bqe

Given the litany of serious, exploitable flaws major AVs have had recently, nothing is better than something.

This is also the case for Elasticsearch. In fact, to get a proper username/password/ACL setup, you need to pay for professional support.

Master of the Senate: The Years of Lyndon Johnson by Robert Caro

If you're interested in the complex history of LBJ, the Senate, or America during that time, I'd recommend this (or really, any) Robert Caro book.

This is why I use Firefox on Android, actually.

DefenseStorm | Seattle, WA | Software Engineer/Security Researcher | ONSITE

We're a cybersecurity startup that helps banks and other financial institutions manage the deluge of security data that they produce. We take all of the security critical information and then alert on what's important, generate reports, and show cool dashboards.

We use AngularJS, Typescript, Java 8, PostgreSQL, Elasticsearch, and we're built on AWS.

The engineers we're looking for are serious about security, performance, and UX. We're trying to build a useful, secure app that solves real problems. Read about our engineering culture here: https://www.defensestorm.com/cybermind/engineering-culture/

If you want to know more or apply, contact me directly at sean@defensestorm.com. Thanks!

This paper also describes an attack on Argon2, which lowers the amount of memory required by an attacker.

DefenseStorm | Seattle, WA | Software Engineer/Security Researcher | ONSITE

We're a cybersecurity startup that helps banks and other financial institutions manage the deluge of security data that they produce. We take all of the security critical information and then alert on what's important, generate reports, and show cool dashboards.

We use AngularJS, Typescript, Java 8, PostgreSQL, Elasticsearch, and we're built on AWS.

The engineers we're looking for are serious about security, performance, and UX. We're trying to build a useful, secure app that solves real problems. Read about our engineering culture here: https://www.defensestorm.com/cybermind/engineering-culture/

If you want to know more or apply, contact me directly at sean@defensestorm.com. Thanks!

DefenseStorm | Seattle, WA | Software Engineer/Security Researcher | ONSITE

We're a cybersecurity startup that helps banks and other financial institutions manage the deluge of security data that they produce. We take all of the security critical information and then alert on what's important, generate reports, and show cool dashboards.

We use AngularJS, Typescript, Java 8, PostgreSQL, Elasticsearch, and we're built on AWS.

The engineers we're looking for are serious about security, performance, and UX. We're trying to build a useful, secure app that solves a real problem. Read about our engineering culture here: https://www.defensestorm.com/cybermind/engineering-culture/

If you want to know more or apply, contact me directly at sean@defensestorm.com. Thanks!

As an anecdotal counterpoint, I have tried meditation (both guided and solo) many times and have found it to have little to no benefit long term. I get none of the benefits mentioned above.

They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.

How could their pricing page be clearer? It says per host in fairly large letters underneath it.

I'm asking because I will be designing a similar page soon (that's also billed per host) and I'd like to avoid the same mistakes.

Time spent at work is easy to measure. Productivity is difficult to measure.

When I was in college, the I-35W bridge collapsed and many people died. In my differential equations class the next day, my professor was handing back our tests and told us–a class of engineers–that every red mark on our tests was another dead body.

You might scoff and say that's hyperbole, or scaremongering, and you might be right, but I took it as a warning. It is our responsibility as ethical engineers to ensure that people aren't harmed by the technology we create. It's true that self-driving cars will likely be safer than human-driven cars, but that doesn't absolve us of responsibility. In fact, it makes it all the more poignant.

The challenge of leadership is that of leading people, not of writing code. Dealing with people can be messy, frustrating, and depressing, but it's what needs to be done.

As a CTO, I code about 30% of the time, but I expect that to go down as our company grows. Much of the time I deal with people who were offended that so-and-so shot down their new design, or they think their career is being harmed because they can't rewrite the entire product in Clojure, or senior management is freaking out because of one minor bug that hits an important customer.

If you can see a path to where you want your company and team to be in a few years, then stay and try to move down that path. It is very rewarding to see tangible progress in your product and your team. If you want to be coding all day, find another job.

