spydum

52 ms·

571.
by spydum 9y ago
Sorry, you don't throw away mitigation techniques because they aren't foolproof. This is still excellent advice. Stop using sa and root accounts for your apps.
572.
by spydum 9y ago
The cost for encryption at rest is single digit percentages these days. I push for encryption at rest on ANY cloud provider storage for one main reason: I have no control over their disk disposal or reuse mechanisms. They can claim they wip
573.
by spydum 9y ago
a lot of people kicking sand in MSFT's eyes for having such a vulnerability.. but come on, the code base for windows is enormous. The feat of engineering that is microsoft windows (and its many iterations) is pretty amazing when you re
574.
by spydum 9y ago
I think you vastly overstate this. While I can't speak to GHCQ, I really don't think NSA has a charter to pursue justice. The FBI may be, but I'm just not convinced they will move quick enough to matter (they do move, but onl
575.
by spydum 9y ago
He is right, but patching is a single layer in your defenses. Where was network segmentation? What about IPS/IDS? You would hope one layer of failure doesn't take out an entire business.
576.
by spydum 9y ago
You have the right idea but wrong version number.. 1.1.13701, not 10701.
577.
by spydum 9y ago
True, but the pace of the transition was substantially slower. I think that is the concerning part: it will happen over years (less than ten) versus generations.
578.
by spydum 9y ago
Next up, prepare for the inbox onslaught of every CASB provider hawking their wares and telling you all about the googpocalypse and how they are uniquely prepared to solve it!
579.
by spydum 10y ago
Interesting, just finished reading John Allspaws 2015 paper from some debugging/problem solving at Etsy: http://lup.lub.lu.se/luur/download?func=downloadFile&recordO... (really slow.. sorry Sweden!) While it f
580.
by spydum 10y ago
The great sadness to me is that incentives in architecture almost encourage this... Hardware is cheap and good designers are few. So when guys like you can come in and squash down the complexity,, company thinks it won twice (first time for
581.
by spydum 10y ago
For sure there is a bit of self-flagellation. However, what it doesn't tell you is how cost effective or as they elude to: how improves developer velocity (a stand in for productivity) is. Those other guys may also be offering streamin
582.
by spydum 10y ago
I haven't attended any crypto conferences but, I do work a bit with high school STEM programs and I can tell you.. higher ratio of male to female, BUT, those female students are far more interested in the math / crypto fields than
583.
by spydum 10y ago
Indeed - heaven forbid you try to sign into Azure Storage Explorer with both! It invalidates the other (workaround: use a SAS)
584.
by spydum 10y ago
I went looking on fancy new google earth. Found some around the area. Completely unrelated, but is it my imagination or do the concrete poles that all the telco cabling ride on flex under the weight?? https://goo.gl/0wv8Hh
585.
by spydum 10y ago
always wondered how exactly this process works.. you can date the stone itself, but how do you date the shaping of the stone?
586.
by spydum 10y ago
Nobody is knocking security training -- just the value of the certificate process. We all know far too many people who have mastered the test, but not the material. This makes the signal from the certification unreliable.
587.
by spydum 10y ago
That does sound pretty unrealistic, but doesn't this consider that scenario: "Omit user identities or screen names with which you were publicly identified."
588.
by spydum 10y ago
IMHO, I dont think it will pan out this way. Companies are being breached, and neither their marketshare nor profits are being significantly affected. Aside from https://www.dailydot.com/layer8/code-spaces-hacked/
589.
by spydum 10y ago
Have you actually looked at the CISSP material recently? It's a hodge-podge of everything under the sun. The only thing it's able to prove is that a) you have endurance and spare time to sit for a 4-6 hour multiple choice test b)
590.
by spydum 10y ago
Totally agree with this. I think security / infosec is just seen as a small niche, so people lump the cryptographers, auditors, SOC analyst, malware analyst, appsec, incident response type people all in one group. It's hard to fin
591.
by spydum 10y ago
I have no idea if this is relevant, but it seems like it: http://www.srp.law.harvard.edu/companies-voting-on-proposals...
592.
by spydum 10y ago
I think you neglect the power of the consumer that credit cards yield: I can dispute charges when retailer/service provider fails to deliver.. It definitely balances the power out. Can't do that with cash.
593.
Analysis of NSA Tool dump(hackmd.io)
2 points by spydum 10y ago|0 comments
594.
by spydum 10y ago
Why is everybody posting/curious about the language of the blog post and not the contents of the file? I've looked through some of the contents.. Some look incredibly old, but others target odd things.. lots of cPanel. My only gue
595.
by spydum 10y ago
These look much older than 2013. So much of this stuff is targeted at sun/sco.. the only thing I can suggest is: most state/government systems are simply ancient.. so their tools will be tailored to their targets.
596.
by spydum 10y ago
Correct: a service called The Work Number by Equifax. http://www.theworknumber.com
597.
by spydum 10y ago
Agree with this, except I often find OWASP hard to navigate or know what's still relevant. Plenty of old projects linger about. They try to flag projects but still troubling.
598.
by spydum 10y ago
Wasn't that fact debunked (oh look fake news from the 80s! Nothing new under the sun I guess)? Though your point still stands- the attack on marriage was successful I suppose.
599.
by spydum 10y ago
I fully agree with all of this for code. However I have often thought the same techniques and mental model approach for debugging any complex system could be boiled down. I also attempted to write a course along the same lines and kept thro
600.
by spydum 10y ago
I find it interesting that for some people it is a truly humbling and transformative event, and others it's a debilitating one. Wish I had explanation for the difference though.

More ›