ejcx

39 ms·

361.
by ejcx 11y ago
I very much think auth should be centralized. It gives you a lot of benefits. - Easier to scale securely. Adding 100 auth'ed services that may or may not work differently is a recipe for disaster. Ad-hoc security by people who aren&#x2
362.
by ejcx 11y ago
This is really kind of funny. Here's a gist with all the questions I ripped out of the source, in case you'd like to read them all at your own pace (instead of robo-Sam's pace) https://gist.github.com/ejcx&#x2
363.
by ejcx 11y ago
It actually should not. People using a password manager might not ever know their password. Funny things happen with password managers where history is missing, changes don't save, keystrokes break things. We can't penalize users
364.
by ejcx 11y ago
I am a little sad that Yahoo didn't win, having watched the Bills Jags game in London over the stream. It was really really high quality and well done. It was great to watch too. I'm just happy to see the wheels start moving on sp
365.
by ejcx 11y ago
I can but I didn't like it as much. Screen out of the box with no screenrc was exactly what I wanted. now it's kind of stuck, as silly as using screen and tmux is.
366.
by ejcx 11y ago
I use screen only to switch between servers. one of my screen Windows is a local tmux session. It's wonky
367.
by ejcx 11y ago
Discovering tmux and finding a workflow with it that works for me made me so much more productive I have a really weird setup though. I run screen on my laptop with a window for each machine I'm connected to. An irc box, a VM, a remote
368.
by ejcx 11y ago
SEEKING WORK I'm a web security and software engineering expert and have written and broken tons of golang and php in production. I'm located in San Francisco. I would love to help you solve your security problems in short-term en
369.
by ejcx 11y ago
The only correspondence you had with the CloudFlare CEO in that thread was: > eastdakota: I work for CloudFlare. We don't get anything from Google for using reCAPTCHA. I think you might have gotten a username confused.
370.
by ejcx 11y ago
> Those who argue that having a dependency like left-pad adds risk to their project are essentially arguing against having any external npm dependancies in their project. No they absolutely are not. Having a few dependencies is something
371.
by ejcx 11y ago
That's pretty neat, but it can be way easier. File formats have never really been robustly verified. The difference between `file` telling you that a binary file is "data" versus your image format is about 3 bytes. I wrote a
372.
by ejcx 11y ago
The blog post you posted by Scott Helme is much better than the one I've seen posted in previous threads[0]. The information about not necessarily pinning to a leaf is critical. Please Please Please read this. >For me personally, on
373.
by ejcx 11y ago
I'm reminded of the first half of "Web Design: The First Hundred Years"[0]. Commercial planes have not gotten faster and have in fact gotten slower. I personally agree with the sentiment of the blog post, that a 5 hour flight
374.
by ejcx 11y ago
By the way. If you aren't well versed in web application security, don't just blindly follow guides likes this, especially when dealing with headers. You really should learn about the technologies > Strict-Transport-Security: m
375.
Apps.gov(apps.gov)
2 points by ejcx 11y ago|0 comments
376.
The Cost of Security Headers(ejj.io)
2 points by ejcx 11y ago|0 comments
377.
by ejcx 11y ago
I'm making internal honeypots a thing. I'm making statically compiled binaries that make deploying a honeypot super super easy. Right now, I've built an HTTP honeypot. The idea is that if anything ever talks to these services
378.
by ejcx 11y ago
This might help support the argument I've seen you make tons of time. You can use h1b data to show real people who don't need to raise their hand on hacker news and declare their income publicly. Here's H1b data for Google an
379.
by ejcx 11y ago
You're missing the point of the post, which is personal responsibility. People on Bill Parcels team cared, and their fans, but all Bill Parcels can do is go out and coach and take responsibility. All the CEO of zenefits can do is lead,
380.
by ejcx 11y ago
I report a lot of bugs and I am not a fan of hacker one or bugcrowd. I also triage bugs through h1 sometimes at work and I really don't enjoy the quality of bugs or the platform. If you are a smallish company my advice is to have a sec
381.
Stealing User Data From The Alexa 1m(ejj.io)
3 points by ejcx 11y ago|0 comments
382.
Misconfigured CORS, Stealing User Data from the Alexa 1m(ejj.io)
9 points by ejcx 11y ago|0 comments
383.
Misconfigured CORS, Stealing User Data From The Alexa 1m(ejj.io)
8 points by ejcx 11y ago|0 comments
384.
Breaking Same Origin Policy (for the alexa top 1m)(ejj.io)
13 points by ejcx 11y ago|2 comments
385.
by ejcx 11y ago
I think most people answered your question without reading it. They must be mind-readers. In my opinion there's only one way to do this. Admins who are all powerful, and non-admins. None of this complexity of super-admins, etc. Admins
386.
by ejcx 11y ago
As an engineer, it's great being able to push code daily and see people using your work. Young engineers normally have more responsibilities at a startup, more trial by fire. It's great fun and good for career advancement. There a
387.
by ejcx 11y ago
This depends on a lot of things. 18f is government so expect lower. Feel free to email me if its a bridge you end up crossing (I'm a lifetime DC native)
388.
by ejcx 11y ago
In case you already weren't aware there is no news here. This is all just high-level, best practice, straight from the CEH or CISSP exam, textbook information. His information was applicable for big organizations with a network and not
389.
by ejcx 11y ago
> Everything is too expensive. I’m from New York... I take issue with this one. It's entirely possible to live frugally while living IN San Francisco. I moved here about 7 months ago and expected it to be incredibly expensive but i
390.
Rails Dynamic Render to RCE (CVE-2016-0752)(nvisium.com)
3 points by ejcx 11y ago|0 comments

More ›