eyeareque

I agree most small time companies would not spend an extra price for a library. Even though doing so would make sense based on the financial risk you take by utilizing a free option.

With that said, major vendors who sell very expensive gear that use open source libraries like OpenSSL could afford to pay a license fee per device, and then pass that price on to their enterprise customers. An enterprise customer would gladly pay an extra 500-1000 dollars for a stable SSL/TLS library if it meant they wouldn't have to upgrade their devices every ~8 weeks due to OpenSSL bugs. Its cheaper to pay for a more stable/secure library (if one exists) than to upgrade mission critical devices so often (or worse, get hacked).

One thing you can say is that a bank has a lot to lose--they'll invest in whatever it takes to secure their networks and devices.

It was posted on many sites, that was the first hit from a search query. I know.

http://mashable.com/2014/04/09/heartbleed-bug-websites-affec... scroll to the banks section, you can see that many of them weren't affected. I've looked around online to see what they use, but it doesn't seem to be posted anywhere.

My first question was serious--If there is a secure and reliable commercial ssl library out there, I know people would pay for it. No one wants to deal with these reoccurring OpenSSL issues while they work to clean up their code.

Really? What library did they use?

Ref: http://www.gospelherald.com/articles/50890/20140414/heart-bl...

Many banks weren't vulnerable to heartbleed (they use BSAFE I've heard).

what is safer: Running backdoor'ed RSA bsafe (http://www.theverge.com/2013/12/20/5231006/nsa-paid-10-milli...) or OpenSSL? Serious question.

Probably not. It sounds (and looks) like they had bad security practices.

The screen shots of the email showed they didn't use pgp it seems. Whoops.

Time to break out the popcorn.

Now I don't feel so out of touch for not using last pass. It always seemed like a bad idea to put all of your trust in a single point.

I've heard that it's not uncommon to have to interview twice before getting in to Google.

Let's hope he makes a product that google wants at some point and then pays him millions (or more) for it. (like whatsapp and facebook).

A major problem I see with H1-B workers is that they are basically held captive by their employment. If they are let go they'll either have to find another H1-B role at a different company or they will be sent back to their home country. This control companies have over them basically will cause a foreigner to work harder, accept less pay, and also refrain from making complaints against their employers. It's no wonder that US companies like Disney and others abuse the H1-B system.

There is a lot you can get wrong when using PGP. A single mistake can cause you to be in a load of trouble.

I can't wait for the day when we have something extremely secure, simpler, and easier to use that has wide adoption.

This made me laugh--I wonder how many innocent people are going to have the FBI kick their doors down for things that past through their "exit nodes" that they hosted.

You could ask--but you have to understand that small teams thrive from working in the same space as it gives easier collaboration. Also, Hallway and lunch conversations are pretty impactful. But, I think this shouldn't stop you from applying, if you can contribute significantly while working remote, go for it.

I personally liked the "not really benefits" section :)

Samy is the man. Such a cool, low cost technique that can be used and built on for cracking many other combo locks as well. Nice work.

So much marketing. It's sort of hard to take these companies seriously.

Couldn't you just disable the floppy device in the vm?

Link to said youtube series?

I wonder if this will have an affect on the 100 mile border zone (constitution free zone) One can hope:

https://www.aclu.org/know-your-rights-governments-100-mile-b...

Sounds like a cool app, and something I've been looking for. I guess Google ate it so I'll never get to use it. Too bad. Congrats to the people behind the app though.

Sounds like a great trip.

But did you ever get sick from the street food? :) I'm not that adventurous I guess.

Are there any details on when Quantum Insert started to be used by the gov? I wonder if the government built it off of the idea shared here: http://www.willhackforsushi.com/presentations/PenTest_Perfec... (See slide 11-14) These slides describe the wifi tool called AirCSRF, which does basically the same attack, but over open wifi.

This is a whole lot of FUD coming from this company. Obviously it's a marketing ploy for attention. They should have waited to go public after Apple made a fix. By pre announcing the existence of the flaw they've helped miscreants point their fuzzers at a target, potentially putting users at risk.

They are very strict inside of the room to ban all forms of recording or picture taking. Probably for legal reasoning (my guess) so I don't think you'll find any.

His social engineering contest at defcon is always awesome to watch. It's incredible to see the big companies give out such internal information. The social engineer is inside of a glass protected booth and the crowd can watch and listen in. They have a points system where the harder to get info gets you a higher score. Ex: a high score was given if you could get them to hit social-engineer.org from their browser. One guy told the person on the other side of the phone that it was a social network for engineers. Also: Make sure To check out the contest on Friday/thurs as they can't really do the live over the phone hacking on Saturday/sun as most businesses are closed on the weekends.

What is your start up? If you can live off of 200 a month and be fine, there might be someone who believes in your idea and will send you 200/month.

I'm not familiar with AWS, but wouldn't a Cavium based card make this a lot easier for Netflix?

Cheap SOHO routers: Sadly, you get what you pay for.

They were bothered that their "stingray" like devices could not capture the messages. But fear not, they can still get it from Prism or Xkeyscore (or whatever they call it).

It's a pain but it sounds like you need to cancel your credit card. Or you can wait and see if this post gets any attention. Obviously they have a gap in their authentication that they need to address.