jusob

Private disclosures happen well before the presentations.

Not just exercised, but bought before the company reaches $50M in assets.

I've been using sqlite-vec, a module for sqlite3: https://github.com/asg017/sqlite-vec

I use and like http://wintersmith.io/ Very simple to use, enough plugins to cover most use cases.

Borland Delphi - My first programming language. They had a significant discount for students.

Encarta (used) - Never used it much, I got it pretty cheap. I was so impressed by the amount of information available on 1 CD

Corel Suite - Also cheap, I believe it came with WordPerfect

I got something similar: a compressed file with an ISO in it: it was a CD with autorun. I guess some OS will mount it automatically and run the autorun.inf if you double click on it.

Typo: "and support the development of tje project."

A lot of bad arguments against JWT tokens. These items are definitely something you can address with JWT token: * expiration date * invalidation * change of roles or any significant change in user attributes

Moe important, the list of issues would be the same for a session cookie: if you don't expire the session on the back-end or reflect changes in the user attributes, same issue.

Basically, apply the same best practices for session tokens or JWT token and you'll be fine. You can also put the JWT toke in the cookie, it does not have to be stored in the browser local stroage.

If you submit this job description, you would get an RFE (Request For Evidence) to explain why these skilled are requires for the job.

There are 3 ways to intercept HTTPS transparently (without a big SSL warning):

1. Put the intercepting SSL cert root in your local trusted store. This is how it is done in enterprise. The certificate is typically pushed through an MDM installed on each computer/phone. This is also how Fiddler works. This requires administrative access to your device to push the certificate root as trusted.

2. Create a rogue certificate from an existing trusted certificate registrar. This is why is a risk with nations like China where "private" SSL registars mybe forced to issue certificates for Google or other sites to the government. This was supposed to be fixed with Certificate pinning (now deprecated), and now with certificate transparency log. But the later has a few weaknesses in practice: - rarely set as enforced by the websites, or set at at all - requires each company to monitor the transparency log and get rogue certificate canceled. I don't know of any company which actually does that.

3. Interception inside the browser through an extension or plugin, or plain process hijack. Since the browser does the HTTPS encryption/decryption, an application taht runs inside the browser with the right access can see all decrypted traffic.

check out https://blitapp.com/blog/take-screenshots-of-multiple-pages-...

Except there are a lot of ways to change what is taxable in the US: 401h, HSA, FSA, etc.

It's too late, but lot of CS students do 1-2 internships, and often get a full time offer from one of these 2 offers if done 12-18 months ahead of graduation.

I've had a model 3 for 1.5 years, I've never had such issues.

Iit is more and more common for tech companies in Bay Area to have "unlimited" PTO. For me, this translated to 5-6 weeks vacation a year at my last 3 companies.

Good read: Amazon acquired Eero (https://mashable.com/article/amazon-eero-wifi-router-sale/). Employees got nothing, founders and executive got millions. This is not my experience in SV, though.

Here is an hypothetical example of someone who only invested just before a crash in SP 500: https://awealthofcommonsense.com/2014/02/worlds-worst-market...

Spoiler: time in market beats timing the market, historycally.

You still have to pay the $800 to California if you reside there.

I use Pcapr to look for pcaps: https://pcapr.net/home

You count the equity in the house (price of the house - mortgage), which is probably just your down payment right now.

I think net worth is important to calculate your retirement age.

Unable to connect to https://free.cloudbrowser.xyz/

"...spending ... hefty amounts on vacations, entertainment, and a weekly date night". They spend too much money on non-essential, so they don't save enough. Great article! I earn a million dollar a year but spend 2 millions in night clubs, so I am very poor.

My electricity was shut down for 15 hours. There was no wind, no heat and I live in a city. At least in the South Bay, there was no wind at all.

I wanted to share my experience. I was a foreign student doing a Master in the US, with several other schoolmates. 3 of them decided to pursue a PhD after their master. We all understood that a Master is done in 2 years, a PhD in 3 years. So they all completed their PhD in 3 years, not a month more. But I met many students, in the same field, some with the same advisors, who were 5+ years into their PhD with no end in sight. I think a lot of it came from the state of mind. My friends had a very specific time lime to finish their PhD in 3 years and they followed it, pushed their advisors when needed, etc. There was never any doubt that they would be done after 3 years. Whereas others started an open-ended journey with no clear goals.

I was in a company that did Agile well (my first time using it). Team velocity was never used to measure the output of the team, only to better predict how much work we could fit in a sprint. The other big think was that they saw Agile as a framework, each team was free to do a different "implementation" and use different tools. Team velociyy had different units in different team and couldn't be compared.

But any XSS would give access to your authentication token, this is why you should never store it in local storage. Cookies have the httponly flag that prevents javascript from accessing the cookie in case of XSS.

If the company qualifies as Small Business (see QSBS,, Qualified Small Business Shares) at the time you buy your shares (not vest), then there is no federal taxes at all (up to 10 millions).

Yes, last month for example: https://healthitsecurity.com/news/amca-files-chapter-11-afte...

Yet another explanation of CORS.

The basic security in we browsers is based on SoP: Separation of Origins. To simplify, there are number of actions that can be done within an origin (a domain, to simplify) that are prevented across origins (across domains, to simplify). CORS is way for bridge 2 different origins, i.e.e to allow some specific actions between 2 different origins.

One example: by default, XHR requests can only send a specific set of HTTP headers to a different origin. If b.com want to accept the header X-Special-Header from a.com, it has to whitelist it - Access-Control-Allow-Headers: X-Special-Header, Access-Control-Allow-Origin: a.com. On a.com, before the web browser makes an XHR request to b.com that includes the header X-Special-Header, it has to check whether b.com authorizes it or not. I sends an OPTIONS request to b.com and check for the HTTP response headers Access-Control-Allow-Origin and Access-Control-Allow-Headers.

Since CORS is a way to bypass the Separation of Origin basic security model, you should be careful with it. For example, you may allow any site to get read your content, i.e. trigger a CSRF request on behalf of the user logged in to bank.com, and with Javascript be able to read the page content, including the account number because bank.com set the CORS to authorize any remote site to do anything, basically putting bank.com in the same origin as any other domain.

The project started as a 64-bit version for Windows (was supposed to be faster). Then, when Firefox changed the add-on framework, it became the "Firefox" version you can use to keep all your old add-ons working. They are merging all relevant security issues quickly, as well as bug fixes.