staticassertion

136 ms·

3301.
by staticassertion 6y ago
That describes my own personal hell with iam, and it drove me to adopt aws-cdk. aws-cdk is their infra-as-code product and it's extremely valuable for iam alone. You can say things like: my_lambda.grantRead(s3_bucket) And it figures ou
3302.
by staticassertion 6y ago
HN "censors" posts all the time. There are moderators who go around deleting posts, and even the users here dare to downvote, suppressing the speech of others!
3303.
by staticassertion 6y ago
> I can no longer use many of the tools that help me, and instead am confined into the corporate-approved structure. This is both a productivity issue and a job satisfaction issue. Out of curiosity, like what? > Trying to separate Ye
3304.
by staticassertion 6y ago
> It's easy-mode for security because it offloads the cost of security to employees. Yeah, absolutely. But I consider this to be, when done right, a good thing. A single security team is going to drown trying to scale your company&#
3305.
by staticassertion 6y ago
App whitelisting is rarely rolled out, but it's just such a definitive win these days. a) You just kill ~85% of malware (rough estimate, probably technically higher, but I'm basing that on stats around interpreter-based/LOLBA
3306.
by staticassertion 6y ago
There are two big things you want to do: 1) App whitelisting. This is not the strongest mitigation (attackers with exploits can move in memory), but it stops drive-bys and 99% of malware, plus it massively reduces noise on the network. 2) R
3307.
by staticassertion 6y ago
One thing I've realized with Rust is that its guarantees are a moving target. Today we can guarantee (barring compiler errors) memory safety in safe rust, but not unsafe rust. But that story is improving. For one thing, we have people
3308.
by staticassertion 6y ago
> How does the site know the user's OS is patched? The User Agent? User agent is a great place for a version 0, sure. 99% of your assets aren't compromised, so worrying about a bypass isn't important to most of them. For a
3309.
by staticassertion 6y ago
Zero Trust != VPN. Zero Trust means that the network is not what determines trust. Consider this: * You go to your office, connect to the network * Now you have access to internal services, by virtue of being on the network In a Zero Trust
3310.
by staticassertion 6y ago
At the same time, it's hard to take down a site that has the type of impact that you're referring to.
3311.
by staticassertion 6y ago
FWIW email security training is something you'll probably be forced to provide, to some degree, as a matter of compliance. It's another case of compliance wasting time by driving companies to do security work that isn't mea
3312.
by staticassertion 6y ago
Yeah, I caught it too late to edit :\
3313.
by staticassertion 6y ago
Sure, agreed that refinements are likely the better approach here.
3314.
by staticassertion 6y ago
That's very surprising. I don't have a degree and at Dropbox, the last company I worked for, dropouts were more common than those who held a bachelors. Maybe there's something else going on?
3315.
by staticassertion 6y ago
TBH while a lot of people say the shortage is a myth, I am not so convinced. I wouldn't personally hire most people in infosec because I think the industry has the wrong idea of what the career should look like. Most people in infose
3316.
by staticassertion 6y ago
I think the fix is dependent types, right? If the compiler can reason about the index and the size of the vector, that's one way. For example; let x = 5; let y = vec![0; y * 2]; for i in 0..x * 3 { y[x] } That shouldn't compil
3317.
by staticassertion 6y ago
I'm confused. You're saying that people are reinventing existing ideas at larger scale, but you also are saying that people don't know how to extend what came before? Those sound like the same exact thing.
3318.
by staticassertion 6y ago
I'm a fool who has done microservices first and is very happy about it. Just want to throw that out there into the sea of negativity I see towards microservices.
3319.
by staticassertion 6y ago
> I'd definetely consider Tor Node Fingerprinting (2nd issue) to be an important issue. Why? If someone knows I'm running TOR, I guess that's not great, but I don't really see the issue.
3320.
by staticassertion 6y ago
I fully agree that it is bad and a legitimate issue. As I said, "a very significant issue".
3321.
by staticassertion 6y ago
Yes, totally. As I said, it's a very significant issue, but it requires a separate ability to tie the tor identity to the user's real identity.
3322.
by staticassertion 6y ago
Yeah, that's my point. Anonymity to me implies that you can not determine my true identity. That property still holds here. What doesn't hold is that you can not determine that I am the same person in multiple locations - a very s
3323.
by staticassertion 6y ago
> (Many users think that Tor makes them anonymous. But Tor users can be tracked online; they are not anonymous.) Being tracked and anonymous feel like two distinct issues. If you were to only see a hash of my username, you could track me
3324.
by staticassertion 6y ago
I didn't think it needed to be stated why. It was horrible from a security perspective. The world has completely changed in terms of end user security since Java went from default-run to click-by-default to denied. "One just needs
3325.
by staticassertion 6y ago
It's not much different in its goals, it's just a strictly worse implementation.
3326.
by staticassertion 6y ago
Java ran in the browser less than 5 years ago and it was a disaster.
3327.
by staticassertion 6y ago
This doesn't make any sense. A) It's not a good idea. The Chrome sandbox is arguably a lot stronger than Apparmor/ Seccomp. A native program in Apparmor or SELinux can still make virtually arbitrary system calls, whereas an
3328.
by staticassertion 6y ago
Semgrep's pretty slick. I tried out a demo and I was pretty blown away by how I could essentially just guess my way to a signature.
3329.
by staticassertion 6y ago
Whether the browser intends to provide that information or not, ASLR was not designed as a control against an attacker who can run near arbitrary code in the process.
3330.
by staticassertion 6y ago
I set up GraphQL with express-graphql on the backend and then I just use fetch on the frontend. I didn't feel the need to use Apollo. It felt fairly simple. I just define the schemas in Javascript, which works fine. But we also use sta

More ›