spydum

42 ms·

451.
by spydum 8y ago
For what it's worth your view is contrary to mine: I've attended quite a few local OWASP chapter meetings and volunteered at OWASP AppSec. I've found it's a pretty diverse set of DEFENDERS, not so much the pentesters. Al
452.
by spydum 8y ago
this would seem likely because you aren't sleeping well or deeply, hence able to recall the dreams.
453.
by spydum 8y ago
And most importantly: keep it updated. About the only thing I would trust without updates is a bsd box. And even that, may eventually fall victim.
454.
by spydum 8y ago
Opsec and AppSec usually handled by different teams :)
455.
by spydum 8y ago
Pretty sure the new way is via PowerShell: Set-AuthenticodeSignature -HashAlgorithm "sha256" -IncludeChain "all" -FilePath "File" -Certificate $Cert -TimestampServer $TSUrl
456.
by spydum 8y ago
so, I tend to disagree: your solutions were the old approach, where you keep trying to block, and hope they dont have a wealth of new source IP's to spawn their attacks from. I think what we find is, this doesn't work any longer.
457.
by spydum 8y ago
Raise better children, and pay living wages, basically.
458.
by spydum 8y ago
? I've got 34 technically. Behind my wisdom teeth I have little buds of teeth which can never surface (not nearly the size of a full wisdom tooth/molar) Supernumerary I believe it's called. I happen to have a pretty long jaw,
459.
by spydum 8y ago
literally effort. when you lower the attackers effort and cost to try an attack, the attempts generally go up.
460.
by spydum 8y ago
So glad they finally published this, saw the OWASP AppSec talk, was eagerly awaiting it. However - I would want to caution: I think this model works because Slack has a self-described "culture of developer trust". I tend to think,
461.
by spydum 8y ago
Are you kidding ? Imagine the crazy boost to unique views after this!
462.
by spydum 9y ago
So... Krang? https://en.wikipedia.org/wiki/Krang
463.
by spydum 9y ago
Exactly.. you have clearly under-tested code that is in debug mode printing out all sorts of detailed error messages and systems team that is overloaded with errors and problems to triage. Talk about a ripe target. That is stuff of nightma
464.
by spydum 9y ago
It could potentially cost far more- the $35MM is just the SEC fine, they could still be subject to other actions by differing agencies. Whether that can or will actually happen? Who knows.. but in any case, yahoo is already effectively dead
465.
by spydum 9y ago
Marketing? What pray tell is she selling? If this had been some post about lessons learned about a the latest whizbang JS framework people wouldn't have had a second thought. I've read plenty of her posts and have sympathized, as
466.
by spydum 9y ago
I would bet substantial number of companies have not even begun GDPR compliance until around Q3 2017. It would be interesting to see the prevelance of GDPR in quarterly earnings call transcripts over time..
467.
by spydum 9y ago
I can't help but observe that substantial movement of pressure and criticism in the US around biased journalism, and fake news is shifting the narrative (or preparing it) for state-controlled media. We thought it was bad before, and so
468.
by spydum 9y ago
Interesting that funding only started to fall when the concept of Affordable Care act began to get traction? If I'm an investor, that sort of thing gives me cause for pause.
469.
by spydum 9y ago
I may be ignorant on this, but don't many of those countries benefit by the r&d funding happening in the US?
470.
by spydum 9y ago
Same here but I have had maybe 3 out of several thousands of transactions where the cashier asked to see my id because it wasn't signed.. The signature generally smears off after a few weeks anyways.
471.
by spydum 9y ago
I feel like this is a really common problem for both mobile AND OAuth authorization frameworks. The scopes and permissions are not quite fine-grained enough - it's generally a read and WRITE for all of what they ask for, instead of bei
472.
by spydum 9y ago
I was going to argue with you, but stats do indeed seem to back this up (I hadn't looked at them in at least a year or two). The gains for chrome are insane, and there is clearly a harsh decline for IE. I suppose this is probably why P
473.
by spydum 9y ago
We just ask the guy/gal at the desk. It's not that crazy, though I will admit, my last trip there added some stress because of this uncertainty.
474.
by spydum 9y ago
Vault already did secrets. Nothing stops you from writing an azure function to handle rotation, but you gotta build it yourself. AWS has BUILT IN support for RDS. However, the biggest delta is: I'm like 90% sure Azure key vault doesn&#
475.
by spydum 9y ago
As long as they retain no data which could specifically identify the original person, yes. There is nothing wrong with building segmentation models as long as they aren't specific enough to identify a specific person. My concern would
476.
by spydum 9y ago
Collab tools are fabulous no doubt, but sheets feels entirely neglected and basic. Permissions model is clunky and gsuite governance is nonexistent - you have to buy a CASB license to do anything effectively. It's not a bad suite, I ju
477.
by spydum 9y ago
we did a similar thing. nobody can figure out why. gsuite is cool for a couple hundred people, when you dont want to pay for office licenses for everyone. it makes even less sense when you already do. there is a serious productivity delta
478.
by spydum 9y ago
Ads yes, but tracking?
479.
by spydum 9y ago
Has anybody actually seen an ISP tracking user behavior? I've worked for a few 1998-2005 and never witnessed it.. however I wouldn't be surprised if they had transformed in the years since. Just curious if anyone has ever leaked i
480.
by spydum 9y ago
I agree with your points. I think mostly the problem is there is no one specific place to find the list of "appropriate" methods to achieve the objective. Someone working in the infosec field could probably spit them out, but a de

More ›