That would help, but an attacker being able to deliver an arbitrary website by MITM is still something that should be avoided.

This explanation makes the most sense to me. I've moved away from friends in the past few years, and we use a combination of methods to keep in touch, but however you do it, it seems like they just get farther away because some things just aren't worth an email or a Facebook message.

Snapchat (if they used it) would be a good way to stay casually in touch with them.

This is exactly wrong. Profiling does not increase safety whatsoever. Bruce Schneier argues it much better than I would:

> If the choice is between random searching and profiling, then random searching is a more effective security countermeasure. But Dunn is correct above when he says that there are some enormous trade-offs in liberty. And I don't think we're getting very much security in return.

https://www.schneier.com/blog/archives/2005/07/searching_bag...

https://www.schneier.com/blog/archives/2005/07/profiling.htm...

Sometimes I worry about a dystopian future of tech where each startup is making small incremental improvements on various minor aspects of life ("It's slightly easier than sending a text!") only to be disrupted by a newcomer with another small improvement on it ("It's even more slightly easier to send than a text than the last startup!").

The big breakthroughs never happen. We just continue to iterate and A/B test ourselves into a convenient oblivion.

Can someone who uses Snapchat routinely tell me why you use it routinely?

I've been using it for a few weeks to send a picture or two to the few people I know who use it, but it seems pretty limited. I follow a few "famous" people on it, and they basically just post random images of them walking around NYC or them traveling. I don't yet see the benefit.

No, it is perfectly acceptable to ban the most extreme members. Just because they don't ban everyone with extreme views doesn't mean they need to keep all of them.

I am tired of these all-or-nothing discussions that seem commonplace nowadays. The world is not as brightly defined as you think it is. We can make forward progress progressively.

Why not? If I suppress the notification, you won't see it. You will then click "Log in" and I'll redirect you to your 2FA screen. I think it's ineffective at what it's trying to do.

Sean here: the mitigation you speak of (notifying the user that they've typed in their master password) is actually another vulnerability.

A malicious page can detect the fact that LastPass put that notification, and then it knows exactly what your master password is without even contacting LastPass. I've told your security team about this but haven't yet received a response.

For those that missed the sarcasm, Telegram is not open source: https://telegram.org/faq#q-why-not-open-source-everything

My favorite Turing tarpit is FRACTRAN, devised by John Conway. It's flabbergasting that it is actually Turing complete, but it is.

A FRACTRAN program is a list of fractions, rational numbers. You input an integer and then you find the first fraction that gives you an integer when multiplied by your input. That process is repeated with the new, multiplied number until there is no fraction that produces an integer when multiplied.

Conway wrote a program that generates primes, there's others that mathematical sequences, but my favorite is just the addition program:

    3/2

Given an input 2^x * 3^y, it will stop at 3^(x+y), which adds x and y together.

Gmail will warn users for this, but not for soft failing SPF. That doesn't make sense.

There's nothing inherently wrong with that password as long as your code isn't vulnerable to SQL injection, which is trivial to do nowadays.

Praesidio – Seattle, WA

We're looking for software engineers looking to work with Elasticsearch, PostgreSQL, Java/Javascript. We build a cloud security product for financial institutions. Keeping them and their customers safe is our business. We're looking for engineers of all skill levels: junior, mid-level and senior engineers.

See this Angellist post for more details: https://angel.co/praesidio-1/jobs/90332-software-engineer

Contact: jobs at praesidio.com or sean at praesid.io for me directly.

When I submitted it, the s was automatically capitalized. Maybe dang can fix it.

CircleCI is still missing crazy important features like: building downstream dependencies when libraries change and scheduled builds.

Until it gets basic features like that, Jenkins it is.

Next generation is indeed a vague term, but I would use HEVC as a good example of a next generation codec.

For another codec to be next gen, it should have the same or better compression than HEVC: about half as many bits to encode the same video than H.264 required.