5 ms·

Maybe hire that person?

by junke 10y ago

dimino 10y ago
Hire someone because they exploited a single vulnerability?
- dozzie 10y ago
  I've heard of much worse hiring practices than to base on a single display of competence.
  - cgriswald 10y ago
    In the late nineties/early aughts, I worked for a company that hired a pair of guys after those guys showed up holding basically all the data from one of the company's services. The company started using these guys' custom software instead. The server running this software was in our main server room although it was technically not our department. So one day, when a fairly serious bug was found, I had to chaperone the non-technical person into the service room. She was on the phone with these guys. For political reasons within the company, all I could do was watch. They instructed her, over the phone, symbol-and-letter by symbol-and-letter to add to live production code. What they added? A giant "if false" block around the buggy code.
  - dimino 10y ago
    True. Then again, I've heard of many better hiring practices as well. Even odds it's a current employee, anyway.
- rimantas 10y ago
  God forbid. No hire if they cannot reverse binary tree on the whiteboard using angular react e6.
  - deleted 10y ago
    [deleted]
  - dozzie 10y ago
    The guy that couldn't "reverse a binary tree" came from a team that turned out to be incompetent (in operations field; they didn't see anything wrong with distributing all the packages with software using HTTP without SSL/TLS nor any cryptographic signature).
    - Chlorus 10y ago
      Are we talking about Homebrew guy? Was this a flaw in Homebrew or something else he worked on?
      - dozzie 10y ago
        Yes, the one. It was (is? don't know, I don't use Apple products) a flaw in how Homebrew and its homepage operates.
        dimino 10y ago
        Didn't they fix it?
        dozzie 10y ago
        As I remember, they argued that this is perfectly fine and there's totally no problem with that.
    - robocat 10y ago
      To be fair, some major Linux distros also distribute using http e.g. go to https://www.debian.org/ https://www.debian.org/ and check the Download link at the top of the page: it is http.
      - dozzie 10y ago
        Yes, but there are some important differences: - Debian provides SHA-512 checksums of those ISO images - the checksums are signed cryptographically - web server is not the only distribution point - Debian packages are distributed signed, so once you have your OS installer somehow verified, you're much safer than with Homebrew Granted, SHA-512 checksums and their GPG signatures are not exposed very prominently on Debian's homepage. You need to go to the listing of directory with ISO instead of clicking "download ISO" direct link.
- clort 10y ago
  Maybe offering a reward is a good way to reduce the anonymity of the person, since rewards can be tracked. Speaking only for myself.. If I were to go the trouble to anonymously tip somebody off about a security vulnerability, it would be because I cared that they were secure and that I did not wish to be identified. I would neither expect nor accept a reward.
  - brokenmachine 10y ago
    Yes but a white hat like you would probably give at least some hints on how to fix it or what vulnerability you have discovered, not just a screenshot showing that you have/had access. I think just the fact that they didn't do this points to malevolence. I would expect the ransom demands to follow shortly.

Maybe hire that person?

by junke 10y ago

Maybe hire that person?

dimino 10y ago

Hire someone because they exploited a single vulnerability?

dozzie 10y ago
I've heard of much worse hiring practices than to base on a single display of competence.
- cgriswald 10y ago
  In the late nineties/early aughts, I worked for a company that hired a pair of guys after those guys showed up holding basically all the data from one of the company's services. The company started using these guys' custom software instead. The server running this software was in our main server room although it was technically not our department. So one day, when a fairly serious bug was found, I had to chaperone the non-technical person into the service room. She was on the phone with these guys. For political reasons within the company, all I could do was watch. They instructed her, over the phone, symbol-and-letter by symbol-and-letter to add to live production code. What they added? A giant "if false" block around the buggy code.
- dimino 10y ago
  True. Then again, I've heard of many better hiring practices as well. Even odds it's a current employee, anyway.
rimantas 10y ago
God forbid. No hire if they cannot reverse binary tree on the whiteboard using angular react e6.
- deleted 10y ago
  [deleted]
- dozzie 10y ago
  The guy that couldn't "reverse a binary tree" came from a team that turned out to be incompetent (in operations field; they didn't see anything wrong with distributing all the packages with software using HTTP without SSL/TLS nor any cryptographic signature).
  - Chlorus 10y ago
    Are we talking about Homebrew guy? Was this a flaw in Homebrew or something else he worked on?
    - dozzie 10y ago
      Yes, the one. It was (is? don't know, I don't use Apple products) a flaw in how Homebrew and its homepage operates.
      - dimino 10y ago
        Didn't they fix it?
        dozzie 10y ago
        As I remember, they argued that this is perfectly fine and there's totally no problem with that.
  - robocat 10y ago
    To be fair, some major Linux distros also distribute using http e.g. go to https://www.debian.org/ https://www.debian.org/ and check the Download link at the top of the page: it is http.
    - dozzie 10y ago
      Yes, but there are some important differences: - Debian provides SHA-512 checksums of those ISO images - the checksums are signed cryptographically - web server is not the only distribution point - Debian packages are distributed signed, so once you have your OS installer somehow verified, you're much safer than with Homebrew Granted, SHA-512 checksums and their GPG signatures are not exposed very prominently on Debian's homepage. You need to go to the listing of directory with ISO instead of clicking "download ISO" direct link.
clort 10y ago
Maybe offering a reward is a good way to reduce the anonymity of the person, since rewards can be tracked. Speaking only for myself.. If I were to go the trouble to anonymously tip somebody off about a security vulnerability, it would be because I cared that they were secure and that I did not wish to be identified. I would neither expect nor accept a reward.
- brokenmachine 10y ago
  Yes but a white hat like you would probably give at least some hints on how to fix it or what vulnerability you have discovered, not just a screenshot showing that you have/had access. I think just the fact that they didn't do this points to malevolence. I would expect the ransom demands to follow shortly.