file.

To be clear, I don't want to recalculate the checksum, I'm assuming that the data is consistent with the checksum, and I'm not expecting anything nefarious; I just want a quick way to peek in and make a list of the checksums — then peek in later to make sure my list hasn't somehow gotten out of sync with the data. Ideally, I'd like to do this through the h5py interface, but the C interface would at least give me somewhere to start.

My use case is basically this: I have a database of my H5 files, and I want to be sure that none of the datasets have changed without the database knowing about it. I don’t care if — say — an attribute has been changed or added, which means file sizes, modification times, and MD5 sums are of no use. For example, I might realize that some scaling was off by a factor of 2, go in and change those bits in one dataset without changing the dataset's shape or even the number of bytes in the file — but then fail to update the database for one reason or another. I need to be able to detect such a change. And since Fletcher-32 is already being computed by HDF5 with every change to our data, it would be very convenient.

Basically, I'm just asking for the highest-level API calls that can achieve this.

I've found one place in the HDF5 source code here where it reads the stored checksum — evidently the last 4 bytes of the buffer.

Using this fact, it looks like there is an answer, as of HDF5 1.10.2 and h5py 2.10. But it's still not nearly as fast as I'd like — presumably because it's reading all the bytes in every chunk, possibly exacerbated by the need to be constantly allocating new buffers for all those reads.

Essentially, we want to bypass any filters (compression, etc.), read the last 4 bytes of the raw data chunk, and interpret them as an unsigned 32-bit integer. The read_direct_chunk in h5py was added in v 2.10, and corresponds to the HDF5 function H5D_READ_CHUNK.

Here's some simple example code, assuming test.h5 has a 2-dimensional dataset named data.

I have to use a certain third-party library that works in the following way:

I have a question that I have solved in what may be a hacky way, and maybe there is a better way to handle it. I have an app in React Native, and keep in mind I am using Expo right now. That you type in a phone number and a message and with a aws lambda function and pinpoint it will send a robo call to that number with that message. This is just a demo right now, it's not meant to work like this in production, and it is not nefarious. The idea of the app rests on this working tho. So it does work, but I was wondering if there was a way to have react native just trigger the phone ringer with a fake number. Or even pass a message to it without using the lambda. If I can't trigger the native ringer, is there a way to build a custom ring interface that could show up even when the screen is locked or the app is closed. So a delay on after the call is initated.

What is suggested as the best way to do this. Are there ways to connect to the microphone and and the speaker with react native, pass a recording and have an interface to do so.

So the three options are

A) stick with the lambda and have it be a real phone call, and have it work no matter if app is open or phone is locked.

B) Have the app trigger a notification to the phone on a timer that pops up a full screen ui that looks like a phone call that you can answer and here a message, whether the app is closed or phone is locked

C) have the app trigger a real phone call ringer on a timer that has a message in it.

Thanks for reading this, and let me know what is possible, and then I will go down the rabbit hole of trying to implement it.

I'm trying to learn how I might secure data from being altered after being passed over an open network between a server and a worker

in my head I was thinking that it should follow something like:

I'd like to simulate a particle explosion, from the center of a screen out to the edges (In CSS, and I promise to not use this for nefarious purposes)

Here's a visual so you know what I'm talking about:

BEFORE:

AFTER:

I've tried using the following HTML/CSS/JS, but it doesn't work (dots stay still in the middle of the screen):

The HTML is just this: