daeken

83 ms·

931.
by daeken 14y ago
I think your definition of "bad" implies a high likelihood of failure. Whereas I'd say that a "bad" startup is one with a low growth or profit potential; my guess is that pg's definition is similar. A bad startup can "succeed" and a great
932.
by daeken 14y ago
This is a million degrees of wrong. With bcrypt, scrypt, and PBKDF2, there is no "adding a salt". It's an inherent part of each algorithm. If you're "building" a salt, you're doing it wrong, period. > It's trivial to build a lookup
933.
by daeken 14y ago
Common in bowling as well, for the cuts you'll inevitably get on your thumb. Most pro shops will sell liquid bandage, which is essentially just superglue as well.
934.
by daeken 14y ago
I had a bunch of fun coming up with terrible ways to write FizzBuzz a little while back. My favorites, in Python https://gist.github.com/daeken/1e3c680c20da98c680c4 and C https://gist.github.com/daeken/15769d83b66974335f78
935.
by daeken 14y ago
Alternatively, the ping times were great considering that pigeons were the transport.
936.
by daeken 14y ago
Security consultant, pentester, breaker. I prefer the latter.
937.
by daeken 14y ago
It's not the anon that I care about, it's that someone is being an asshole in public to people I consider to be friends, and using my (and nbpoole's) name to do it. I'm not fond of that.
938.
by daeken 14y ago
Totally agreed on all counts.
939.
by daeken 14y ago
I have a Windows VM that's snapshotted with all of my favorite tools. When I need to test something, I do so and then roll back. No mess, no cross-pollination of tests.
940.
by daeken 14y ago
So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for
941.
by daeken 14y ago
No, but "So You Want To Be A ..." is a reference to http://en.wikipedia.org/wiki/Quest_for_Glory:_So_You_Want_to...
942.
by daeken 14y ago
It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers
943.
by daeken 14y ago
Every one of them is either about it or a link to the site itself.
944.
by daeken 14y ago
While I don't deal with enterprise sales, I do security consulting for the enterprise, and one thing I do is never lower my prices. Instead, I'll just add additional value over top, e.g. an extra day of consulting. Yes, it has the same ef
945.
by daeken 14y ago
> Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate. Couldn't agree enough. Even if this is something you do as
946.
by daeken 14y ago
I'm probably going to set up a mailing list soon, but if you drop me an email at cody.brocious@gmail.com I'll make sure to let you know when I put out the others. Glad you found it useful! Oh, also, follow me on twitter, as I'll certainly
947.
by daeken 14y ago
One thing I learned early on in business is: it's always easier to lower your prices than to raise them, so set your initial valuation high; you can always drop it later if you need to.
948.
by daeken 14y ago
Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.
949.
by daeken 14y ago
Justifying the expense wouldn't be difficult at all. However, I think the free version is Just Fine (TM) unless you need stuff like the scanner or intruder (intruder works in Burp Free, but is limited to something like 1 request/second).
950.
by daeken 14y ago
> Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also e
951.
So You Want To Be A Breaker, Part 1: Web Security(daeken.com)
261 points by daeken 14y ago|83 comments
952.
by daeken 14y ago
I thought about mitigating that, as it could definitely have some nasty effects, but couldn't come up with a decent way to do so. Hopefully, people won't misconfigure it too often!
953.
by daeken 14y ago
I get around this with nginx rewrite rules. Since my old blog was Posterous, I spit out a bunch of rewrites to map my old URLs to new ones, e.g.: rewrite ^/superpacking-js-demos$ /2011-08-31_Superpacking_JS_Demos.html;
954.
by daeken 14y ago
Nope, no DB at all. The way you edit the content is 100% up to you, but at the end of the day, your entries are just Markdown files in a directory. You can see my whole blog setup at https://github.com/daeken/Benjen/tree/master/daeken.co
955.
by daeken 14y ago
Rather than a web app that runs and serves up content dynamically, this just spits out HTML that your webserver can serve up. No additional surface area for attack, no need for caching to keep things efficient, etc. Super simple.
956.
Show HN: Super simple static blog generator, Benjen(daeken.com)
90 points by daeken 14y ago|45 comments
957.
by daeken 14y ago
> Chrome extensions are worse than just "accessing all your data", since they actually inject code into running web apps en masse. At least with Windows, they'd have to patch a particular binary (and it's non-trivial to so). There's no
958.
by daeken 14y ago
As far as I'm aware, that's not done here. (Warning: I've read analysis on the process, but haven't looked at the code myself)
959.
by daeken 14y ago
I used 960gs for the first time last night, to build the template for http://daeken.com/ (had to finally switch from Posterous). It was amazingly simple, even for someone completely CSS brain-dead. Really can't say enough good things ab
960.
by daeken 14y ago
There's really no need to. Given a single block of RC4 ciphertext and no known plaintext, the possibilities for cryptanalysis are slim at best.

More ›