spydum

31 ms·

361.
by spydum 8y ago
The only cool Harvard kids dropped out
362.
by spydum 8y ago
So, vulnerable web apps exploited to attack internet connected cars? you'd think they'd learn from Nissan like two years ago? https://jalopnik.com/how-the-nissan-leaf-can-be-hacked-via-w...
363.
by spydum 8y ago
I mostly agree that it’s nearly impossible to end up with a container image with zero CVEs listed unless you are some sort of wizard. However I think images being built and deployed when there is an available patch is foolish (CVEs without
364.
by spydum 8y ago
If I may: > I'm describing a process by which you figure out the actual risk of vulnerabilities before treating them further. The problem here is that your assessment of how a vulnerability might be leveraged or accessed is bound by
365.
Dr Seus writes technical manuals(mailing-list-archive.cryptoanarchy.wiki)
3 points by spydum 8y ago|0 comments
366.
by spydum 8y ago
The whole 10x, 100x engineer thing is a bust. If a company hires a bunch of squabs who don’t know jack, a reasonably talented engineer comes on board and might legit be 10x, or more. The problem is we have no legit baseline to build factors
367.
by spydum 8y ago
Or the password recovery for lost 2fa is secret questions (this is so awful,but see it often). And chances are those secret questions/answers might also be in the vault
368.
by spydum 8y ago
Didn’t you hear? They stopped updating their indexes. /s
369.
by spydum 8y ago
If your dockerd is exposed without something like mutual TLS auth, RCE is a feature! Some little container breakout is irrelevant (I’m sure you know, but others might be confused)
370.
by spydum 8y ago
My guess is prudent man principal applies - did they have a reasonable plan to remediate once the 0-day was known? How would peers in the industry have been affected? If it’s truly a 0-day, and they followed reporting the breach, I don’t se
371.
by spydum 8y ago
I think this is nonsense - it’s only true if you believe the businesses should have existed without protecting user privacy. GDPR and such don’t require you to go out and buy any hardware, or pass through any other expensive compliance audi
372.
by spydum 8y ago
maybe he considered his audience, and it's not the genpop, but tech people who read such things?
373.
by spydum 8y ago
Very cool, I recall seeing a lightning talk at KubeCon on this very thing: https://schd.ws/hosted_files/kccna18/45/NA%20KubeCon%202018%...
374.
by spydum 8y ago
I think they just try to idiot proof too much, which ends up a bureaucratic nightmare.
375.
by spydum 8y ago
It can, google data studio more or less is this
376.
by spydum 8y ago
The keys didn’t get deleted. Only the encrypted data. If keys are gone - they are GONE. AFAIK you cannot restore the keys
377.
by spydum 8y ago
Courts are not run by robots, judges are generally smart people. I agree - I think most people overthink the whole IP == PII nonsense. I think it’s more likely that IP + other factors, and your USE (or misuse) is where things become more gr
378.
by spydum 8y ago
If you watch the 11th game where pro player wins, (prior was a 10-0 shutout by Alpha), the AI actually lost because they rebuilt the agent to use the same forced camera perspective as the human - so there is absolute truth to this being a c
379.
by spydum 8y ago
Totally agree - there is a bit of a feedback loop as media shapes the cultural expectations. It’s really unfortunate because the vast majority of people are cattle and just follow the herd - no independent critical thinking. Worse is when s
380.
by spydum 8y ago
Because you are inundated with news/social media telling you about all the sex offenders in your area, human trafficking gangs abducting kids, and so on. Reality is these were all there before, and the probability of being a victim is
381.
by spydum 8y ago
I’ve never understood this - aiming a laser at a vessel moving at over a hundred miles an hour many thousands of feet away seems incredibly harmless, unless you have one gigantic, powerful laser...
382.
by spydum 8y ago
Really common malvertising attack, server is probably compromised: https://www.welivesecurity.com/2013/05/07/linuxcdorked-malwa...
383.
by spydum 8y ago
i mean, pretty sure you mean "Never roll your own crypto".. most people should be writing some bit of "security".. You probably want authentication, authorization, audit and so on in your app. Now, I do think I agree in
384.
by spydum 8y ago
Exactly- atlas kills me without any type of SSO options for the control plane. Also I feel that they HAD to offer this to counter Azure CosmoDB
385.
by spydum 8y ago
The power of suggestion is amazing. I didn’t notice my tinnitus until reading this comment..
386.
by spydum 8y ago
i suspect the leverage of pivoting the tri-spoke axle helps transfer more of the horizontal force you are applying, into a vertical force as it pivots. A larger wheel doesn't do this the same way
387.
by spydum 8y ago
The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.
388.
by spydum 8y ago
While SSHA2 isnt that bad if they’ve applied a work factor, but that’s probably not the case.
389.
by spydum 8y ago
If they are mirroring your content, figure out a signature of their crawler, and start serving "special" content to them.. Perhaps a bit of JS which does a window.location check and redirects if it's not your own (chances are
390.
by spydum 8y ago
it really is. The only downside is the lack of serious technology employers. So unless you land a remote gig, or are happy as a road warrior, it's tough to find work

More ›