DGAP

Looking for more anecdotal evidence, if you had to run an AV what would be the lowest impact?

Favor Delivery | Austin, Texas (TX) | Android, Frontend, Senior, Backend, Test Automation, QA Manager | Onsite | Full-time | https://jobs.lever.co/askfavor?lever-via=WUDy1PL7mZ

We're an on-demand delivery company based solely in Texas and growing rapidly."Favor’s mission is ‘Anything Delivered’. Our engineers make high-touch logistics happen. The Favor technology platform is the engine behind the business enabling millions of Favors. Our technology efficiently manages the real-time assignment of Runners to Favors, facilitates communication between customers, Runners, and support, keeps thousands of customer and Runner mobile applications in sync, and more."

Usual benefits & perks including: - Complimentary meals, commuter benefits, dependent care, and delivery credit - Unlimited PTO - Brand new dedicated office space - Premium health, vision, dental and 401(k) options

Feel free to comment here or on find me on Twitter for questions - I work on the engineering team.

Tech stach and keywords: PHP, Kotlin, Scala, Python, Java, Node.js, React, MySQL, Kafka, Docker, Kubernetes, Terraform, AWS, Elasticsearch, XCUITest, Selenium, JUnit, NUnit, Espresso

AWS has Macie to catch this sort of thing, not to mention the usual AWS security automation tools available like Security Monkey. Or the fact that a pen test should have caught this, or employees following the data use policy.

This article is a great illustration to me as well of how hard it is to do security right even if you're a professional, much less a developer who's mostly responsible for implementing features not building secure systems. The internet is rife with self-proclaimed experts, all offering directly contradictory advice as loudly as possible on best practices for security.

Agreed - but for non-technical consumer 2FA, there's really no other option that users are actually going to use. And SMS 2FA is still orders of magnitude better than just passwords when your threat model is credential stuffing and weak passwords - not attacks on specific accounts.

And if you use 2FA, then it raises the cost of compromising your account to that of a targeted phishing attack at worst. That's an entirely different threat model.

Triple the estimate.

Unfortunately, using Google Tag Manager basically requires setting 'unsafe-inline', neutering your CSP.

...that depresses me on several levels.

Excellent list - I immediately ctrl+f'd for Schneier's law as it's my favorite crypto axiom.

My only suggestion would be adding: "Crypto is like catnip for programmers."[1]

[1] https://blog.pinboard.in/2013/04/the_matasano_crypto_challen...

We do hear about it, and in the Western press primarily: https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie...

The difference is that when US-run agents get burned, they get publicly executed by the Chinese government, as opposed to put on trial for imprisonment.

Selective Klotho Re-uptake Inhibitors? SKRIs?

Not a great look for Stamos.

You or your business are much more likely to have your information stolen because of credential theft than someone discovering and exploiting vulnerabilities. This is regardless of whether your attacker is a nation state or a cheating student. Whether you decide to call it "hacking" is irrelevant when they're in your network.

Maybe you do, but you obviously shouldn't.

Eh, most airlines going for satellite WiFi aren't doing it out of the goodness of their hearts - they're doing it because the unit economics make sense. There are exceptions like JetBlue who offer it for "free" though.

Long bitcoin in 2019? Brave.

My personal law from working in software consulting is "triple the estimate."

They'd only work for campuses, with elevators in all the dorms.

Somewhat ironically, the Israelis have their own, cruder, initialism for this.

Hence the organizing of entire overseas conferences in order to lure them in.

"The FBI is now investigating whether Raven’s American staff leaked classified U.S. surveillance techniques and if they illegally targeted American computer networks" [1]

It's still illegal to use US classified information for a program like this and it's still illegal to target American citizens or networks.

[1] https://www.reuters.com/investigates/special-report/usa-spyi...

No one read the other Reuters article on this - it may have been criminal for NSA employees to participate in this, at the very least it was highly discouraged. If anything this is a good argument to pay IC employees on the GS payscale better so they're less likely to take jobs with other countries.

This further reinforces the pattern of terminating TLS at the LB. While this is generally justifiable, it does decrease defense-in-depth.

Any published IOCs for this? Any hashes for the malware itself?

I love my MBP - when my employer pays for it. I'd never buy a $3K machine with this many issues on my own dollar.

Seems strange to have a NYT article about this without mentioning Basecamp/ 37Signals. They've been a proponent of the bootstrapping model for a decade.

Favor Delivery | Backend, Frontend, iOS, Android, Security, Product, Senior | Full Time | ONSITE | Austin, Texas Food delivery startup local to Austin TX, we were acquired by H-E-B as a wholly owned subsidiary in 2018 and are growing fast including a move to a new HQ in East Austin this year.

I came onboard recently and have really enjoyed working with this team. Still very much a scrappy startup/ small company culture and we're building a lot of new tools and features. If you have any questions feel free to reach out to me on Twitter: @Primed_Mover

https://favordelivery.com/careers

Favor Delivery | Backend, Frontend, iOS, Android, Security, Product, Senior | Full Time | ONSITE | Austin, Texas

Food delivery startup local to Austin TX, we were acquired by H-E-B as a wholly owned subsidiary in 2018 and are growing fast including a move to a new HQ in East Austin this year.

I came onboard recently and have really enjoyed working with this team. Still very much a scrappy startup/ small company culture and we're building a lot of new tools and features. If you have any questions feel free to reach out to me on Twitter: @Primed_Mover

https://favordelivery.com/careers

That is a strange issue. I have all of my music (sans the few tracks not on Spotify anymore) saved in a Starred playlist which I started 7 years ago when Spotify saved music via "stars." Even there though, I only have 7K tracks - how do you have 10k?!