bostik

61 ms·

691.
by bostik 6y ago
At the risk drawing fire from everyone, I don't really think ISO27001 is a security certification. We get audited annually against 27k Annex A (basically ~95% of full one) + UK Gambling Commission extras. The audit focuses far more on
692.
by bostik 6y ago
Funny how history repeats itself. Nokia had logbufd on their linux devices (N770/N800/...) to prevent NAND getting abused by constant writes. They realised very early on that writing logs during runtime is essential for debugging
693.
by bostik 6y ago
If its success has kept uncountable, "segmented" garbage devices from ever entering the market, I'd say WRT has been even better for the consumers than you think.
694.
by bostik 6y ago
> So how do we guard against this type of attack? You can't ever prevent it, but you can raise the attack cost/complexity and make detection much more likely. Go for immutable infra and transient CI/CD systems. Provision
695.
by bostik 6y ago
My money is on Burp proxy. Pretty much every single web vulnerability researcher uses it, to the point of absurdity. Squint hard enough and screwdrivers have a familiar shape, so you of course you look for a big enough hammer.
696.
by bostik 6y ago
There can be a difference in degree, it's not a binary option. Personally I think both are dangerous, but thanks to audience self-selection and rules of the platforms, Parler is more dangerous of the two.
697.
by bostik 6y ago
> shipped systems with most of userspace built in 32b mode Gah, so that's where ARM's THUMB instruction set got its inspiration from.
698.
by bostik 6y ago
That's a scary thought. You're effectively saying that small-screen, asynchronous, human-to-human text based communications have been solved, with no further improvement possible. Isn't that a rather depressing vision?
699.
by bostik 6y ago
> unless it builds some of those features Here's a thing I don't understand - why is everyone obsessed with copycatting? By aiming for feature parity you, as a business or service, are letting a competitor dictate your roadma
700.
by bostik 6y ago
> Beyond the HackerNews crowd, most people don't care about privacy. I believe in this one you are mistaken. Adblocking has gone from fringe to mainstream in just a few years. Tracker blocking and in general putting actual value o
701.
by bostik 6y ago
From my point of view, the most interesting and balanced part is hidden 3/4 of the way to the article: > Russia’s social media campaign ultimately played a marginal role, according to Benkler, but the media was elevating both its i
702.
by bostik 6y ago
I'll just add to the sibling comment with one educated guess. Since the attack requires recording of approximately 6k U2F auth operations, we can quite easily calculate the minimum wall time. From a purely anecdotal experience, it take
703.
by bostik 6y ago
The SSH setup with a Nano and a laptop is pretty neat, in fact. Once you get it going. For a desktop it wouldn't work as smoothly thanks to the touch-for-every-auth requirement. Even with the well-known document (by HN regular StavrosK
704.
by bostik 6y ago
For quite a bit longer, I think. The book Weapons of Math Destruction was published in 2016, and the conclusions therein were not exactly new at the time either.[ß] The business model of ad-based social media is focused on generating enga
705.
by bostik 6y ago
The main idea with a security token is that you can not get the keys out of them.[ß] So for a truly secure and reliable setup, get three. Enroll them all as parallel 2FA tokens. Keep one with you, one in a relatively easily accessible but n
706.
by bostik 6y ago
Well, yes. Obviously. One would hope. But if they were to do so, it could be done so that there likely wouldn't be anything in the visible application or its behaviour to highlight the change to a regular user. Unless you somehow see t
707.
by bostik 6y ago
> * The sentiment of your message almost makes it looks like you are trying to say Whatsapp is no worse at E2E than the others?* That was not my intention. I'm trying to say that E2E implies a very specific threat model, and that Wh
708.
by bostik 6y ago
Well, let's be fair. The threat model for end-to-end encryption assumes that endpoint devices or the software itself used for communication are not compromised. Or subverted. It's common knowledge that group chats are not E2E - th
709.
by bostik 6y ago
Not just that. Based on the reports, some of the rioters were carrying blue lives matter flags. I would say it's pretty obvious there were shared sympathies between the mob and those protecting the Capitol. Being overrun by attackers i
710.
by bostik 6y ago
> Following this logic we should then add standard libraries and the whole os into account. I realise you're being snarky but systems and verification schemas like that do exist. The terms I most often associate with them is &quot
711.
by bostik 6y ago
Smarkets | Full Time | ONSITE [REMOTE during the plague] (London, UK; also Downtown LA, California) We're a modern betting exchange, going technology first to enable proper price competition in a field of fat commissions. Join a small
712.
by bostik 6y ago
Yup, according to these "researchers" having robots.txt on your website is enough to warrant a CRITICAL vulnerability. No, I'm not joking. That's one of the reports I saw in November. I've also had to triage the cla
713.
by bostik 6y ago
Short expiration date on an offer, coming out of the blue , makes it an exploding one. I'm sorry, but that's how it is. There is also a very easy solution. I've done my fair share of hiring. We have hiring windows too, and h
714.
by bostik 6y ago
Annuity buy-backs, anyone? Someone at Wall Street must have thought of that and pitched the securitisation already. Think about it - large companies agreeing up front to spend a minimum of X billion a year buying back their stock. And then
715.
by bostik 6y ago
I'm going to take flak for this, but I believe it needs to be said. (And for the record, I have been dealing with audits and auditors continuously for the last 5 years. In 2019 I spent 25% of all my working hours directly working on
716.
by bostik 6y ago
> Maybe the real problem is that the FIPS standards are too conservative? Quoting a professional cryptographer: FIPS compliance means that your code/system is sufficiently mediocre. Conservative would be one thing. Stubbornly out
717.
by bostik 6y ago
And the fact that RH kept a far larger portion of the price improvement as their kickback. As the article mentions, the standard brokerage cut is 20% from the price improvement. RH demanded 80% of it for themselves. Sure, their customers st
718.
by bostik 6y ago
Yes, "long Covid" is a thing. There are several reported cases in the UK, with around 2% of patients taking months to recover.[0] In effect, while it takes couple of weeks of potentially intensive treatment to tackle covid-19 infe
719.
by bostik 6y ago
Correct. I've been saying since ~2013 that Elopcalypse was the best thing to happen to Finnish ICT sector. Sure, it was painful and horrifying, and a lot of really good talent left the country for good. (Headhunters and recruiters for
720.
by bostik 6y ago
I remember going through the Verizon specs for phones and manufacturer at the time (N9 wasn't properly out yet, so we were targeting N900). Verizon had not updated their hardware requirements so it was impossible to get approval for

More ›