Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)

I'm not sure if this is exactly what you're referring to, but apparently years ago there were exploits bundling JAR files into GIFs to sneakily have them executed by the Java browser plugin: https://en.wikipedia.org/wiki/Polyglot_(computing)#GIFAR_att...

Back in the day I wrote a PoC exploit for my employers app that abused an image upload api by embedding a jar file inside an svg as XXE which then got me RCE. Fun times.

if anything i would use EXIF data to enhance stego.

generally its the JPEG standard that allows the payload, manipulation by abusing EXIF is how you operate the exploit.

there is a 64k file segment specified for JPEG, and you can abuse it to hold any "data" you want, as well as extending to other segments, for more storage.

the raw steganography in most primative form is a comparison of two photos, one of which is pixelshifted to encode the data.

in advanced form, the pixels hold the encrypted data, but the application segments of the JPEG hold keys and or matrix values, and you need a reference image. you can move fairly large volumes of ASCII representation like this before its noticed

you basicly write a webpage that local caches the payload and keys, then abuses EXIF to build and execute an exploit on the target.

this is a variation on a common theme in steganography, but still interesting and giving something a name can be a useful contribution in itself

How will you get Mozilla and Google to trust it?

Especially since sanctions are transitive. Mozilla and Google, being US companies, are actually not allowed to trust any entity whose purpose is to work around sanctions. Their members could go to jail for that.

It seems the site basically doesn't do anything for IPv6 :-(

I see the same problem with rDNS. The box at the top correctly reports the DNS name as "forward-confirmed" but I see a -5 points penalty for missing reverse DNS. Tried with various IP addresses, and I observe the same for many (not all).

Can the same version of Word now produce the same rendering on two PCs? In the past (I didn't really check recently, I'm thinking more about 10 years ago) the same file might have had page breaks in different positions and things like that. I never understood if it came from slightly different versions of the fonts, from some info derived from the default printing or anything else...

With a credit card ;-)

The VoIP landline seems a way better solution than the proprietary Tin Can phone: while it looks nice, it apparently needs a subscription to call regular numbers... and AFAIK you can't call it from a normal phone (please correct me if I'm wrong!)

Well, the point of the landline phone (at least to some parents) is also that it has no screen, and has actual buttons, and stays home... for cell phone, we have prepaid SIM cards that are actually usable (in many EU countries credit doesn't expire and you must just use it every few months to keep them active, not sure about US).

Pretty much all phones have screens, even landline ones. They communicate at minimum caller ID, or what phone number you dialed out.

Using an old flip phone (they still make them that have 4g/5g connectivity these days!) gets you a similar ask, with the benefit that it’s portable if you need to.

Nice interface at a first glance, for sure can be useful for users who would find using the actual thing too cumbersome. How does performance compare to the native app? Is any form of hardware decoding/encoding like h264_nvenc available? (I guess not?)

I would imagine the only way to use NVENC directly from a browser would be via WebCodecs.

~4x slower than native for encoding, which is acceptable for clips under 5 mins. No hardware encoding -- WASM is CPU-bound, for now. WebCodecs could bridge that gap in future.

0.4 what latency? 0.4 s or 0.4 ms, or something else? Because if it's 0.4 ms, that seems to be very local, and possibly even impossible on LTE because of network latency. I'm not even sure 5G manages to get under 1 ms of latency.

I had the same thought: the device OP used for LTE testing may have been still connected to a local link and was routing packets over that instead.

On my PC, the site displays a weird "Your browser is not Javascript enable or you have turn it off. We recommend you to activate for better security reason" banner on the top... not sure if it's my ad blocker that messes up some CSS styles that makes this appear, but the message is weird in any case.

EDIT: no, it's not the ad blocker. The <noscript> tag is empty, and that string floats in the source near the <title> tag.

I got a lot of ads related messages and I can tell you, this site works much better by actually disabling javascript!

In any case "We recommend you to activate [JS] for better security reason" sounds quite ridiculous...