ejcx

32 ms·

271.
by ejcx 10y ago
I'm not going to do any more responding. The author of the service is an active HN user and has been for 5 years. I have no idea if I reported the issue by email or not... Anyone who "cares" about security should know about C
272.
by ejcx 10y ago
I'm not some heartless security snob. This is not the first time I've seen this site, and it's been broken for at least a year (when I pointed this out last time). Because of that people SHOULD stay away.
273.
by ejcx 10y ago
I don't think I'm being pedantic when I expect security software, or software dealing with secrets, to be secure. It's not malice but solving sensitive problems without taking security seriously can actually have really big c
274.
by ejcx 10y ago
You have described CSRF tokens exactly =]. This is exactly what they should do, but this is necessary for ALL state changing requests not just the email change.
275.
by ejcx 10y ago
This same website gets posted once in a while and it drives me crazy. Do not use this service. With less than 60 seconds of looking, you can hijack people's deadmanswitch accounts with a simple CSRF on the email change API. If you have
276.
by ejcx 10y ago
CloudFlare https://www.cloudflare.com/ | San Francisco, CA; London, UK; Singapore, SG; Urbana-Champaign, IL; Austin, TX | VISA, ONSITE CloudFlare is building a better Internet -- performance and security optimization at the
277.
by ejcx 10y ago
I love that one of the files is "Stuff.cs". Super neat visuals and I can't wait to play with this, as someone who knows nothing about this kind of "stuff".
278.
by ejcx 10y ago
You still have to pay for bandwidth and if the attack began impacting SLAs and paying customers, that's bad for business.
279.
by ejcx 10y ago
I experienced this in the DC area. Few people I met were motivated. Everyone has an easy paycheck from their government contracts. Sure, great, smart, motivated people are there but I found them to be rare. It's a comfy life, but if yo
280.
by ejcx 10y ago
Brakeman is really high quality. If you are doing anything appsec related with ruby or are not an appsec person with a ruby codebase, brakeman is very helpful.
281.
by ejcx 10y ago
I feel like this would work well but both parties would never agree. Elon gets ungodly amounts of money and mass production experience to execute his vision. Apple gets to make a ton of money if it works out. But would Elon join one of the
282.
by ejcx 10y ago
Just wanted to give the author a shoutout for being awesome. This article is published with an AMP version[0] too, which is pretty unusual for smaller blogging sites. AMP articles are so much easier on my eyes (and the author can't inc
283.
by ejcx 10y ago
You are completely wrong. Inline styles on a static page is not a security issue. If you read that blog post you linked to, you would know this. CSP will do absolutely nothing for a single static html page containing all assets it needs as
284.
by ejcx 10y ago
I ran in to the exact same problem. I had a chrome extension with >15k users. One day I got an email saying I violated the facebook trademark (my extension blocked the read receipts in facebook messenger and had 'facebook' in t
285.
by ejcx 10y ago
Like tptacek said, "Don't HPKP your blog". There's only a handful of sites that need HPKP and that's okay. That doesn't mean there is something wrong with HPKP. It's a useful tool for people with a specifi
286.
by ejcx 10y ago
This is literally clickbait. To paraphrase the article, you need to work hard and learn fast. Saved you a click.
287.
Negotiate my salary, negotiation consultants(negotiatemysalary.com)
2 points by ejcx 10y ago|1 comments
288.
by ejcx 10y ago
CloudFlare https://www.cloudflare.com/ | San Francisco, CA; London, UK; Singapore, SG; Urbana-Champaign, IL; Austin, TX | VISA, ONSITE CloudFlare is building a better Internet -- performance and security optimization at the
289.
Update: Resetting passwords to keep your files safe(blogs.dropbox.com)
4 points by ejcx 10y ago|0 comments
290.
by ejcx 10y ago
I tried washio within the last 2 months for the first time. It was much harder than using a neighborhood laundromat IMO. I scheduled for it to be picked up and had to wait 2 days, versus the neighborhood folks who do it same day. I paid $10
291.
by ejcx 10y ago
Not only to GET press, but also to PRESS the company for $. This is a huge problem I see with bugbounties. People running the bug bounties, who are not appsec security literate, are basically bullied in to thinking that something is a secur
292.
Sorry, but Your Browser Password Manager Probably Isn’t Enough(wired.com)
1 points by ejcx 10y ago|0 comments
293.
by ejcx 10y ago
Hey! Lots of people end up building things like this. You have a problem though. Your program produces linear ciphertexts. The key "a" and the message "a" will always create the ciphertext "136". Everyone writi
294.
by ejcx 10y ago
This is a very non-standard and unique thing Dropbox has done. Dropbox's concerns for their users are: 1. legacy accounts with bad passwords 2. people who used bad passwords then and have not changed it The people who are helped are pe
295.
by ejcx 10y ago
I think it would be great to buy a car from Amazon. The WYSISYG pricing is something missing from car buying. Negotiating a car price can be a lot of fun if you're a good negotiator, but people who aren't might love this. It also
296.
by ejcx 10y ago
This is exactly the distinction I'm talking about. Doing it live is way harder than moving static content out to all the leaf nodes once per day and serving it to a geographically small region. Adaptive bitrate has nothing to do with t
297.
by ejcx 10y ago
Curious how many Tb someone like twitch does per day. AFAIK they are the biggest live streaming platform, since Netflix is all HTTP. Seems like that could be a big moneymaker for them, for these big time events that need a "live"
298.
by ejcx 10y ago
I pay for dropbox and they do that to me, as well. Why would I want to be a business customer if I'm a paid normal user? Somewhat annoying but maybe it's working for them.
299.
by ejcx 10y ago
I have too. The ceiling for an engineers salary is much lower in DC. Also young people have a much lower salary as well. Some managers might be pretty close in compensation though. We are talking about DMV. Working in the city is very uncom
300.
by ejcx 10y ago
This article makes Palantir sound really weak to me. Palantir makes money selling their product. They are not a real competitor or Northrop Grumman or Raytheon. The big primes are massive and organized to win lots of different big contracts

More ›