ramimac

17 ms·

151.
A better way to learn a new codebase(xdg.me)
1 points by ramimac 5y ago|0 comments
152.
by ramimac 5y ago
It's a hard problem - and depends on your target market. That being said, in my experience most companies with the maturity to go hunting for a tool like this will also have established vendor security requirements. On a baseline &quot
153.
by ramimac 5y ago
Regardless of the tool itself, there is a huge trust barrier to overcome here as a hosted solution for inherently sensitive Incident Response related data. Looking at the site, there is nothing to indicate this would be viable for my organi
154.
by ramimac 5y ago
I would highly recommend anyone interested in pentesting smart contracts look at the work Trail of Bits has been putting out: https://blog.trailofbits.com/?s=smart+contract&submit=Search Start with "246 Findings Fr
155.
The Last Men’s Hotel in Chicago(newrepublic.com)
2 points by ramimac 6y ago|0 comments
156.
by ramimac 6y ago
Exposing resources to a specific "evil principal" via Endgame would be reasonable in some attack simulations/red team engagements
157.
by ramimac 6y ago
Slide 62 does present some of that context: Survey was sent to 25k founders in the MicroConf database, 673 respondents (534 completed the survey)
158.
Between the Places(betweentheplaces.glitch.me)
2 points by ramimac 6y ago|0 comments
159.
by ramimac 6y ago
If you're interested in the security posture here, I saw a good talk on bug-hunting in OpenEMR at BSidesCT last weekend: https://www.youtube.com/watch?v=wSvlhFQzUNg
160.
by ramimac 6y ago
If that were true, it'd be interesting to see if they push out support for close-captioning. It's an accessibility push, but also would leverage a lot of the same capabilities...
161.
by ramimac 6y ago
Are you asking from a career or technical perspective? This report isn't particularly technically complex, a majority of this sort of leaked data is widely available on clearweb forums. The minority requires building relationships and&
162.
by ramimac 6y ago
Scott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Prac
163.
by ramimac 6y ago
What about this implies parallel construction to you? The OGUsers databases (well, actually a couple, they've been hacked multiple times) has been publicly available for a while. Also, the discord chats and Vice article include details
164.
Keyctl-Unmask: “Going Florida” on the State of Containerizing Linux Keyrings(antitree.com)
1 points by ramimac 6y ago|0 comments
165.
by ramimac 6y ago
Just for reference, the former example you give is just a bug bounty as far as I can tell. The discussion of relative merit of bug bounty versus a pentest is well trod ground, so I won't rehash here except to say I would never consider
166.
by ramimac 6y ago
According to Insight's attestation this was a 5 day test focusing on: 1. External vulnerability assessment of the Bitwarden computing systems and web applications 2.External penetration testing of the Bitwarden computing systems and
167.
by ramimac 6y ago
Sorry for the "not free" suggestion, but I use Feedly which I believe supports this use case. They offer shareable "boards" and a card view (among others).
168.
by ramimac 6y ago
Whoops - scope -> score. Right now the site provides no insight on how the calculation was made, or even what the components of the calculation are. The end result is that it really provides no value to a visitor unless they want to tak
169.
by ramimac 6y ago
Interesting proposition. A couple thoughts: 1) Providing the scope in a black box makes this feel far more like a blatant sales pitch, with little inherent value. 2) I'd recommend providing an example target (i.e I ended up just using
170.
by ramimac 6y ago
Aqua has been releasing some really great k8s security tools recently. kube-bench [1] and kube-hunter [2] are worth a look as well. [1] https://github.com/aquasecurity/kube-bench [2] https://github.com/
171.
by ramimac 6y ago
Just because I don't see it mentioned anywhere in the post - this can be done locally using cargo-audit [1] [2]. Cargo-audit also has a recommended setup for Travis CI [3] [1] https://github.com/rustsec/cargo-audit
172.
by ramimac 6y ago
Looking forward to seeing the results of their external security audits. This page may be of interest to you: https://hey.com/security/
173.
by ramimac 6y ago
I've been using The Parson's Essential[1] with an italic nib for 5+ years, and have to drop a recommendation. Also of interest to anyone exploring transitioning to fountain pens would be the Pilot Vanishing Point[2], which is a re
174.
by ramimac 6y ago
2FA is important of course, but it is in no way a panacea. Especially SMS or TOTP MFA. It is near-trivial to add a phase to phishing that captures the second factor as well. Tools like https://github.com/kgretzky/evilgi
175.
by ramimac 6y ago
The challenge also now has an official website: https://cloudresumechallenge.dev/ And while the "Hall of Fame" is empty, it seems some people are starting to complete it. Write-up: https://dev.to/j
176.
by ramimac 6y ago
patio11 has talked about this as well: https://training.kalzumeus.com/newsletters/archive/services_... There is also an indiehackers discussion with some relevant examples: https://www.indiehackers.com&
177.
by ramimac 6y ago
Between this and the Zerodium tweets[1], seems like a hard week for Apple security PR [1] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...
178.
by ramimac 6y ago
They're gradually pushing the time period back, as of a couple days ago I believe it was end of May. As of right now it's for "stays and Airbnb Experiences made on or before March 14, 2020, with a check-in date between March
179.
by ramimac 6y ago
If you actually want to expire the assets, you could use S3 lifecycle configuration - https://docs.aws.amazon.com/AmazonS3/latest/dev/intro-lifecy... . If you want "clever" ideas, maybe a Lambda that
180.
by ramimac 7y ago
Some really interesting comments in the previous discussion: https://news.ycombinator.com/item?id=13647098

More ›