micaksica

9 ms·

31.
by micaksica 9y ago
There isn't one. I think that the Node ecosystem tends toward minimalism and compartmentalization in modules, and in doing so monolithic authentication solutions don't really exist like they do in other frameworks in which there&#
32.
by micaksica 9y ago
Pseudonymity is probably the better term.
33.
NPM CTO: `crossenv` malware on the npm registry(medium.com)
1 points by micaksica 9y ago|0 comments
34.
by micaksica 9y ago
In case you assumed that corporate responsibility is actually taken to heart by those making corporate strategic decisions, let this show you that it is not. Corporate responsibility moves are little more than good PR, a product selling poi
35.
by micaksica 9y ago
Thanks, I came here to post this exact thing. Even if NPM isn't prohibiting packages, you'd imagine they'd have internal security alerting for Levenshtein distance from the names of very popular npm packages. Such an alerting
36.
by micaksica 9y ago
Oscar is a dev, Kent is the maintainer of "cross-env", a popular package. hacktask is an unknown malicious module uploader that was harvesting credentials.
37.
by micaksica 9y ago
> A good static type system is too useful and important. What? A whole lot of web apps these days are built in Python, Ruby, or JavaScript, none of which are statically typed languages. Do you mean a strong type system?
38.
by micaksica 9y ago
You bought a TL-15 safe for your home? Where did you place it? Even the smaller TL-15 safes weigh hundreds of pounds and require some logistics to place. They are very impractical for most apartment dweller types, or even some high-density,
39.
by micaksica 9y ago
This is actually still a problem with some air-cooled bikes, and a lot of even the common beginner bikes made up into the 00s are air-cooled. The bike overheating aside, when you're sitting stopped on 101 near Mineta airport on a gasol
40.
by micaksica 9y ago
I work in infosec as a security engineer, I agree with this more than anything else anyone has posted about the state of the security industry on HN, ever. For security being a human problem, I have yet to meet infosec types with strong bac
41.
by micaksica 9y ago
As a motorcyclist, whenever I was in SEA on my motorcycle I was always dismayed that lane splitting / filtering is not legal in the state. Motorcycling is still the fastest way (for me) around SF and the Bay Area, and the lane splittin
42.
by micaksica 9y ago
This is exactly what is going on. This is a thinly veiled propaganda/recruitment effort trying to capitalize on students' new-found, Mr. Robot-driven curiosity regarding "hacking".
43.
by micaksica 9y ago
The standard way of frustrating decompilers for Android applications is with heavy obfuscation using ProGuard [1] or DexGuard. [2] IMO, DexGuard is a real pain in the ass to reverse around. If you aren't dealing with heavy obfuscation,
44.
by micaksica 9y ago
While this is a clickbait article, it's probably worth many high schoolers recognizing that compensation is simply unevenly distributed. There's an increasing realization that going to college does not give you a fast track to FTE
45.
by micaksica 9y ago
Agreed. I work in infosec as well, and I think the author of this article is confusing time spent vs. passion for something. Coming from software engineering, security is no different than any other technical profession: if you don't l
46.
by micaksica 9y ago
I pulled down this package. It is just a package.json file.
47.
by micaksica 9y ago
There was a thesis on this a year ago: http://incolumitas.com/2016/06/08/typosquatting-package-mana... After the "left pad" debacle, npm provided protection from typosquatting a deleted module: htt
48.
by micaksica 9y ago
As for this vector, credentials leaks have been littered across the community and they've been aware since 2015. See https://github.com/ChALkeR/notes/blob/master/Do-not-underest... for more informa
49.
by micaksica 9y ago
I withhold any opinions about Luckey. I've never met the guy and I don't feel it's fair to judge somebody based upon what journalists have decided to write about him. (However, I don't think we'd get along much.) Be
50.
by micaksica 9y ago
> There's a substantial difference between social drinking or overprescription We're talking about lives being ruined. I know many alcoholics that are "social drinking", every day, to the detriment of their own career
51.
by micaksica 9y ago
The "think of the children!" appeal to emotion doesn't usually garner sympathy here. I strongly disagree with your statement and where you're placing blame for the issues of peoples' lives being ruined. Drug users
52.
by micaksica 9y ago
This title has been changed from its original. Mods? Node.js applications are one thing, Express.js applications are another. This seems to talk about the Express.js framework, and Express has its own set of guidelines that should be follow
53.
by micaksica 9y ago
It's unlikely to be performance art, and if this isn't fraud it's gross negligence. Does anyone know of any British legislation that refers to the sale of these types of products?
54.
by micaksica 9y ago
They ripped that straight out of the OWASP CSRF cheat sheet, under "Personal Safety CSRF Tips for Users". Yep, clearly nomx's issues are all just user education issues. [1] https://www.owasp.org/index.php&#x2F
55.
by micaksica 9y ago
> There's only so much of the hardware rat race worth keeping up with anymore at the desktop level. I believe there's only so much of the hardware rat race worth keeping up with at all. Assuming most of Hacker News is coding, w
56.
by micaksica 9y ago
> I'm saying that it's better to taste the tea, and useless to talk about it. Yes, it is better to taste the tea, but useless to talk about it? That's a bit strong, IMO. It is futile to reduce a culture to cliches, sure, b
57.
by micaksica 10y ago
+1 for dnSpy. It is the only .NET debugger/decompiler I use these days.
58.
by micaksica 10y ago
I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole. US-CERT is explicitly calling out that many appliances and
59.
by micaksica 10y ago
> Folks love to talk about how they do “design strategy” and want to work on “new big things.” They’ll tell us that they can do the details, but they’re better with strategy and developing new concepts and their time is better spent else
60.
by micaksica 10y ago
I'm beginning to find the "Silicon Valley" / "San Francisco" divide to be quaint pedantry at this point. Culturally to these kids I have met in interviews and career fairs, there is absolutely no distinction. I

More ›