dguido

26 ms·

211.
by dguido 10y ago
I was one of these people! I still have all the bars from the same pack, in case anyone wants to run experiments. The bar that made me sick was part of the known bad "2:07 B.B. 14JUL17 F3 1966" batch. I ate one of the contaminated
212.
by dguido 10y ago
Here's the criminal complaint. Check Paragraph 12, sounds like he just liked to take work home with him. I'm leaning on the side that this IS NOT ShadowBrokers. https://lawfare.s3-us-west-2.amazonaws.com/staging&#x
213.
by dguido 10y ago
Close! tis-interpreter requires inputs to drive it, so we fed it inputs that the CRS generated, that AFL generated, and some existing test cases. tis-interpreter found 4 bugs and clang found 1. > This doesn't necessarily mean CRS is
214.
by dguido 10y ago
There are different types of funding provided by Mozilla. We participated in the Secure Open Source (SOS) Fund and that was pretty straightforward. Mozilla pays a security firm to audit an open source codebase and then report their findings
215.
by dguido 10y ago
Hacker News aught to auto-mod stories with "ESR" or "Eric S Raymond" down. His ntpsec project is an insecure joke and half his blog posts are unintelligible racist, sexist rants. Don't give him more air time.
216.
Look out endpoint vendors, you've got competition in your mirror (osquery/Win32)(blog.trailofbits.com)
8 points by dguido 10y ago|0 comments
217.
by dguido 10y ago
For all the conspiracy theorists and people crying "who will they go after next": All that's happening here is a non-profit is buying ads for common ISIS-related search terms and displaying anti-ISIS advertisements. You know,
218.
by dguido 10y ago
It could result in a huge influx of people from north brooklyn, where there will be no trains, moving to south brooklyn to get to the trains you mentioned.
219.
by dguido 10y ago
This is awful advice and you would be wise not to follow it. > Your first choice of web browser should be the TOR browser with Javascript disabled. > Your second choice of web browser should be the TOR browser with Javascript enabled.
220.
by dguido 10y ago
Schneier is basically blogspam. Quotes entirely from another article, follows up with "I don't know what this means???" Why do people keep reading him?
221.
by dguido 10y ago
The pro-democracy campaigner in this article openly admits to discussing assassinating the prime minister of Fiji with other members of his group. It seems kind of silly to act incredulous when you find out that he might, then, have been wa
222.
by dguido 10y ago
https://github.com/jedisct1/libsodium-php https://paragonie.com/book/pecl-libsodium Docs happen to be written by the OP too...
223.
by dguido 10y ago
Unless it is formally verified, then it is really perfect. Not sure why we shouldn't strive towards that final state of evolution. Conceding the game at "good enough" is a cop out.
224.
by dguido 10y ago
We released a passwordless auth library for iOS about 2 weeks ago. At first glance, it looks much simpler than the process described on this website. We also take advantage of Secure Enclave key storage rather than leave the authenticator s
225.
by dguido 10y ago
Hey Zardus, I'm sure the info reached you. What team are you? We approached everyone either indirectly through broadcast emails or directly through me calling/emailing. I'm not sure an internship would have been what we were
226.
by dguido 10y ago
How is this news? This entire post is blogspam referencing a 2014 Blackhat presentation about a cheap social engineering trick that has nothing to do with SSL. https://www.trustwave.com/Resources/SpiderLabs-Blog/Re
227.
First startup powered by osquery gets funded(fortune.com)
1 points by dguido 10y ago|0 comments
228.
by dguido 10y ago
If Stefan says it will you believe me? https://twitter.com/i0n1c/status/745922795977187329 You just used a kernel privesc that you probably already had to read it. NOT A BIG DEAL.
229.
by dguido 10y ago
This is stupid. Anyone interested in writing jailbreaks for iOS would have already had access to these binaries. People are blowing this way out of proportion.
230.
by dguido 10y ago
You're right. Before any integration of a server-side PGP key like this, they ought to have deployed some basic hygiene like a strict Content Security Policy (CSP) and a better sanitization library like HTMLpurifier. I don't trust
231.
by dguido 10y ago
I hope this will become a parable for applying "data science" without sufficient input from practitioners in the field.
232.
by dguido 11y ago
Ryan is still working on it. Expect it up on the Trail of Bits GitHub alongside a blog post soon. If anyone has any questions, there are a few people from the company reading the comments. Feel free to ask and we'll do our best to repl
233.
by dguido 11y ago
I think we have talked this issue to death and I'm sad to see this on the front page, again. This list is one of the worst, if not the worst, public initiatives ever undertaken by the EFF. More than anything, it represents how the EFF
234.
by dguido 11y ago
S/MIME and GPG support out of the box, that's amazing!
235.
by dguido 11y ago
To address the title: It does not happen in practice, and the idea that "simply because code is open-source and viewable, it is more secure" needs to die. It is an open-source fantasy, like Linux on the Desktop. Code becomes secur
236.
by dguido 11y ago
Yes, the obvious first mitigation was to ensure that all iMessage clients used pinned certificates. This prevents an attacker who can forge their own certificates from obtaining encrypted iMessages and launching the JHU attack.
237.
by dguido 11y ago
If you're struggling to understand the impact of this iMessage flaw, remember that it requires either a Root CA or Apple's help to work. If you're considering an attacker with access to a Root CA, then you have problems far b
238.
by dguido 11y ago
How many more Pwn2Owns will we need to have until all the security vulnerabilities in browsers are gone?
239.
by dguido 11y ago
No, Firefox is not even a challenge enough to be listed.
240.
by dguido 11y ago
I think that's because they're talking about how it could play out, not how they want it to play out.

More ›