m0nastic

Are technology companies eventually going to become like cell phone companies (or oil companies) where everyone sort of agrees that they all suck, but "oh well, what are you going to do", or will some company become the de-facto "conscientious choice"?

I feel like there's at least a bunch of "companies" on the software side of the equation who I don't feel shitty about supporting, but I think the problem will be with hardware.

I live in DC, and work intel-community adjacent in the infosec industry. I'll stipulate up front that I've never worked as a government employee, and despite doing some assessment work (like being hired to break into the Department of the Interior without their knowledge, or breaking hardware/software that was being deployed in far away places) everywhere I've worked has tried very hard to steer clear of government work (not for any ethical reasons, it just pays much worse than equivalent commercial work, and is almost always boring). In fact, the last two places I worked had distinct government and commercial divisions (where I ran the commercial divisions).

That said, I've built and run several security consulting practices in the DC area, and consequently have done hiring interviews for dozens of people who were NSA employees (1 of which we ended up hiring). Absolutely none of them have even the slightest apprehension about the nature of the work they were doing (so much as they were able to comment about it during interviews).

In fact, prior to the Snowden leaks, the NSA was pretty much at the bottom of my list for government agencies doing shit I disliked. They have a pretty clear scope and charter (which we've come to learn has been muddied).

But no one I've talked to, either who works there or works at a contractor in the DIB, thinks they've done anything wrong. Did you read those batshit NSA talking points that came out yesterday from Al Jazeera's FOIA request? They believe those things.

They think they're doing important, valuable work to protect the country. I can only imagine that internally within NSA there has been dissent about some of the stuff that's come out. Maybe people have resigned over it, maybe they've sent strongly-worded emails to their bosses. I really hope there was a great deal of dissent about the "intentionally fuck up crypto standards that we push to other branches of the government", but I doubt we'll ever hear much about it.

Your questions could just as easily refer to people who work on SEO spam, or targeted advertisements (I'm not saying those things are equivalent, but they're also jobs I've heard people on here posturing morally about).

I have to strongly disagree on that point. I'm certainly not an expert (I hadn't done any meaningful programming in 10 years prior to reading it), and I found Real World Haskell immensely helpful in building a production system that receives and processes security events.

In fact, the chapter on building a Syslog server was incredibly useful, as the first piece of the system I'm building processes events which look a lot like Syslog (with some JSON embedded in the messages).

I will say that I had a hard time getting through the book as my only Haskell book. I ended up using Hutton's "Programming in Haskell" as a supplemental resource (selected mostly because it's a very small book).

One thing I'm curious about (but haven't seen mentioned yet), is whether the bitcoins that were seized were Ulbrichts or "DPR's". That might seem like a silly distinction (as obviously the state is arguing that Ulbrict is DPR), but I can imagine a case where it's actually important.

i.e.: If the FBI identified the bitcoins as part of their efforts investigating DPR, for Ulbrict to claim ownership of them might actually be bad for his defense. On the other hand, if they were seized when he was apprehended (presumably they were stored on his laptop), than I think it becomes much less problematic for him to assert that they are his.

It's not really germane to this discussion; I was just giving an example of the fact that it can be tricky for the government to seize assets in a prosecution (considering the fact that it can be difficult to de-complect where funds come from).

I talked a little bit more about my dad's situation in a comment a while back: http://news.ycombinator.com/item?id=3067094

I'm sympathetic to the idea that "ill-gained funds" shouldn't be accessible to a defendant for their defense; but it does pose some moral problems.

When my dad was indicted by the FBI, part of the process (because he was a fugitive) was for them to seize all his funds. This was personally problematic because his funds were also my mom's funds (due to having a joint account); which left my mom very suddenly with no money, and two children (one of which, me, being a newborn).

I got the distinct impression (which I admit was based on only hearing one side of the story) that the FBI intentionally made life difficult for my mom in an effort to entice her cooperation in locating my dad (ignoring the fact that a husband who flees on the day of his son's birth to avoid prosecution from the FBI isn't necessarily in said wife's good graces).

I don't have a good answer to this problem.

It really depends on what type of security you want to be involved with. If you're interested in appsec (which I think is infinitely more interesting than network security, but obviously, other's opinions will differ), then web security is a good place to start.

