dsacco

30 ms·

211.
by dsacco 9y ago
Don't sue people if they publish vulnerabilities without any notification to the vendor, as long as they never overstepped and exploited it themselves.
212.
by dsacco 9y ago
"Slimy" and "gross" are not nearly sufficient for either insider trading or market manipulation. I don't particularly like the way these researchers are acting either, but that's actually because I don't l
213.
by dsacco 9y ago
> I think the "security industry" has a delusional image of themselves and regard most of them as grey hats at best. This criticism of the industry might hold more weight if you actually evidenced a willingness to use termino
214.
by dsacco 9y ago
> They do not make money from the exploitation of the companies whose software/hardware they find flaws in. Right, and neither did these researchers. In point of fact, no, the difference really isn't all that stark. It&#x27
215.
by dsacco 9y ago
> There is a "reasonably accepted" definition of black hat, by your reasoning, and it is: someone who uses computers in bad faith. Speaking as someone who 1) works in the security industry, 2) has managed corporate disclosure
216.
by dsacco 9y ago
Excellent, great citation! Now, precisely what did the security researchers hack for their own gain, and precisely which computer's security was violated? If we can call them "hackers" just because they ostensibly comprom
217.
by dsacco 9y ago
The problem with your first line is that it leaves the definition of black hat open to interpretation, when that is not how the word is actually used in the security industry or in popular reporting. Black hat activity specifically refers t
218.
by dsacco 9y ago
> If the term is flexible, why the hard reaction to my flexing of it? The terminology is not flexible, it has a well established meaning. If your bar for a black hat includes legitimate security researchers disclosing vulnerabilities
219.
by dsacco 9y ago
There is a reasonably accepted definition for what a "black hat" is. I don't particularly agree with conceptually bucketing people into black hats or white hats, but the paradigm has an existing meaning. In any case, if we
220.
by dsacco 9y ago
I think the difference in facts you're talking about is a difference of degree, not category. In other words, it's not plainly false, there certainly is a vulnerability, it's just perhaps exaggerated. I could see a case bei
221.
by dsacco 9y ago
I'm sure they believe that, but to be blunt, that changes the definition of "black hat" from "compromising people with security vulnerabilities" to "doing things I personally find unsavory when publicly disclos
222.
by dsacco 9y ago
No, it's actually not. It's distinguished precisely by using a vulnerability with the intention to compromise others. You can't just redefine "black hat" to be whatever normative disagreement you have with how peo
223.
by dsacco 9y ago
No they aren't. Aside from the inherent and obvious lack of nuance in that terminology, black hats do not report their vulnerabilities. They weaponize them and use them, or they sell them to criminal organizations.
224.
by dsacco 9y ago
Admittedly no, but considering AMD is up ~3.85% as of this writing, I'm not sure I'd have benefitted from doing so.
225.
by dsacco 9y ago
> It will also serve to increase the premium on 0days... I strongly doubt that. I've seen incredibly serious vulnerabilities I've reported firsthand have little to no impact on a company's valuation when publicized.
226.
by dsacco 9y ago
I've done it once or twice when I reported a vulnerability directly to a company and I knew they'd have to report it to downstream customers pretty quickly. I've also been in discussions for larger vulnerabilities with securi
227.
by dsacco 9y ago
> Could something like this be considered inside information? No, illegal insider trading refers to trading on inside information when you have a confidentiality agreement or a fiduciary duty. Information asymmetry is insufficient (or
228.
by dsacco 9y ago
You’d think that, but Wittgenstein minted his career on calling philosophers out for not thinking critically enough in debates.
229.
by dsacco 9y ago
> They think they're very savvy for having the Uber app and knowing how to use it. In fact my uncle was bragging about some uber benefit he gets via his amex platinum card. In fairness, it’s a great benefit.
230.
by dsacco 9y ago
I’ve done research on credit card data like that. I can tell you both experientially and mathematically that four bits of random information is insufficient to identify people. The information was not anonymized and they were tracking peo
231.
by dsacco 9y ago
There are several reasons, in my opinion: 1. They are very "loud" - VC funding, visibility and large headcount are antagonistic features for a firm specializing in boutique data mining. It's not impossible, it just makes it h
232.
by dsacco 9y ago
Mostly hedge funds and market research companies. Less frequently, companies looking to bootstrap computer vision or natural language processing systems without sourcing their own data. If you productize the data as a forecast, it can cost
233.
by dsacco 9y ago
Do you have a citation for this? I do security reviews for companies with strong HIPAA requirements and I’m nearly certain this is incorrect.
234.
by dsacco 9y ago
I agree with the basic thrust of your comment, which as I interpret it boils down to saying it's unhelpful to throw book titles at a person without any context or guidance. However, I disagree with this point: > If some 2-minute vi
235.
by dsacco 9y ago
> I'm curious what exactly that person is doing. You seem to be describing a leader but not necessarily tech/science innovator. He’s a research scientist at a tech company. He resolved a central open problem in his field whil
236.
by dsacco 9y ago
Rather than simply give you a list of resources or textbooks, I’d like to give you a broad “map” of the various domains of mathematics, this way you understand what you’re working towards. I’d also like to recommend how you can maximally op
237.
by dsacco 9y ago
> But WireGuard seems to use a single key per network interface. Every interface is associated with a public/private key pair, but each interface need not peer with a single client. That would be inefficient. Instead, each peer (i
238.
by dsacco 9y ago
> The best scientists probably won't be recognized during their lifetimes. The scientists you do recognize while they're alive, are probably not the best at "science". Hard disagree, unless what you mean by recognit
239.
by dsacco 9y ago
> Medium levels of intelligence is require for most jobs, even in Investing you do not need to be that bright to be "the best" in the field. At the risk of kicking off a debate to define the word “intelligence”, I think you’r
240.
by dsacco 9y ago
The problem with that paragraph is it’s vague and non-commital, like a horoscope. We can fill in the blanks to make that description fit people who we already think are intelligent, innovative, etc. As a template, it lacks precision because

More ›