santaragolabs

8 ms·

31.
by santaragolabs 12y ago
Thanks for clarifying that. And I indeed meant the title hierarchy you mentioned.
32.
by santaragolabs 12y ago
Not at Microsoft but know the company well (did contracting work for some teams). PM refers to Project Manager as far as I know. But there are different levels of PM's within Microsoft. You can be a completely junior PM managing two re
33.
by santaragolabs 13y ago
Same for me (see my other comment). I contacted them too.
34.
by santaragolabs 13y ago
The site seems to be a bit overloaded; I got through to the entire process including verifying the Mastercard transaction but the order doesn't show up in my account's order history. I just emailed them and now we'll wait and see. Could ver
35.
by santaragolabs 14y ago
Care to point me to some sources on these limitations? I'm just curious.
36.
by santaragolabs 14y ago
It's a cultural difference. I'm sure that what happens in general French office culture is totally not acceptable in India. Example: in a lot of French companies each morning co-workers tend to greet each other by shaking hands (when it's m
37.
by santaragolabs 14y ago
I haven't noticed this as strongly as the author of the article. But there are definitely cultural factors at play. I'm Dutch and I work a lot in Germany; everyone tends to come in right on time whether it's a physical meeting or a conferen
38.
by santaragolabs 14y ago
I've used it on the RCX a year or five ago and back then leJOS didn't have any proper garbage collector implementation nor a proper way to free memory explicitly. Due to all my buddies only having Java knowledge we were forced to use leJOS
39.
by santaragolabs 14y ago
Yeah, I didn't even interpret your statement as to mean that. Edited and hopefully clarified my post now.
40.
by santaragolabs 14y ago
edit: clarification I wholeheartedly agree with you; some personal other side of the story regarding the link in OP's article. Lack of listening? That's not my experience with Bado. I know him in real life and I've worked together with him
41.
by santaragolabs 14y ago
Okay, guess that makes sense; personally I wouldn't mind having this dual usage but maybe it would make the W3 spec people throw a hissy fit. Interesting attempt I must say but I think it will be hard to actually get it out there. Too much
42.
by santaragolabs 14y ago
It depends. A SOCKS proxy would continue to work perfectly; no changes needed there. But most production networks use HTTP proxying; assuming that they do not do MITM attacks (sometimes for legitimate inspection/compliance reasons) on the S
43.
by santaragolabs 14y ago
That will be more difficult if you've got a cluster of servers in which each new connection request of a client can end up at any of these servers at any given time. So the keys would have to be rotated simultaneously for all servers in the
44.
by santaragolabs 14y ago
It's very easy to do in NAT'ed environments and the Linux kernel doesn't implement the suggestion of the RFC draft to include timestamps too. An attacker who doesn't want to do a MITM attack because that might be noticed can set up sessions
45.
by santaragolabs 14y ago
There are tons of developers who've got no experience dealing with (potential) security issues or have any idea about the "gentleman agreements" that are prevalent in the security- versus the IT-industry. So it could very well be that he ha
46.
by santaragolabs 14y ago
You get better security back for all the Windows machines that are in your local network, the ones that your customers use or the Windows/Azure servers you use for your day to day business. If you dump it online way more people start lookin
47.
by santaragolabs 14y ago
Pretty easy; you just email secure@microsoft.com (there are PGP or S/MIME keys available too) and you generally receive a response in a maximum of 48 hours. In most cases you get a reply within a few hours stating that you've passed their s
48.
by santaragolabs 14y ago
Yeah, even something standalone which attempts to implement a C-preprocessor such that my editor can hook into it and properly resolve the used code-blocks might be already useful. But it's going to be a massive pain, if not impossible, to
49.
by santaragolabs 14y ago
That may be, but I want to have all this information in my editor too so my editor can warn me about it. Take something like a developer just defining a macro like __USE_GNU to get rid of a warning about an undefined function; you just have
50.
by santaragolabs 14y ago
Ha, good catch. But in this case x was always positive.
51.
by santaragolabs 14y ago
I'd prefer not to go too much in specifics due to NDA's and all that; but one simple example that I've encountered: I've seen simple cases where a function returned a signed integer value modulo x. Which of course means that this function c
52.
by santaragolabs 14y ago
Ha, you're completely right. I've been brought in on several occasions to help my clients decide on which static code analysis tool to use after an evaluation period and I've encountered these situations too. But it helps if it's an outside
53.
by santaragolabs 14y ago
So I've dealt with dozens of Fortune-100 companies implementing and using static code analysis tools. They can and will help but in general I feel that these tools are not much more than the code-equivalent of the syntax- and grammar- check
54.
by santaragolabs 14y ago
Before scrolling down in the first paragraph of the article it already says: "wanted to share with you a detailed write-up of the levels, why they're vulnerable, and how to exploit them.". I don't think it's necessary; if you don't want to
55.
Stripe CTF Writeup(blog.ioactive.com)
126 points by santaragolabs 14y ago|89 comments