cschneid

22 ms·

211.
by cschneid 14y ago
There are several areas of space, designated by security level. * In "High Sec" - you can shoot whoever you want. When you shoot somebody without the right to (ie, they stole from you, you can shoot them), then you have a few seconds (up to
212.
by cschneid 14y ago
It's about trust. The transaction hits the network immediately. Then a miner puts it in a block as soon as right away, or as slow as... several days (if you put a transaction fee, you'll move to the frontish of the line). Once its in one
213.
VimDrills #9: Repeating Oneself(vimdrills.com)
2 points by cschneid 14y ago|0 comments
214.
by cschneid 14y ago
No, chef/puppet/etc are configuration management tools. They automate the manual typing of server setup commands, and then verify that the system stays that way. They are not security tools. So you're on your own on what to actually tell t
215.
by cschneid 14y ago
Re pepper: It's a STRONG password. It turns '12345' into 64 random characters + '12345'. Meaning that you can't brute force against a dictionary, unless you have that pepper value. Which is only stored on the production system. This turns
216.
by cschneid 14y ago
You're right. Throwing shit at the wall can screw things up, and you must still be using a proper full-strength hash, and not just throw crypto primitives at it. What I'm suggesting is that secrecy is a useful layer on top of a valid crypto
217.
by cschneid 14y ago
IMO, you should be doing both. People should use strong bcrypted passwords, with a salt, then ALSO a 'secret' pepper value (long value stored in app code). This adds additional security in the case of a db-only dump being released, and do
218.
by cschneid 14y ago
Well, for this specific issue, it was an executive branch decision that allowed, and now doesn't allow unlocking. Laws are often just "hey, executive, do this", and the executive figures it out (see also: EPA, FTC and lots more).
219.
by cschneid 14y ago
Damnit, I'm busy fixing the devise issue!
220.
by cschneid 14y ago
Thanks. Is there a firewall level rule we can use to block requests (in addition to updating rails itself). We have a ton of apps to update, so a catchall rule would be very helpful.
221.
by cschneid 14y ago
Is there any more info about the severity of this attack? Is this a drop-everything issue? What are the vulnerable endpoints (reading between the lines implies password resets?).
222.
by cschneid 14y ago
My girlfriend teaches high school. Another teacher there teaches a class sponsored by a local community college. The curriculum is strict, and the teacher needs a masters to qualify. And then the kids end up with real college credit.
223.
by cschneid 14y ago
One thing I'd suggest is to learn a vastly different language. If you use ruby all day, learning python probably won't give you the type of insight that learning C would. Or learning a lisp. So much is looking at things in a different way
224.
by cschneid 14y ago
I'm happy that Nathan is sharing his experience here. It's an interesting project. My development advice would be to get buildable, deployable (and deployed!) copies of the app early. A new developer's skill often peters out around the ed
225.
by cschneid 14y ago
What have you spent money on so far? 500 bucks out the door before development starts seems pretty large, unless I'm missing some consulting time, or tools?
226.
by cschneid 14y ago
Note the comment about Yaml parsing in 1.1 era rails apps. You'll want to at least look into what your app is doing.
227.
by cschneid 14y ago
That is correct. The latest 3.1.10, or latest 3.2 series have this update. See the top of the linked notice: Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15
228.
by cschneid 14y ago
Name.com has been my default registrar for a while, and is pretty decent. Recently while renewing a domain, the anonymous registration stuff didn't apply right (paid for 2 years, got 13 months instead. no biggie). Their support fixed it ov
229.
by cschneid 14y ago
This idea has been floated before: http://www.freakonomics.com/2010/11/18/freakonomics-radio-co... Basically just taking all the interest from the loans, and splitting it up as payouts in a lottery among everybody who has money saved.
230.
by cschneid 14y ago
When my paypal was broken into - it was immediately used to order from a EU based usenet provider. Paypal reversed it for me, but I wonder how much of this is fraud related?
231.
by cschneid 14y ago
Options are really cool since they are so well named. They really do give you a ton of options to adjust your risk to exactly what you want. On one hand, you can have infinite risk strategies, on the other, you can lock in a stock price al
232.
by cschneid 14y ago
Downside is obviously the 100% loss you'd take on the $400. Assumption you're making: That FB is overvalued currently, and has 15% to fall (it's at 20 now, and you are saying it will go down by $3 by the 18th [tomorrow!!!]) I'm not sure whe
233.
by cschneid 14y ago
I use the 1password pronounceable strings. Still plenty random, but you can say it over the phone to a customer service person if you ever do need.
234.
by cschneid 14y ago
Coffee also apparently prevents prostate cancer to some degree too: http://www.webmd.com/prostate-cancer/news/20110517/coffee-ma... For your own safety, go make some now.
235.
by cschneid 14y ago
Re: pepper - The devise plugin for Rails uses it. The idea is that the attacker must now steal both the app code AND database, which are often on separate servers. Just make their life harder.
236.
by cschneid 14y ago
"Cracking" in this sense is brute forcing. SHA1 is fast, and people use bad passwords. The combination means that you can run through lots and lots of bad passwords very quickly. I checked my linked in password I have stored in 1password
237.
by cschneid 14y ago
Remember salts don't need to be secret to do their job. The goal is to change the algorithm slightly (by adding additional input) for each user. That means you can't mass-precompute (rainbow tables), and just look up what matches, you hav
238.
by cschneid 14y ago
Steps I used to setup a linode service to do IPv6 hosting: (running apache, running passenger for ruby) 1) ifconfig to get my already assigned ipv6 address 2) Setup my DNS AAAA record to point to it (for both www and blank). 3) There is no
239.
by cschneid 14y ago
I bought a clothes steamer a while back (Jiffy Steamer), and I was pleasantly surprised that it had a full circuit diagram and component list included in the instruction book. I can take that sucker apart, fix things, and put it back toget
240.
by cschneid 14y ago
Different compilers will generate different compiled code, even on identical input (ie, clang vs. GCC). So the binary will be different.

More ›