niros_valtos

13 ms·

91.
by niros_valtos 5y ago
What can you gain from it? If someone makes a higher wage, you may be frustrated, and if lower you may stick at your current job just because it pays well. Pay is important, but there are many parameters that determine your worth to a comp
92.
GitHub downtime root cause analysis(github.blog)
10 points by niros_valtos 5y ago|0 comments
93.
by niros_valtos 5y ago
My recommendation is to make a decision based on the topic that excites you. Even if you take a job in a candy shop and enjoy it, you may end up doing really well. As for the high risk assumption, given that you are just finishing your stud
94.
by niros_valtos 5y ago
The data may come from other sources, like your phone that can be connected to both the corporate and private emails.
95.
Data hacked for 400K Planned Parenthood LA patients(abcnews.go.com)
2 points by niros_valtos 5y ago|0 comments
96.
by niros_valtos 5y ago
Hackers for Charity: https://hackersforcharity.org/
97.
Ask HN: How do you measure secure coding over time? Here is how I tackled it
2 points by niros_valtos 5y ago|0 comments
98.
Chainjacking Supply Chain Attack Explained. Low Probability but Nice Research(intezer.com)
2 points by niros_valtos 5y ago|0 comments
99.
by niros_valtos 5y ago
If you are connecting over TLS, the server is already trusted and I see no reason to validate the response. The theory may be the ability to tamper the response before it hits your code (such as in SDK), but even then a malicious SDK can ma
100.
by niros_valtos 5y ago
Why SigV4 is insufficient? It works across AWS’s SDK and seems to be safe as it is time bound (limited time to serve the request and each request signature includes the timestamp).
101.
by niros_valtos 5y ago
Your network can be compromised if the device is connected to the same network as other devices. However, most modern routers support a guest WiFi, which may be a good fit here. In the previous company I worked for we provided alternative l
102.
California Pizza Kitchen spills over 100k employee Social Security numbers(techcrunch.com)
7 points by niros_valtos 5y ago|0 comments
103.
by niros_valtos 5y ago
If GitHub doesn’t want to fix it, maybe we can use Checks API to validate that the cookies.sqlite file will be prohibited?
104.
by niros_valtos 5y ago
When security impacts productivity it becomes a difficult battle. Zero trust tries to solve the VPN requirement, but as we all know, the devil is in the implementation details…
105.
by niros_valtos 5y ago
A startup in early stage can’t afford to have such policy. Instead encouraging the obvious shopping around, try to focus on the good things corporates usually don’t have. Developers will appreciate continuous challenge, career path, anythin
106.
by niros_valtos 5y ago
This functionality is a must nowadays. To reduce the risk, I would lock the packages to specific versions and upgrade only after two weeks or immediately after a critical vulnerability is fixed.
107.
by niros_valtos 5y ago
It seems like a product with minimal stickiness. I think companies will use it for 1-2 months to have a good enough database of JDs, then send it to the hiring managers for adjustment and that’s it. It isn’t different than copying JDs from
108.
by niros_valtos 5y ago
If the user is trusted but the environment isn’t, the user can sign the string and you can validate it pre execution. If the user is not trusted, you need to contain the execution as much as possible, e.g. container without file or network
109.
by niros_valtos 5y ago
In terms of preventative measures, harden the underlying infrastructure. For example: prevent outbound connection initiations. If you need it, profile the connections and lock them down. From a detection standpoint, the free options are NPM
110.
by niros_valtos 5y ago
Opening a bug bounty program where security is immature may cost too much money. If issues won’t be handled in a good enough pace, researchers may stop submitting bounties.
111.
by niros_valtos 5y ago
My challenge with this guidance is the lack of focus in what is truly minimal as this list is quite extensive. As a security practitioner, I would simply threat model the product and provide minimum requirements to release.
112.
by niros_valtos 5y ago
Mind sharing?
113.
by niros_valtos 5y ago
Who designed your landing page? The design is amazing!
114.
by niros_valtos 5y ago
Not a nitpick at all. Fixed.
115.
by niros_valtos 5y ago
Author of the post here (Nir, CEO of Arnica). Thanks for the feedback! That's a great tip, I wish I knew before. I'm not a developer (our developers are busy building the actual product) so I learn new things every day. I'll
116.
by niros_valtos 5y ago
The link doesn't work
117.
by niros_valtos 5y ago
Microsoft has always been focused on developer experience (if you haven’t seen Steve Ballmer’s “Developer Developers Developers” video, it’s a must). VS Code is a result of one of the drastic changes Microsoft went through in the last yea
118.
by niros_valtos 5y ago
Based on this description, it looks like you are an entrepreneur. If you failed with investing and software development is boring, challenge the perception of people to manual or ineffective tasks that excite you and then figure out how to
119.
by niros_valtos 5y ago
I really don't get the need for it. Open the terminal. Type "man git" and you're done!
120.
by niros_valtos 5y ago
As everyone else mentioned here, this article refers to full packages. With that said, there is no need to be a founder to get a huge chunk of $$$ - the first employees tend to do very well. The path to success is finding these founders an

More ›