ejcx

18 ms·

181.
by ejcx 9y ago
Quite frankly if you're a spook you don't leave your job until you retire, or you go to the public sector where the bar is "this person has a clearance" Hiring is not very competitive for government work. They are usuall
182.
Show HN: passgo, cmdline password manager written in go(github.com)
2 points by ejcx 9y ago|0 comments
183.
The Right Way to Manage Secrets with AWS(segment.com)
4 points by ejcx 9y ago|0 comments
184.
Secrets Management the Right Way(segment.com)
13 points by ejcx 9y ago|0 comments
185.
Misconfigured CORS, Stealing User Data from the Alexa 1M(ejj.io)
1 points by ejcx 9y ago|0 comments
186.
by ejcx 9y ago
Wat. OpenResty as an alternative to go? Wat? Please, nobody write full fledged WebApps or all of your middleware in lua. Trust me that's a horrible idea. I have seen about everything you can do in lua/nginx and it does not turn ou
187.
by ejcx 9y ago
I saw one drive by Grace Cathedral in SF just a few weeks ago. It looked really nice, but I could tell it was a lower model than the S almost immediately. I mistook it for a prius for a few moments.
188.
by ejcx 9y ago
I am probably the right person to help having a ton of cdn experience, but I don't fully understand the situation. Feel free to email me at evan at segment dot com
189.
by ejcx 9y ago
I'm an appsec person and security person. I'm surprised about the hundreds of people talking about CSP, HSTS, HPKP and it feels like I'm the only one talking about insecurity headers. Within the Alexa Top 1MM I discovered abo
190.
by ejcx 9y ago
QA hardly exists in in SaaS industry. It's been replaced with unit tests, integration tests, and deployment processes that include things like blue green tests, canaries, and all that jazz. I say go for Software Engineering. I'm b
191.
by ejcx 9y ago
Yeah scapy is nice and there's a lot of nice libs, but security engineering and building of tools Go wins every time. Especially when it's something brand new.
192.
by ejcx 9y ago
I haven't read the book but definitely will. I work in security and have noticed most security people are not software engineers and mostly know how to cobble together python scripts. Go is much better for this with the extremely stron
193.
by ejcx 9y ago
If it is local and communication never leaves the machine, why use TLS? 1Password got heat for the opposite in the past (use of ws:// between the browser extension and the Mac Client). 1Password correctly pointed out that there is
194.
by ejcx 9y ago
I agree with you on all counts. It's hard to get a new name though after 100 years of history. I don't think it will change under Snyder, since the name recognition is one of the things that makes it one of the most valuable franc
195.
by ejcx 9y ago
I am a die hard Redskins fan (if you're in the bay area and want to watch games with me, reach out). This is a win for the redskins but I think the majority of us don't care anymore about the name that strongly. Pretty interesting
196.
by ejcx 9y ago
I built a golang password manager a while ago, in the image of pass. Shameless self pitch. It is a little slicker, not needing the master key to save sites. https://github.com/ejcx/passgo
197.
by ejcx 9y ago
Would love to know revenue numbers. At some point, 10 years in, you need to have a monetization plan. $1.7B is a lot of money
198.
by ejcx 9y ago
There isn't a lot here to read in to. I worked at a very small company that was going to be bought by amazon. We were "left at the alter" by amazon. I would be very surprised to see a slack deal go through, knowing what I kn
199.
by ejcx 9y ago
I've generated this exact token at several companies and it's worked great. An expiration of one day is not 86400 it's unix_time()+86400, to clarify. It's not stored in the users session and is completely stateless. It&#
200.
by ejcx 9y ago
You're wrong. If this is generated every time the page loads you get a new token each time. OR you have to transmit a god awful amount of data on the same page. When I work for a company that accepts GBs of data over the same TLS conne
201.
by ejcx 9y ago
Why make an extremely complicated set up, with many edge cases, all to save yourself from a single token? - Privacy extensions often times block referrer headers. - POST requests are usually necessary. - Open redirects are c
202.
Show HN: Dssss – Secure Secrets Management on AWS(github.com)
1 points by ejcx 9y ago|0 comments
203.
by ejcx 9y ago
I like ichi sushi. It's very small, a bit out of the way, and very good.
204.
by ejcx 9y ago
It's pretty interesting to see what the biggest VCs are in states that aren't massive business centers. I didn't even know what to expect for my home state of Virginia. Now I know what CIT does in that giant oddly shaped buil
205.
by ejcx 9y ago
I have a friend who does real estate in DC who pays Zillow thousands per month to be on the forefront of all the incoming leads. It reminds me a ton of Yelp. Seems to me like the realtors are probably right, zillow is throwing their weight
206.
by ejcx 9y ago
I actually have worked in security at startups my entire career. Before the tons of negative HN posts get posted. 2 things. First, hug ops. I've been there before and will be again OneLogin. Same day notification and detected it by you
207.
by ejcx 9y ago
This might be for sampling the book, but my SO and I had fun trying to guess the books. We got quite a few of them! Pretty neat!
208.
by ejcx 9y ago
Js is clearly very popular. What are these fundamental flaws that js has that this comment mentions? I don't understand why it would be the "paragon of wasted opportunity".
209.
by ejcx 9y ago
It's not shocking but AMP enforces it. People talk a lot of trash about AMP, but until there's another solution that allows me to go to a news website and actually read it, I'm an AMP supporter.
210.
by ejcx 9y ago
Bodies are complicated I completely agree with you here. I have an extremely bad habit drinking about 2L of diet soda a day (on a good day). I also exercise 4-5 days a week (powerlifting and some light cardio) and am in great shape. people

More ›