dguido

15 ms·

151.
by dguido 10y ago
I'm the speaker in this video. AMA! If you're interested in more of the technical details of how a CRS (automatic bug finding system) works, I recommend watching this presentation from my colleague Artem Dinaburg. "Making A S
152.
by dguido 10y ago
The CheckedC compiler from Microsoft (built on LLVM) is probably a more complete solution to the issue of memory unsafety in C. Check it out! https://github.com/Microsoft/checkedc
153.
by dguido 10y ago
It depends on the market you're after. Sophisticated buyers won't ask for certifications. They can look at your work and understand your value. Those are the clients my firm is after. Leads that ask for certifications drop out of
154.
by dguido 10y ago
> None of the flaws exploited in Tor are memory corruption flaws _exploited_ is the operative word here. Show me the list where people wrote exploits for the bugs you point out, or where someone abused them to de-anonymize a Tor user? Th
155.
by dguido 10y ago
Thanks for the support! Really cool to see a project of mine up on the front page of Hacker News.
156.
by dguido 10y ago
Literally none of this matters. None of the flaws exploited in Tor are memory corruption flaws. They are entirely architectural and design flaws. No attacker cares if they move to Rust. _NO ONE_.
157.
by dguido 10y ago
LastPass is a tire fire. How many exploitable vulnerabilities in a password manager do people need to drop as 0day to kill this company? Why is it that we continue to tolerate products that routinely violate the sales claims they make? Star
158.
by dguido 10y ago
Before anyone races in with a suggestion to use a VPN service, I STRONGLY suggest that you consider running your own self-hosted server instead. There is a great set of Ansible scripts to do just that right here: https://github.c
159.
by dguido 10y ago
Yes, choice of VPS provider matters if that's what you're going for. I would bet that Netflix has a fairly complete inventory of all the IP addresses that Amazon owns at this point...
160.
by dguido 10y ago
Yes! We cover that in the FAQ in detail: https://github.com/trailofbits/algo/blob/master/docs/FAQ.md#...
161.
by dguido 10y ago
This is incredibly bad advice. Opera has the worst security track record of every other major browser, and clicking that ad blocker button routes all your traffic through a single endpoint at a Chinese-owned company. Hello surveillance! Eve
162.
by dguido 10y ago
None of this concerns me for an application like NextCloud. Deploying TLS properly is table stakes. What does concern me: this app is written in PHP, famous for such a horrific design that it frequently leads developers down dangerous code
163.
by dguido 10y ago
$6k covers about 3 days of effort by a single security auditor, which barely scratches the surface for a large application like NextCloud. Sorry, security is expensive :-/. You can save yourself some headache by using best practices an
164.
by dguido 10y ago
Something I've learned from being a consultant is that there are an infinite number of possible build system configurations for real applications. Apple gets the best of all worlds by asking for bitcode since it abstracts any unique re
165.
by dguido 10y ago
I completely agree. It's fairly simple to isolate and sandbox individual compiler processes in the cloud and fully mitigate this risk. You can be sure that whatever processes the bitcode on Apple's servers is only supposed to touc
166.
by dguido 10y ago
> How much could you actually transform with a high degree of certainty that you don't break the application? Compilers routinely "modify" the programs given to them via optimization passes and the like. This is normal. By
167.
by dguido 10y ago
As another security expert, I see tremendous security opportunities presented by bitcode. Apple can start providing high-fidelity feedback to application developers about security risks in their applications through both XCode and the app s
168.
by dguido 10y ago
@computerality extracted the sections that changed between the iOS 9 and 10 security white papers here: https://gist.github.com/computerality/3e0bc104cd216bf0f03f8d... <--- only the new parts tl;dr: https:/&#x
169.
How Alexsey Belan hacked into more than a dozen tech companies(medium.com)
1 points by dguido 10y ago|0 comments
170.
by dguido 10y ago
Many highlights in this thread on Twitter: https://twitter.com/dguido/status/839843696078127104
171.
RAND Study Examines 200 Real-World 'Zero-Day' Software Vulnerabilities(rand.org)
6 points by dguido 10y ago|1 comments
172.
by dguido 10y ago
I would ask the same in the opposite direction. Please make a list of companies that have positively confirmed they're receiving help from Assange. So far, there is no public evidence beyond a tweet from Wikileaks.
173.
by dguido 10y ago
Don't believe anything from Assange until it's confirmed by the tech companies themselves. Ask the security teams at each of these companies if they received any information from Wikileaks. From the people I know at the affected c
174.
by dguido 10y ago
There are plenty of alternative sources I could list, but Matt's blog post is 1) accessible 2) correct 3) short. That's a winner in my book!
175.
by dguido 10y ago
Great point, but this sounds like a topic for another blog post. I'm so glad that FIDO U2F is starting to catch on. I keep a drawer full of keys at work and hand them out to all our office visitors. The next generation of Bluetooth, NF
176.
by dguido 10y ago
Yes, definitely always keep your OS up to date! Even in 2017, this is still a major advantage that iPhones have over Android phones. There will be bugs in any device, and iPhones have a better plan for dealing with them than Android phones.
177.
by dguido 10y ago
Hi, my name is Dan, and I don't recommend anything on the privacytools website. Above all the many problems it has, it recommends using insecure hosted VPNs and advocates an app-centric approach to restoring your privacy (e.g., Install
178.
by dguido 10y ago
Do you own a disassembler? I do. Also, a decompiler, debugger, and other analysis tools. Closed source does not mean "black box." And besides, open source doesn't mean anyone has reviewed the code. Reviewing a program for sec
179.
by dguido 10y ago
I have a security review for a news room coming up, and I plan on sharing this blog post with them. Thanks for writing it Matt! I'm definitely behind all of the points you made. If anything, I worry that non-technical users will still
180.
by dguido 10y ago
There was some additional detail about this post discussed on these two Twitter threads: https://twitter.com/justinschuh/status/835264832001593344 https://twitter.com/dwizzzleMSFT/status/

More ›