ejcx

Is email secure enough, or does Google/Microsoft running people's mail servers make it secure enough?

I think it's the latter.

Resilient and secure compared to regular snail mail, you must mean.

You're dangerously wrong about the security of email...

I hope email disappears. It has no security, bad tooling and software, weird protocols. Ip reputation has long been a thing in email.

You can own IRC as well. I feel like your 3 cons are my three pros.

This should be renamed to "Telegram right to left vulnerability"

This is just not an RCE. It's just pretty good phishing.

There are so many services with domain ownership validation issues. It's honestly an extremely hairy problem.

Handling all the edge cases is extremely challenging to do so with good UX

When a customer validates ownership do they keep it forever? How long? Do you rescan for txt records? How often? Do you handle customers leaving gracefully? How do you handle new customers re-setting up their domain on a new account?

It's a big mess and it's a lot better to do what cloudfront does and give customers a unique name to CNAME to

Or with a different spin.

Locking your computers that are no longer in company possession is a common Enterprise control. They take protecting your data seriously!

If the authorities need the data on the computers the will surely present a properly scoped warrant!

I've worked and had roles where I had a non-existent manager.

If it is really really that bad, it's a much better outcome to leave amicably versus fighting to fix the issue. Remember that software is a very small industry we all work together in.

There's no candid way to fix your manager's behavior if they are non-existent, or completely detached from their team. Especially if your manager's manager does not care or know.

If you have malicious applications running on your laptop you have bigger problems already...

Lots of people being critical of this response. I think it's pretty good, and have been on the disclosing side of this equation many times.

Admits responsibility and says their current course of action (working with key stakeholders). Addresses concerns of the workaround. Has a timeframe for future updates. Has a call to action for what you should be doing next. To those of you pointing out that this is PR, you're right but that's not a problem...

Short and sweet and has it all. If anything, it is a day late but monstrous organizations probably had a lot of bureaucracy to cut through.

People are so reactionary and quick to throw any company with a security issue under the bus, without ever having been on the other side of the table. The reality is issues happen to everyone and Intel wants to fix it.

Segment | San Francisco, SF | Full-time | Onsite | https://segment.com/jobs

Segment is growing quickly and hiring on all fronts. In the engineering organization, some roles I find particularly interesting:

    - Tooling Engineer (https://segment.com/jobs/922851-Tooling-Engineer)
    - Site Reliability Engineer (https://segment.com/jobs/253929-Site-Reliability-Engineer)
    - Application Security Lead (https://segment.com/jobs/931020-Application-Security-Lead)

Our engineering organization is full of talented people, working on fun projects, and engineering solutions used by some of the worlds biggest and most innovative companies. Some fun blog posts that show what we are up to.

    - The Million Dollar Engineering Problem (https://segment.com/blog/the-million-dollar-eng-problem/)
    - 5 Advanced Testing Techniques in Go (https://segment.com/blog/5-advanced-testing-techniques-in-go/)
    - A Brief History of UUID (https://segment.com/blog/a-brief-history-of-the-uuid/)
    - Many more, read our blog!

If you are interested in the Application Security Lead, or other security positions feel free to reach out to me if you have questions about the roles (but apply on the site)!

For more open positions feel free to browse and apply on our jobs page: https://segment.com/jobs.

Even if the data is not random it doesn't weaken your kernel prng by writing non-random data to urandom.

Don't overcomplicate your threat model with non-existent risks

it expired >100 days ago. Im guessing people are supposed to go here: https://www.godaddy.com/help

I think this is a really weird situation.

This 6year old did not make $11M. His parents did. His parents edit the videos, maintain high production value, market the channel, make a constant stream of videos starring Ryan.

It's a pretty weird situation. It is kind of insane how much money his parents are raking in because of this

We wrote about our use of parameter store extensively. We have been very happy with it:

https://segment.com/blog/the-right-way-to-manage-secrets/

I really think it's just an AWS account with credstash under the hood, that some Amazon engineers work on full time. Seems like a no-brainer to use imo, since it's very polished.

You're assuming readers are managing snowflake servers, and I'm assuming they are in an containerized/autoscaling/more modern environment.

SSM wins for mine. I think you're right that the file approach wins for yours.

While this is true, it's something you can work with in the future, and it defined a secrets process earlier rather than later

If you do nothing you end up stuck with secrets in git history and you essentially have to roll them all.

So, my advice is generally SSM with no security is better than no secrets Management solution.

If you're all in on AWS, just use parameter store. This scheme is just CredStash, and so is parameter store under the hood.

You're right, but it's worse than you say.

It's also legal data requirements. Many EU businesses ask that their data never leave Europe. How do you separate your product in to multiple continents and still work seamlessly.

It is not easy. Sometimes it is just easier to stand up everything you have in NA in the EU, and get a new tld (like .eu). It's a mess. Multi-cloud is HARD.

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story.

I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

These types of findings are such bullshit. They use "vulnerable" javascript libraries.

I implore any reader to go out and find a vulnerability of non-P5 severity on 10% of these websites through these "vulnerable libraries".

No it is not at all. This is what the whole debacle was a few months ago when you removed most of the download links from your website.

https://twitter.com/cryptovillage/status/884205077459738624

I'm a bugcrowd customer too, but offering a prize to say you are secure is a fallacy. It's also not how bugbounties work... Example: - https://moxie.org/blog/telegram-crypto-challenge/

The fact remains the same that the things you championed against LastPass doing are now the features and products you are providing.

You guys have already been caught erasing and hiding the previous versions on your site to convert people to 1Password.com.

I don't really care about any of this since but you guys are just not being sincere about the things you're doing. It's kind of sad.

It's both. My guess is the product offering and pricing changes are part of the same push for recurring revenue

Former LastPass employee here. Looks to me like 1Password is going full LastPass. First fully hosted passwords. Now support for extension only (which is way worse security wise).

SaaS margins and recurring revenue is better, and I guess their previous model was killing 1Password.

> This kind of thing doesn't stop people. I think it just means you end up with fewer good products to use.

To be more clear. This won't stop the vast majority of people. They want to use good products. If it's good, they will use it.

That's what people have said about passwords with password managers, private keys with keybase, their servers and legal documents with AWS and docusign, their banking with online banking, etc etc. The list goes on and on.

This kind of thing doesn't stop people. I think it just means you end up with fewer good products to use.

Again, I think this decision has nothing to do with Ransom HPKP and everything to do with how it's not a usable standard, and people who try to use it correctly fail.

I will be VERY upfront that I DO blame Scott Helme for this. I mentioned this in 2/2016 as well[0]

It's fair. There was a lot of buzz about Ransom HPKP. The whole thing was doomed from the start, and I was pretty upset every time I saw anyone publicly push for it.

0: https://twitter.com/ejcx_/status/698227927390023681

I think this has very little to do with you.

Hpkp was championed by a lot of security people, who in turn got a lot of people to foot gun themselves (Scott Helme even admitted that he is oftentimes one of the first people called by people who HPKP foot-gun themselves).

There were only a handful of sites that actually needed HPKP level security, and ransom-hpkp was the least of people's worries. Hpkp was more dangerous to people rolling it out on purpose than it was to mass header injection or similar :/

HPKP has been doomed from the beginning. Here is sleevi saying he regrets it in 2/2016: https://twitter.com/sleevi_/status/696171562383224832

It might have been okay but yeesh I hate that navigation apps do this.

They will randomly reroute you through a labrynth to save you a minute. Happened to me all the time when I lived in Dc/Nova and I learned not to listen to the app