llasram

Sounds like a pretty successful bidirectional filter to me. (As in: you apparently don't want engineers who don't know this detail, and I wouldn't want to work at a company where that kind of trivia is a litmus test.)

This is actually one of the main uses for the ISP/telco product appliance sold by my employer, Damballa. The appliance reports client IPs which appear to be infected with malware to the ISP, who then reports this their affected customers by whatever mechanism the ISP prefers.

This particular DDoS I actually believe is _not_ due to a botnet, or at least believe there is insufficient evidence either way. The attack appears to be using a technique/infrastructure I’ve been passively tracking for nearly a year, wherein the attack DNS requests are spoofed to appear from seemingly-random clients and sent to open recursive DNS servers across the Internet. This makes the attack look like a botnet to superficial analysis on the target side, but this isn’t necessarily the case. In the small amount of time I’ve so-far invested in trying to track down the origin, I have yet to observe generation of the initial query packets.

"In fact, looking at the salary tables, there actually isn’t a level of higher than 5 years."

That seems like it explains the OP's experience right there. Why would honestly senior devs even consider jobs well below their salary range? My shop is almost entirely very senior people with 10-20 years experience, but we pay accordingly.

Two ways: (1) the uploaded information appears to include book licence details; if the book-scanning aspect is true then this amounts to scanning for DRM-stripped or otherwise out-of-licence material. (2) Details are light on the new DRM scheme Adobe introduced in DE3, but some are claiming it to involve requiring always-on network connectivity; if that is true, then this information leak may be linked, or at least may not be blockable w/o also preventing access to DRMed books.

You only need large quantities of pDNS data for the discovery portion. For classification all you need are collections of domains produced by the same algorithm ( which are readily available for the widely-known DGAs.) The domains being NX isn't so much corroboration as fundament -- the NX-producing search over multiple domains is the observable behavioral distinction between AGD vs static C&C discovery.

(I've worked with both Antonakakis and Yadav, and implemented the production version of Damballa's AGD classifier as per Antonakakis).

If the goal is to actually detect DGA activity vs just playing around with data, check out https://www.usenix.org/conference/usenixsecurity12/technical... for a much more effective approach.

The key difference is the use of sets of (NXDomain) domains vs single domains. With a few additonal features, the boost in signal is sufficient to allow classification as individual DGAs with essentially no false positives.

In 2008-2009 I was probably the second biggest commiter to Calibre (still #4 according to github), focusing entirely on the conversion pipeline and format support. I'm still proud of the OEB modeling as some of the finest OO code I've written, or probably will write now that I've moved on to functional.

For everyone complaining about the UI and management functionality, realize that you are not the target audience. Head over to www.mobileread.com, look at the Calibre forum and the praise Kovid gets, and you'll see that he's largely catering directly to what his core users want.

It is interesting that Calibre and mobileread are still around, and relatively little changed. I lost interest and moved on once pretty much every commercially-available e-book became available in EPUB format. What's left is a very, very specialized core of enthusiasts.

I wonder how these rules came to be known as "bots" within Twitter. It has an nice symmetry to it though: use bots to fight bots.

At least one useful take-away: k-modes clustering. I initially thought it was a typo/miscommunication, but the soybean reference seemed bizarrely specific. It apparently actually exists, and is an extension of k-means to categorical data, using Hamming distance instead of Euclidean distance.

Damballa - Atlanta, GA, USA (local preferred, but remote OK)

Damballa is looking for top-notch developers and scientists to join our Research and Development Team. You would be part of the team responsible for masterminding the core technologies of Damballa's products – working on advanced pattern detection algorithms, massive data collection and analysis solutions, prototyping new detection systems, and advancing large-scale applications that deliver actionable threat intelligence.

A typical day might involve writing a Hadoop job in Clojure using Cascalog or using Ruby to drive automated data processing tasks to deliver new data to our customers. You will be involved with experimentation, development and deployment, so a passion for understanding our complete technology stack is necessary.

No prior security experience is necessary, just an interest in the field. Damballa specializes in analysis of network traffic, so a familiarity with DNS, HTTP and other forms of network communications technologies is beneficial.

More details at https://www.damballa.com/company/employment

Jeremy Kun's "Math ∩ Programming" blog has two great primers on probability theory:

http://jeremykun.com/2013/01/04/probability-theory-a-primer/

http://jeremykun.com/2013/03/28/conditional-partitioned-prob...

His next post in the series is supposed to be on Bayes' theorem.

For something even simpler, check out redenv -- https://github.com/damballa/redenv . It tries to provide something which works more like Python's virtualenv, just doing the minimum necessary to setup an environment referencing a particular system-provided Ruby installation, but with an isolated gemset.

With these sorts of academic benchmarks I frequently find myself questioning what exactly got tested. The researchers obviously know what they're doing, but that doesn't make them experts on all of the technologies under test. Their description of their HBase configuration in particular leaves me skeptical of how closely it reflects a well-tuned production setup. I think publishing the actual configuration files they used for each technology would be a big help.

If this is actually true, I think it gets called "corruption" here too. Biden may not have received monetary compensation, but if this is what happened, Dodd owes him a hell of a favor.

I wonder what the Go list would look like. US-only, probably somewhat random and maybe even obfuscating, but world-wide is a far more popular game.