spydum

70 ms·

601.
by spydum 10y ago
You sure? I seem to recall hearing a number of shallower wells going dry nearby the heavy agricultural areas?
602.
by spydum 10y ago
digestive tract maybe not, but metabolism/endocrine system does actually respond.
603.
by spydum 10y ago
(Up to 6%)
604.
by spydum 10y ago
The great irony in tech is that we all rail on tech outsourcing, but no qualms about it elsewhere (marketing, sales, finance, HR, etc). I get it if you aren't quite big enough for a full time person, but just remember incentives are us
605.
by spydum 10y ago
Typically no. Most ISP's have a Term of Use which says something like: "C2 SB shall have the right, but not the obligation, to: (a) monitor traffic and content on its network, in its sole discretion, including through the us
606.
Apache Struts 0-day(blog.talosintelligence.com)
5 points by spydum 10y ago|0 comments
607.
by spydum 10y ago
Totally agree. Would also point out that if you have systems up for many years, they like haven't been updated in the same... shouldn't people find that alarming?
608.
by spydum 10y ago
I mean yeah it kinda is, but you really think google needs advertising for its brand?? I think Google is doing some of the most impactful security work as a company I have ever seen. Between GOOG and MICROSOFT (within past few years) they h
609.
by spydum 10y ago
Nah, just remind them you made a design decision to focus on the meaning, and not the grammar, which let you write the post 10x faster ;)
610.
by spydum 10y ago
The risk is that more money does not always mean more progress. Government organizations tend to grow all by themselves (would be interesting if you could legislate some productivity targets into budget expansion maybe?)
611.
by spydum 10y ago
I take it to mean they roll out their own physical fiber, and don't just lease or ride someone else's network.
612.
by spydum 10y ago
Isn't it worse than that? Even if you are not a CF user, if your apps make calls to a third party site protected by CF, you could be at risk (stolen credentials, API keys), and could be attacked using those now.
613.
by spydum 10y ago
People are going to lambast CF for downplaying the impact, and there could be merit in that. However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to
614.
by spydum 10y ago
I would point out, 9/11 hijackers were all here on legal visas[0] - so using that thinking is faulty. Our visa process seems to have faults, and I think this EO is a stop-gap to try to amend the issue. I don't particularly agree w
615.
by spydum 10y ago
Good news! Enable ANSI in your terminal and: ESC[5m http://wiki.bash-hackers.org/scripting/terminalcodes
616.
by spydum 10y ago
I must be missing something: doesn't this say published August 2016?
617.
by spydum 10y ago
I think both trump and sanders were symptoms. The people wanted change (which is why Obama did so well). What they got was very moderate change. Government doesn't change as fast as people want, so they continue to vote more extreme fo
618.
by spydum 10y ago
It's waaaay more profitable to sell the same device for three years without updates: it costs nothing in r&d. This wholy explains the mind boggling profit margins doesn't it?
619.
by spydum 10y ago
that isn't exactly how IP spoofing works: i'd argue for the most part, ip spoofing is just a DDoS hassle. Its not very useful on a real service you intend to interact with (tcp/https require you to reply to those ip packets
620.
by spydum 10y ago
Retail sector is not going to hAve a strong 2017. 2016 ended soft and almost every retailer is losing ground to ecommerce. That being said, it does seem odd they would cut senior ecommerce folks in that climate.
621.
by spydum 10y ago
Honest question: do Product owners report up through CTOs usually? I am not even sure how it works at a technology company (where the technology literally is the product). I guess I ask this because I don't usually think of the CTO def
622.
by spydum 10y ago
I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for validation). Then your endpoints don't need to exchange secrets at all?
623.
by spydum 10y ago
Im somewhat confused on that as well: cloud services is not the EC2 equivalent. VM is. Also, if you run VMs, you most definitely are on the hook for patching.
624.
by spydum 10y ago
Since both AWS and azure some free tiers for a trial period, what other way do you see for them to ensure you aren't abusing the service and just creating a new account every month? Tying it to real financial accounts is unfortunately
625.
by spydum 10y ago
Incorrect: U2F would prevent this, but simple 2FA challenge could simply be displayed at the next screen of the form, and once you submit, the malicious server could immediately use the token you provide. U2F does mutual auth of the u2f se
626.
by spydum 10y ago
Interesting write up.. I like the idea of thinking of misplaced commas in contract law as a parallel to software vulnerabilities!
627.
by spydum 10y ago
I think this is still a cop out: first thing junior will do when he can't connect to his database from home is google it, then find out how to bind to all ip's. Network access is BARELY viable access control, as it's too easy
628.
by spydum 10y ago
fully agree, but I think the point was around the educational value of literally being able to handcraft HTTP requests. I learned a ton back in the 90's doing exactly that for various plaintext protocols (FTP, SMTP, POP3, IMAP, HTTP).
629.
by spydum 10y ago
As others have pointed out, there are tools for creating a TLS socket, not much harder than nc or telnet. However, HTTP/2 will be a totally different game.
630.
by spydum 10y ago
agree here. I say kudos to GSMA for even PAYING ATTENTION that the talk was planned, and reaching out ahead of time. It's not like they were asking them not to present. I find there are quite a few folks in security who tend to be glor

More ›