I've spent the bulk of my career doing application security work, so I have less advice to give about other aspects of infosec (which like the article says, really is a large field).

But, (and this is fairly generic advice, received from a disembodied pseudonym on the internet) you can do a lot worse than just picking up a copy of the Web Application Hacker's Handbook, download the free version of Burp suite, set up a VM and install some old versions of popular CMS's (or bulletin boards).

EDIT: Here's an old comment by tptacek that recommends something similar for starting out (so at least two people recommend this): http://news.ycombinator.com/item?id=5266939

I don't find a lot of value in CTF's (again, other people obviously feel differently), and I disagree with the other person who recommended you go to Blackhat.

Security conferences can be great, but I wouldn't go to Blackhat as your first (I actually wouldn't go to Blackhat unless your work was sending you, or you're speaking there). You can't throw a rock without hitting ten security conferences nowadays, so I'd start with ones more local to you (which will have the added benefit of having attendees who are also more likely to be local to you).

Based on your HN profile, it looks like you might live in Austin? If so, there are plenty of companies hiring security folks (actually, almost everywhere there is a crazy unmeetable demand for security professionals).

If you're a developer, you've already got an advantage over 95% of the people working in Infosec. That sounds like an exaggeration, but people seem to have a hard time understanding the disconnect from the relatively small "hacker" community and the much much larger corporate world where "senior pen testers" don't know how to do anything above and beyond kicking off a network scan.

I'd like to think that the appsec world is a little more advanced, but I think that's just me rationalizing. The bulk of people doing corporate appsec work (by which I mean consulting) are just running WebInspect (or something equivalent). That's why if you spend any time in the infosec community, you'll hear countless tales about how difficult it is to hire good people.

If you have any specific questions, or just want any advice, feel free to email me (my email is in my HN profile).

I can't speak for anyone else, but when I moved to DC, the regular supermarket options were all terrible (very small, don't carry lots of things I used to be able to get from suburban supermarket's, no parking, awful produce, etc.)

I found Trader Joe's to be a slightly less egregious Whole Foods, so I did most of my shopping there.

What finally wore me out was the fact that I couldn't do "all" of my grocery shopping there (I have no interest in buying hippy toilet paper or hippy soap), so I still had to shop at a "regular" grocery store.

Now, Amazon subscription takes care of most of our household stuff (like paper towels and dishwashing detergent and such), and we get produce delivered weekly by some local green grocer (which I let my girlfriend talk me in to, as left to my own devices I don't really eat produce).

I worked from home exclusively for about 6 years (this year is the first time I've been back working at an office), and admittedly, my work almost never involved other people (except for clients, who are remote even if I was in an office, as the majority of the application testing I've done was remote testing), so I'm certainly outside of their demographic.

But the one thing which just seemed weird to read was that it gives the impression of everyone being constantly chatting and doing video calls at a moment's notice, which seems to run counter to the "give every developer their own office" and create a distraction-free environment for programmers. I think I would feel constantly interrupted working in that environment, which seems counter to Fogcreek's whole persona as a place that's "developer-oriented".

I just searched pgp.mit.edu and it looks like the first key I have on there is from 1998[1] (with several others from previous jobs, although I don't know why I had two keys when I worked at BBN).

I don't think I even have a key for my current email address.

[1] http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x867C6...

In a dozen years, I think I've had a grand total of 4 clients (out of several hundred) that ever used PGP (despite recommending it specifically on project kickoff calls, particularly for communicating discovered vulnerabilities). I only had one who already had a key.

Outside of those few work examples, I don't think I've ever sent or received a PGP encrypted message. In fact, the only signed messages I think I've ever seen were mailing list messages from people who signed all their messages.

I'm happy to see things like this, as the easier it is for folks to use Haskell, the better it is for the platform.

I might try to experiment with some personal projects on it, although unfortunately, I can't use it for any of my actual work.

That's true, but I've spent a good portion of the last year and half dealing with them and disagree on the likelihood of them ever achieving any widespread adoption. My company would love for me to be wrong about this.

My argument isn't that the NSA hasn't backdoored TPM's (which I freely admit I can't convince you of), it's that TPM's are not "The Crown Jewels".

I'm still unclear on the government's ability to compel falsehoods (even the discussions around National Security Letters seem to indicate that they prevent disclosure, but can't require lying), but I don't think I can convince you of that.

