d4mi3n

35 ms·

331.
by d4mi3n 5y ago
Speaking for myself working in cybersecurity, I suspect a lot of corporate and government IT/InfoSec folks are too busy rolling out recommended mitigations and observability improvements to have too much to say. Mainstream media does a
332.
by d4mi3n 5y ago
Coming from the Ruby ecosystem, a lot of this played out similarly to how the Rack[1] middleware conventions developed in the early Rails v1 and v2 days. Prior to Rack there was a lot of fragmentation in HTTP server libraries, post-Rack eve
333.
by d4mi3n 5y ago
I work as a security engineer for a benefits provider. This stuff has been top of mind for me, the rest of my team, and our CSIO. I love the direction you're going with this. Would love to hear more about: 1. Status. Is this a beta pro
334.
by d4mi3n 5y ago
Love the work you folks do at USDS. What kind of needs do you have for Security Engineers specifically? There's a lot of ground to cover just in that specialty and I'd love to hear what specific security problems are top of mind f
335.
by d4mi3n 5y ago
There's concept similar to what you're describing called crypto-shredding[1]. Hashing isn't a good way ensure the confidentiality of data--just the authenticity--you really want to prefer a solid cryptographic algorithm if yo
336.
by d4mi3n 5y ago
I think this is a good take, though depending on your domain and the maturity of your security program you eventually reach a point where the blast radius from misconfiguration becomes manageable through mitigations you have in place. Past
337.
by d4mi3n 5y ago
Ah, good call out. I'm mixing up Okta's SDK integrations with stuff more similar to a CASB or authenticating proxy. An organization I worked at in the past solved this problem by using Terraform/IaC to deploy authenticating p
338.
by d4mi3n 5y ago
> A major complaint the "Zero Trust" people have about modern VPNs is that app-layer proxies can do device-context authentication --- so "employer-owned device, up-to-date patches" is a valid access rule, and that&#x2
339.
by d4mi3n 5y ago
> Not lying about convictions sounds great from the pious ivory tower or from seasoned professionals who may have enough experience that others are able to look beyond their past. Sadly--and I do mean this, I agree with your sentiment--w
340.
by d4mi3n 5y ago
My company is hiring. I'm a firm believer that folks shouldn't be punished by the US justice system, but instead reformed. I can't speak to your circumstances, but my team is hiring for folks like you and barring any policies
341.
by d4mi3n 5y ago
This is absolutely correct! Modern technical security practice preaches defense-in-depth. Over a long enough period of time, you WILL be compromised. It’s much more effective to plan for it and mitigate the damage than it is to attempt perf
342.
by d4mi3n 5y ago
Yep. To add insult to injury, for many years there either wasn’t a setting to disable loading of external programs or doing so required a subscription of some kind to a MS enterprise license/endpoint/policy management feature.
343.
by d4mi3n 5y ago
That depends entirely on their backgrounds. I myself do not. The status-quo here isn’t too different than anywhere else in the tech sector. Many security engineers transition into infosec from related fields like IT, DevOps, Network Enginee
344.
by d4mi3n 5y ago
They may not have one, or have one that’s so underwater with larger issues that the rest of the org doesn’t know how to route things to them. Hiring for technical security is hard —you need engineering expertise to find good people, and th
345.
by d4mi3n 5y ago
> I wish there was a way non-sensitive data could be transmitted plain-text, but signed with a server certificate. This solves many of the same problems, while avoiding many of the problems with HTTPS. Isn't this, more-or-less, HTTP
346.
by d4mi3n 5y ago
We’re on the same page, though I’d argue Google holds a larger share and influence in the internet advertising industry, even if that’s not their only product. I frankly don’t trust FB, Google, or Amazon with my personal data. This becomes
347.
by d4mi3n 5y ago
I can't speak for others, but my personal distaste for Google (the company) is mainly around privacy issues. Other companies on this list have this issue as well (FB, Amazon), but Google is so dependent on advertising revenue that it&#
348.
by d4mi3n 5y ago
Ah, our old friend supply chain security. This is a very, very hard problem to solve without some serious coordination and effort. To do this well you need to do all kinds of things like: 1. Verifying the authenticity of the software you&#x
349.
by d4mi3n 5y ago
While I share the sentiment, there are plenty of perfectly valid reasons one might need or want to do this--I can't comment on that particular article as it seems to have moved off the front page. A few things that could justify rebu
350.
by d4mi3n 5y ago
I agree, though I suspect viability of models is heavily driven by the economic/regulatory/cultural environment. In the US, we have: 1. A poor social net, meaning employers need to take on the onus of providing many basic benefits
351.
by d4mi3n 5y ago
"Every single developed nation" is a very broad generalization that I'd be skeptical of being true. I'd also dispute that all countries are pro-corperation and instead state that most countries are pro-economy. Corporati
352.
by d4mi3n 5y ago
You are technically correct—the best kind of correct. I think the big distinction here is that external marketing is trying to change public opinion in pursuit of profit to the detriment of competitors (presumably). Internal marketing as di
353.
by d4mi3n 5y ago
> It’s marketing turned inwards. I believe the word for this is propaganda: prŏp″ə-găn′də noun 1. The systematic propagation of a doctrine or cause or of information reflecting the views and interests of those advocating such a d
354.
by d4mi3n 5y ago
> A country being hostile to unions isn't nearly as bad as a country being hostile to corporations. This is a very subjective conclusion that is likely very dependent on what economic class you fall into. Many folks on HN (myself in
355.
by d4mi3n 5y ago
I have to wonder if anti-fingerprinting is the wrong approach to privacy invading advertising. There’s an inherent asymmetry between the resources available to those who build these systems and those who try to stop them. I’d love to see mo
356.
by d4mi3n 5y ago
I was unaware of it as well, thanks for calling it out. I don't think you were wrong to call out your suspicions, I was just unaware of what controls or processes were in place (if any) to prevent the need for users to police stuff.
357.
by d4mi3n 5y ago
Aside: Is HN so fragile that it requires end-users to police anomalous activity? Given the age and influence of the platform I'd assume dang and co. who moderate and maintain the board are old hands at staying on top of manipulation of
358.
by d4mi3n 5y ago
I don't know enough to comment on "healthiness" of assumptions about ones' self and where they fit into analysis like in the OP's link. My commentary is purely on how we communicate with each other in a time where d
359.
by d4mi3n 5y ago
Social media in particular really degraded my social life for a number of years prior to minimizing Facebook in my life. I found that: 1. With all the little updates you get through Facebook, a lot of people feel that there isn't as mu
360.
by d4mi3n 5y ago
Still waking up and it's possible I misread GP, but their comments didn't seem disingenuous on my reading. It's healthy to be skeptical of something that varies that much from one's personal experience. Your reply about

More ›