raesene4

9 ms·

31.
by raesene4 11y ago
Especially when most stripe using sites embed the payment request in their page and there's no way for end users to tell that it's using stripe without looking in the source of the page. If that got re-directed by an attacker 99+
32.
by raesene4 11y ago
Traditional banks are very risk averse and have large investments in older tech. It's a brave company who chooses the ground-up re-write of a core system in the banking world.
33.
by raesene4 11y ago
One of the more interesting aspects of Mondo is from their blog they appear to be building their software stack from the ground up, as opposed to taking the approach of other new banks and buying in/white-labelling core systems from es
34.
by raesene4 11y ago
There's quite a crop, some of the ones I've seen so far - Starling http://starlingbank.co.uk/ - Tandem https://tandem.co.uk/ - Loot https://loot.io/ - Fidor https://
35.
by raesene4 11y ago
I'm not sure I'd class Mondo as a "passion Project" they're a company with a product in alpha (payment card) and in the process of getting FCA accreditation, which requires quite a bit of work to get started on... A
36.
by raesene4 11y ago
to provide some context on the newspaper that this article is on. The national is a newspaper specifically set up at the time of the Scottish Referendum to provide a more nationalist viewpoint to counter the perception that the mainstream
37.
by raesene4 11y ago
There's quite a few ways to get started with the skills you need for pen. testing and the good news is that a lot of them are free or low cost. You should probably start by picking an area that you're interested in (e.g. web, infr
38.
by raesene4 11y ago
Absolutely! Although that said not all of them store creds in dot files by default...
39.
by raesene4 11y ago
If you want to be concerned about the npm chain of dependencies model, one thing you should probably think about is that there is no curation of code on npm, so a package could be malicious (e.g. if an attacker compromised a set of package
40.
by raesene4 11y ago
Ruby will but it's an API key not creds directly. Python probably will, IIRC it's not auto-created but is general pratice to put creds in a dot file for PyPI. Go doesn't really have a widely used package manager in that sense
41.
by raesene4 11y ago
FWIW user namespacing is already available in docker experimental and will hopefully be getting into mainstream soon...
42.
by raesene4 11y ago
protecting the other 99% of their users from an attacker loading malicious firmware onto their device?
43.
by raesene4 11y ago
how are you handling the problem of banks revoking customers online fraud guarantees if they make use of 3rd party services to make transactions? From what I saw of the aggregation sites that pulled details from UK banks in the past, this w
44.
by raesene4 11y ago
EV certs will only make sense (for the vast majority of sites) when consumers start actually recognizing the difference between EV and DV, personally I don't see that happening real-soon as many non-technical consumers don't even
45.
by raesene4 11y ago
That's an interesting opinion... what makes you think it's the easiest OS to target? Do you have any data to back up the claim that a modern Windows OS is less secure than it's major competitors (OSX and, in some circumstanc
46.
by raesene4 11y ago
For me, the business model of this kind of service is important. Where a commission is paid by the dealer to the service, it would seem to me that there's a potential for a conflict of interest as the service gets more money, based on
47.
by raesene4 11y ago
I'd agree, I was just pointing out the basis that the author was coming from which was the reason why he was considering seasonal variations in battery calculations. With that said, from reading some articles about off-grid living, it&
48.
by raesene4 11y ago
well nobody apart from people looking for an off-grid lifestyle of course. What I took from the article is that pure solar off-grid is impractical away from equatorial latitudes.
49.
by raesene4 11y ago
I think the original article was looking at the proposition of off-grid energy use using purely solar, in which scenario seasonal variations matter From the article "Even with these rough numbers it’s hard to see how anyone living any
50.
by raesene4 11y ago
I'm going to have to disagree with your point about banking applications based on my experience (~15 years) in banking IT and security. Whilst obviously Internet facing apps are treated with more caution, it's definitely not true
51.
by raesene4 11y ago
oh sure, in an ideal world the dev kit would have all the capabilities of the live consumer device. But when you're developing a new category of device, that's not always possible. For a very related example, look at the Oculus Ri
52.
by raesene4 11y ago
I'm not sure the narrow field of vision is that important for a dev. kit. The goal is to let people work out how best to produce apps for this kind of interface. If they can't sort it for consumer release, that's a much bigg
53.
by raesene4 11y ago
so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data? The information (AFAIK) about their security mechanisms
54.
by raesene4 11y ago
I like patreon a lot and feel sorry that they've been breached. Luckily (for them) I'd guess that with the number of breaches these days, the negative publicity on them will be a lot less than it would have been a couple of years
55.
by raesene4 11y ago
You can't :) There is a huge Market for Lemons ( https://en.wikipedia.org/wiki/The_Market_for_Lemons ) style scenario in IT systems with relation to security. Everyone will say "we take security seriously"
56.
by raesene4 11y ago
sure for some attacks it might help, but ultimately if someone has compromised your server, that server is likely to have the ability to load the key to decrypt the data. For example to handle the case of unattended server reboot, you&#x2
57.
by raesene4 11y ago
the problem is, if you intend to use the data within the application, you need to be able to decrypt it. If you can decrypt it, so can anyone who compromises the website :) with e-mail addresses you need to use them in their unencrypted fo
58.
by raesene4 11y ago
Of course, but the article being discussed is about curl|bash so I felt that comment was relevant :)
59.
by raesene4 11y ago
This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps. Looking at Dockers deployment of Content Trust as an example of this. You still have a trust decision on first use, but it&#x27
60.
by raesene4 11y ago
But curl|bash is a one step process, as soon as you get the script you execute it, with no opportunity to check a signature...

More ›