zedshaw

45 ms·

481.
by zedshaw 15y ago
Hmmm, that could be interesting actually. It might be possible to replicate that with source code checkins on a project.
482.
by zedshaw 15y ago
Glad you liked it. Yeah, my R is a little rusty but hopefully you got the general idea of gathering stats and then tracking them to see if you can improve them.
483.
by zedshaw 16y ago
> Meanness is moral mediocrity. Shiiit Paul, hacker news has been screwed up since the beginning. Remember this video? http://www.viddler.com/explore/rentzsch/videos/31/ That video would show up on the front page about once a year, a
484.
by zedshaw 16y ago
Yes, definitely do this. Don't let people try to convince you that you shouldn't reinvent the wheel. Typically they just have some wheel they've reinvented that they want you to use. Instead, you should implement as many things as you ca
485.
by zedshaw 16y ago
Ooooh, that looks sexay. I will play with this now.
486.
by zedshaw 16y ago
Ohhh, my bad, I totally forgot that people like selling things that don't exist but telling everyone else they do exist.
487.
by zedshaw 16y ago
> the problem is that if you promise a manager something The real problem is thinking of "estimates" as "promises" when really they're rough guesses. If you go around holding people to a guess as if it were some kind of gospel biblical
488.
by zedshaw 16y ago
Lulu was supposed to help me get the book into Amazon.com, but they totally and completely failed at this. All I can do is point people at my lulu page and that's it. If they got their act together and actually put the damn thing into A
489.
by zedshaw 16y ago
If it's boring then it's not for you.
490.
by zedshaw 16y ago
I probably would just do that as more of a opt-in signup than a barrier. As much as your mouth waters at this, I'm more cognizant of how that short-term myopic goal undermines the long-term goal of universal education.
491.
by zedshaw 16y ago
Let's try a few of your supposed scenarios: 1. Researcher posts it. 2. Vender pulls it down and looks at it, then says it's harmless or not an issue. 3. Researcher thinks it is, and since the vendor says it's not, the researcher posts a cle
492.
by zedshaw 16y ago
That's possible, and also for the SMB market that's producing lots of software but might be just a few devs. Think: iphone, ipad apps, small sites. There's not much for them either.
493.
by zedshaw 16y ago
It's easy. Vendor decrypts it. It gets ignored. Done.
494.
by zedshaw 16y ago
It's starting to look like doing this for open source projects is a good start. They seem to be less capable at this, try to hide the vulnerabilities more, and reporting to them is much harder and well organized. Also, based on my experie
495.
by zedshaw 16y ago
So, block spam and identify people to avoid is what you're saying? Done. Now what?
496.
by zedshaw 16y ago
That's a really good point. I'd be competing with companies that pay people to give them defects, which is really hard to go against. I sure don't have the money to do it, so maybe this would just be for open source projects at first.
497.
by zedshaw 16y ago
Could be an option, although I'm not sure what's better given that most vendors wouldn't want to have other vendors know they're vulnerable until they fix it. Also, I'm pretty sure that if adobe and microsoft both have a vulnerability then
498.
by zedshaw 16y ago
> Actually my point about the karma system is that you can achieve the same goal you have in mind without needing any sort of data from the researcher other than "product X is vulnerable" and then the karma points will determine whether
499.
by zedshaw 16y ago
Yep, you know way more about this than I do. I've wanted to solve this problem for a while so any feedback helps. The only thing you seem to be missing in the above is the consumers. It's not about getting the vulnerabilities transmitted
500.
by zedshaw 16y ago
What if this turned into an open source client combined with a standardized API for reporting vulnerabilities directly to vendors and similar escrow services? Ultimately, yes, it's meant to be easier and more open than current initiatives.
501.
by zedshaw 16y ago
That shell script does that already. Go ahead and run it for multiple sites with the same file: sh encrypt.sh www.google.com mysecret.txt sh encrypt.sh www.apple.com mysecret.txt sh encrypt.sh www.microsoft.com mysecret.txt It t
502.
by zedshaw 16y ago
> First off vendors by decrypting the content of the researcher's submission are basically giving up vulnerabilities to the bad guys that want to target unpatched systems They already do this. After a vulnerability is patched and fixed
503.
by zedshaw 16y ago
That's fine, they can ignore it since ultimately it's not about them but about everyone else. People then evaluating similar products can go look and see how they compare on their security track record. Once that happens I imagine they'll
504.
by zedshaw 16y ago
Yep, exactly. People reporting vulnerability shouldn't have to beg to do it, they should be able to do it and it's up to the corporations to provide more convenient means. That and I thought it was a pretty cool hack to encrypt a payload us
505.
by zedshaw 16y ago
I mostly disagree with this. Right now the corporations have pretty much stacked the deck against consumers when it comes to security. A simple site where you can go and at least see the amount of vulnerability in a product, and also any
506.
by zedshaw 16y ago
Can you find instances of this practice? I'd like to know so I can investigate.
507.
by zedshaw 16y ago
Yes, ideally GPG would be better, but if you only did GPG then companies could simply not publish a key and avoid the whole system. I'm envisioning some combination whereby, if they are already registered on vulnarb.com then you just get th
508.
by zedshaw 16y ago
> The real problem is that vendors sit on vulnerabilities for months or years; giving them one more (complicated) way to publish doesn't really help much. Just making sure you actually read what I wrote, since that's specifically stated
509.
by zedshaw 16y ago
Yeah, that whole mental ninja trick of saying a programmer who doesn't want to do your bullshit "process" isn't a "team player" has to stop. It's just a manipulative way of calling someone autistic, a nerd, anti-social, and other offensive
510.
by zedshaw 16y ago
You can also just go to: http://learnpythonthehardway.org/ And download it for free, including checking out all of the .rst files that make the whole book.

More ›