theboss

14 ms·

91.
by theboss 13y ago
I think it is good advice. He says to do it twice per month, not everyday. It sounds dumb in those words, but the concept is good. This can be as simple as saying ``lets get coffee'' and you buy the other person the coffee. It is
92.
by theboss 13y ago
lastpass is free or at maximum $1 per month. 1pw is pretty expensive though.... Also they run in your browser which mean the client side and crypto code is easily recoverable
93.
by theboss 13y ago
So do you have both in the same database or were only one type stolen? The difference is very important
94.
by theboss 13y ago
It is weird watching two ants fight. Mammals it is pretty easy to understand what they are trying to do, hit eachother or bite eachother or something. But ants? It just kind of looks like they are crawling on eachother. I have no idea how o
95.
by theboss 13y ago
None of the attacks I thought of rely on an attacker to break https....
96.
by theboss 13y ago
Okay I'll dig into the details when I have time. I noticed you an malgorithms took the time to write big posts to me. Thanks, Ill make sure I repay you with some of my time too.
97.
by theboss 13y ago
I don't see why you don't just get the key once, allow you to verify it, and store it locally. It seems pointless to make all these extra requests to you. There's a reason that gpg does this..... Maria's twitter being ha
98.
by theboss 13y ago
When I get someone's GPG key I can call them on the telephone or go to their house and make sure I got the right one. I add it and use it. When you use this, I'm assuming I get that key every time from the server. I can get it and
99.
by theboss 13y ago
Where are the security details published? I think that's what we all want to see... On top of this....I think this is cool in theory but bad in practice. The assumption that Root CA's are trustworthy is already hard enough to make
100.
by theboss 13y ago
This is a good solution. Have a archive private repo that everything I'm done with goes in. Perfect.
101.
by theboss 13y ago
Yeah that does work. It is only frustrating when I have a lot of big projects at the same time. Sometime they can be public, but othertimes they cant. I imagine it is worse for undergrads, where almost all their coursework will be private.
102.
by theboss 13y ago
Github, I use you for all my \LaTeX papers, programming assignments, masters projects, whatever else. It is really helpful. But I don't like that I can only have 5 private repos. Making my work public could be an honor-code violation a
103.
by theboss 13y ago
exactly. That seems to be what OWASP is trying to do right now...and it doesn't seem to be working because it isn't technical enough.
104.
by theboss 13y ago
Obviously OWASP can't be perfect. We may see the same security issues over and over but the details of particular problems will be specific to the code-base. But stuff that is universal should be a lot better. Broken Auth page is so ho
105.
by theboss 13y ago
Tl;Dr. OpSec is hard. Like really hard. So hard you'll mess it up given enough chances.
106.
by theboss 13y ago
They should get a BugTraq ID or go into OSVDB, however, that isn't always the case. These should be reported, and if they are serious, documented.
107.
by theboss 13y ago
CVE database is really really bad. Mitre says their limited funding means they are unable to fit all vulnerabilities into the database. There are MANY MANY MANY vulnerabilities that are not in the CVE database. NVD, CVE, BugTraq, PacketStor
108.
by theboss 13y ago
You would be ASHAMED how many websites and companies with software have "Won't fix vulnerabilities". The list to which I have reported is long....
109.
by theboss 13y ago
Ahh I see. Thanks. I trust him. Nobody knows best like an anonymous stranger on the internet.
110.
by theboss 13y ago
I don't know what this means. I understand the individual words....but not the meaning of your post
111.
by theboss 13y ago
Dang. $400million sounds like a lot for landing page. Only kidding. Best of luck to those guys. They sound very talented.
112.
by theboss 13y ago
ITT, people who have never been to DC. Dulles is one of the main airports everything flys into for DC. As for as I know, it is the biggest. Dulles has a lot of government contractors and big companies in the area, but that's about it.
113.
by theboss 13y ago
Who are these vocal misogynists in this industry? I've never heard of them or seen them...
114.
by theboss 13y ago
it isn't that difficult to white list a few domains.. It's a grand total of 1-5 lines of code that contains a string you can change... CSP is super valuable and it's worth the few extra lines
115.
by theboss 13y ago
Yes. It does say he didn't access the data. There is a difference between passive and active attacks.
116.
by theboss 13y ago
No....No he didn't. https://twitter.com/HackingDave/status/425640931690565632
117.
by theboss 13y ago
That's what it is like already. Except instead of trivia, it is the same recycled data structures and algorithms questions, with some specific questions about topics on one's resume. IMHO the hiring process will change a lot in th
118.
by theboss 13y ago
So....is it still oil? What is the molecular difference between bio-fuel and regular ol' jet fuel? What is the difference after it is burned? Seems ridiculously cool.
119.
by theboss 13y ago
TL;DR - If you want to do crypto then learn crypto. If you want to learn crypto and do crypto then certainly start with this. Then, when doing crypto...practice. Build it and reach out and ask for help and talk to people who know what they
120.
by theboss 13y ago
A friend and I built a t-shirt site too. It's so incredibly basic (ours is ugly) but was fun to do to actually write some software for the web (we arent really web guys). The code is actually really cool because we never have to touch

More ›