dguido

40 ms·

361.
by dguido 13y ago
Uhhh, that post looks more like rampant speculation than an update on where things stand. Here are a bunch of primary sources of info that came out over the weekend instead: http://www.washingtonpost.com/politics/federa
362.
by dguido 13y ago
More here: "5 Ways NSA leaker Edward Snowden's story isn't holding up." Nearly every statement in his video interview is vastly exaggerated. http://news.yahoo.com/5-ways-nsa-leaker-edward-snowdens-stor...
363.
by dguido 13y ago
FFS people, this is called MAPP and the program has been public and a huge security success for the last few years. Microsoft advises lots of security companies about patches slightly before they are issued. That way, everyone has options o
364.
PBS: What Should Be Up for Public Debate When It Comes to Secret Surveillance?(pbs.org)
1 points by dguido 13y ago|0 comments
365.
by dguido 13y ago
PROTIP: the guy who wrote the article is a US-based journalist.
366.
Comparing ASM.js and NaCl(blog.leafsr.com)
3 points by dguido 13y ago|0 comments
367.
Don't get added to the YAML botnet, come to a Ruby Security workshop in NYC!(blog.trailofbits.com)
3 points by dguido 13y ago|0 comments
368.
by dguido 13y ago
This is completely off-topic. Where in the entire IP Commission report did they mention anything about the entertainment industry? http://ipcommission.org/report/IP_Commission_Report_052213.p...
369.
by dguido 13y ago
Hm, I'm surprised more people aren't angry at the lack of adoption of cert pinning in mobile apps. It seems like no one cares to prepare for attacks like this, despite widespread knowledge that they occur?
370.
by dguido 13y ago
The easiest thing they can do is use HTTPS and implement cert pinning.
371.
by dguido 13y ago
Here's the full report: http://www.defense.gov/pubs/2013_China_Report_FINAL.pdf
372.
by dguido 14y ago
Are there any security improvements worth mentioning in this release? Ubuntu used to be at the forefront of security on Linux and kept track of improvements made per release on their wiki. This effort seems to have stalled after the departu
373.
by dguido 14y ago
I find opposition to this bill somewhat hilarious. On one hand on the front page right now, we have FBI soliciting the public for information after we've experienced a serious attack. Efforts are underway to crowdsource the identities of th
374.
by dguido 14y ago
Here is a video of a similar attack being performed on a real car by another researcher who discovered the same vulnerabilities/attack vector in parallel to the academic team (1m30s): https://www.youtube.com/watch?v=bNDv00SGb6w NOT theore
375.
by dguido 14y ago
You know, others might have a pet peeve for exactly the opposite reason. A lot of what people call hacking now-a-days is building things with tools that were meant to do exactly what a developer is doing with them. This use of the term hack
376.
by dguido 14y ago
I don't care if it's beautiful, or how it auto-saves drafts, I want an e-mail client designed with security from the start. Everyone seems to be up in arms about privacy these days, but people forget both how much data is available inside t
377.
by dguido 14y ago
See page 8: http://www.ncix.gov/publications/reports/fecie_all/Foreign_E... Here's one egregious example of China stealing clean technology from the US (sorry for the paywall, but it was the best source): http://online.wsj.com/article/SB
378.
by dguido 14y ago
Looks like all that stolen technology can't save the company from making bad business decisions. Solar and other green tech intellectual property has been among the highest priorities for Chinese hackers in recent years.
379.
by dguido 14y ago
I feel like any communications app, especially e-mail related, that's trying to label itself as "modern" needs to include some support for crypto as a requirement. I hope the Dropbox people push for things like that from Mailbox, given thei
380.
by dguido 14y ago
I'm getting tired of this. If you want to stick your head in the sand and ignore the data, then fine. Try and ignore this: 50% of all Android devices have unpatched vulnerabilities for which exploits exist. https://blog.duosecurity.com/201
381.
by dguido 14y ago
Sorry! It wasn't a threat, just pointing out my disagreement.
382.
by dguido 14y ago
The updating problem is a design flaw they knew they would have to deal with and that they did nothing about until version 4, when they started trying to separate core functionality out into apps. That's not acceptable. Code signing can be
383.
by dguido 14y ago
There are safe ways to enable access to it. Take ChromeOS for example, which has a hardware switch on the outside of the device that "jailbreaks" it and allows access to these features. Lack of such creativity by the Android team with regar
384.
by dguido 14y ago
You clearly didn't read a single link that I posted. I did a comprehensive study of all malware targeting mobile devices between 2011 and 2012 and, yes, they are targeting the device itself and the design choices made while building it. EDI
385.
by dguido 14y ago
I linked to our research page, right? http://www.trailofbits.com/resources/mobile_eip_2.pdf http://techchannel.att.com/play-video.cfm/2013/1/8/Conferenc... http://techchannel.att.com/play-video.cfm/2011/7/14/Conferen... If you think t
386.
by dguido 14y ago
You couldn't be more wrong and, unfortunately, I don't have the karma yet to enable downvoting :-). Easy example as long as we're on the topic, the Chrome browser or ChromeOS. I can think of a dozen things that could be done to Android to b
387.
by dguido 14y ago
heh thanks for the support and, yes, you got my position right. For anyone who might be thinking I'm an iOS fanboy or something, our company is probably harder on Apple than any other in the world with regard to security: http://www.trailo
388.
by dguido 14y ago
His attitude towards security is well known among those attempting to help make Android devices safe for people to use. His refusal to believe that a device could be both safe to use and popular or safe to use and useful has directly led to
389.
by dguido 14y ago
Andy Rubin was the major factor responsible for insecure Android devices. He thought it was impossible to be both secure and 'X' for any 'X'. Meanwhile, Andy Rubin's replacement is Sundar Pichai, SVP for Chrome and ChromeOS. http://en.wiki
390.
NYU-Poly has a summer cybersecurity program for women in high school(poly.edu)
1 points by dguido 14y ago|0 comments

More ›