dsacco

340 ms·

2041.
by dsacco 12y ago
The salary bands are the sort of thing you'd see listed on a page devoid of context. They're minimums and flexible. If you have 10 years of dev experience and you're a strong enough case to get a yes from an infosec firm, the
2042.
by dsacco 12y ago
You don't need to move. There are plenty of companies hiring remote positions based in NY or SF that will pay you a local salary despite being remote.
2043.
by dsacco 12y ago
Sorry about just getting back to this, I didn't think there'd be such an interest. I'll go in order. 1. >> I mean, you're in NYC. Are you referring to someone outside that area? Yes I'm in NY (Westchester, act
2044.
by dsacco 12y ago
I know engineers without a degree who pull $250k a year. Here's an example: you can become a principal consultant at the best and most well-known infosec firms in the world without a degree. By and large, they don't care. Even the
2045.
by dsacco 12y ago
Fair point. I live in Westchester now, and most of Westchester is not within reasonable walking distance of Metro North for a daily, morning commute. All of Woodlawn is.
2046.
by dsacco 12y ago
Yes, that's exactly what I mean. Treat all user-input (and by extension, client-side anything) as dangerous. A server putting a security protocol in the hands of the client when it is not unavoidable is usually bad.
2047.
by dsacco 12y ago
That's a fair point, though it doesn't outweigh the myriad other reasons not to do client-side hashing. Security is always a battle of usability and tradeoffs. Client-side hashing simply doesn't make sense for security. It re
2048.
by dsacco 12y ago
A lot of the advice in this thread is good, so I'll stick to one point. Let me tell you what a qualified lead is :) A qualified lead is a potential customer who fits all of these criteria: 1. Is willing to use your service or your pr
2049.
by dsacco 12y ago
You're right that it's bad to store non-hashed passwords, but your point about security is unfounded. Facebook, and any other company you'll log in to, requires a non-hashed password at some point to check against the hash.
2050.
by dsacco 12y ago
I've lived in NY all my life, in both Manhattan and the Bronx. I also used to go to Staten Island weekly. Here are some notes: * The Bronx: I lived in Woodlawn. I think it's very interesting that it's one of the most affordab
2051.
The Bug Bounty Study: Improving Responsible Disclosure(breakingbits.net)
1 points by dsacco 12y ago|0 comments
2052.
by dsacco 12y ago
That's a pretty heavy handed definition of irresponsible disclosure. The onus of patching security flaws is on the company, not the security researcher. Responsible disclosure is a courteous and respectful form of helping a company fix
2053.
by dsacco 12y ago
I run http://breakingbits.net , my security consulting blog, on WPEngine. I highly recommend it. Wordpress gets a very bad rap with security but as long as you generally disable comments, are paranoid about plugins and themes, an
2054.
by dsacco 12y ago
Thank you for this. I had been using different iOS apps for a while, some of them paid, and none of them really gave me the functionality I was looking for. Thanks to your comment, I just tried MiniHack out. This app has beautiful typograph
2055.
by dsacco 12y ago
I've never once had difficulty reporting a security vulnerability to Apple. For that matter, I've never seen any of my friends in /r/netsec have difficulty either. Slow to respond? Perhaps, if they receive many reports.
2056.
by dsacco 12y ago
SEEKING WORK Location: NYC Remote: Yep, but also willing to go onsite. Need security? I'm a consulting security engineer for all levels of product development (network, web, mobile). I offer rock solid penetration testing and sou
2057.
by dsacco 12y ago
Location: NYC Remote: Yep, but also willing to go onsite. Willing to relocate: Not really, only looking for contract roles. Technologies: Need security? I'm a consulting security engineer for all levels of product development (
2058.
by dsacco 12y ago
Speaking as a security consultant - don't give a reward. What they did is technically illegal and not in the spirit of security testing. If someone finds a vulnerability accidentally (I've done this before), they won't ask fo
2059.
by dsacco 12y ago
This suggestion eliminates bugs that are introduced by unsafe typing, sure. But race conditions, logic flaws, misconfigured tools and almost every class of web vulnerability wouldn't be eliminated just by implementing this. Most vulner
2060.
by dsacco 12y ago
There is a fine line between automating fully-automatable penetration testing tasks and automated scanning. Unfortunately, there is a very idealistic drive to feature-creep penetration testing tools away from "useful when used by a pro
2061.
by dsacco 12y ago
SEEKING WORK - REMOTE or NYC Security engineer with a background in web application, mobile and network penetration testing, source code auditing and reverse engineering. Past clients have included both pre-funded startups and large AmaGooB
2062.
by dsacco 12y ago
SEEKING WORK - Penetration testing, security auditing. New York City OR Remote Email: dylan@breakingbits.net Website: http://breakingbits.net I'm a software engineer and security researcher. I'm available on a consulti
2063.
by dsacco 12y ago
Hello everyone, I reported this flaw to GroupMe. If you have any questions about it, feel free to ask.
2064.
GroupMe Account Takeover Vulnerability(dsaccomanni.blogspot.com)
3 points by dsacco 12y ago|1 comments