When all the hullabaloo around the alleged IPSEC backdoor occurred, it was frustrating to not be able to be as open about it as I wanted (not because of any government/security issues, but because at the time I still worked for the company and we were advised against talking about it).

You are free to assume that even right now as I type this, a shadowy figure in an ill-fitting Brooks Brothers suit is standing over me dictating my responses, and then chastising me for spending my time on HackerNews.

I keep finding myself in the awkward position of trying to refute conspiracy theories, but not being at liberty to share everything I know about these scenarios (I really need to work somewhere besides DC), so I'll tread lightly.

Taking for granted that the NSA actually backdoored TPM's (which I can assert professionally is very unlikely, but I don't expect anyone to take my word for it), they are far from "crown jewels".

The only "meaningful" large scale use of TPMs is actually within the department of defense. It's been a pretty uphill battle getting them deployed and used in other environments.

In that particular instance you weren't wrong[1], but that's the problem when stories like this come out, is that it makes it much harder to know what's a crazy conspiracy theory and what's real.

[1] Those claims made by Greg are completely untrue. I ran the professional services group for that company and will happily attest to whomever asks that at no time did we insert a backdoor (or anything that could even be construed as such) into IPSEC.

I haven't been able to get the site to load, so I'm committing the venial Hacker News sin of commenting without reading the article, but I'm assuming this is somehow "trademark-related".

I don't know what the branding of Hacker Scouts is, movies have always seemed able to skirt the BSA trademark issue by calling themselves things like "Wilderness Scouts", etc. So I'd imagine it would be hard for the BSA to claim ownership of the entire "scouting" landscape.

I assume these people don't have access to the capital necessary to fight this in court, which is a shame.

As an Eagle Scout who has been pretty unhappy with the conduct of the BSA since my teenage years, I would be very happy to see them lose a case like this (although that's easy for me to say, as I'm not on the hook financially for it).

Part of the philosophical justification for the "full-disclosure movement" is the belief that, much like scientific discoveries, they almost never happen in a vacuum by a lone brilliant researcher.

Which is to say, that it is entirely possible (I'm not going to presuppose how likely) that this has been known about for some time, and used for other nefarious purposes in a manner that wasn't so "easily" detected (the existence of a master record of all Bitcoin transactions makes it much more likely for this to be found than people exploiting it in some random app).

It could be that somewhere right now, in dozens of coffee shops throughout Eastern Europe, South America, and Asia, a group of collective hackers, each unaware of the existence of any others, read this blog post and uttered their linguistic equivalent of "Son of a Bitch".

I guess that the reason I've been able to migrate almost entirely to using my iPad for everything must be the way I used to use my computer previously.

I've pretty much always ran applications "full-screen". The only time I really ever have more than one thing on screen at a time is if I'm splitting a tmux window.

I use my iPad how I imagine people use Chromebooks (with the addition of being able to use more than just the web browser).

That makes me wonder if over time tablets will become used for more and more because they increase in functionality/complexity (mimicking how people use their PC's currently), or if they'll remain the way they are, but people will just adopt their usage paradigms.

Thanks, I've been testing out a bunch of hare-brained schemes and it didn't even occur to me to just use HDFS directly (and seeing you and karterk both suggest it helps).

Basically, at a high level, the system I'm working on aggregates and processes security information (It's a SIEM, if that product category means anything to you). At the point the logs get ingested, the server determines if they're "actionable" (which is determined by rules I load into Redis), in which case it parses them and stores them in a Postgres event table; or "not individually actionable, but may cause an action in conjunction with some other log" that I want to just store somewhere for batch processing.

I don't really need to tokenize those logs, as at the point I care about them I'm just going to be searching through them. So, they're "unstructured" in the sense that there's about 15 different collection points, each with it's own format (many just an ugly facsimile of syslog with some JSON in the middle).

So, I think your suggestion will work out very well.

Thanks again.

At the risk of hijacking what seems like a linkbait article, I'll ask folks here a question:

Does anyone have good experiences/recommendations for storing a "reasonable" amount of unstructured logs/pcap files. By "reasonable", I mean, not petabytes (maybe a couple terabytes, over time).

I ask, because I keep thinking something like HBase is overkill (although one of my alternate solutions is to run an internal Openstack Swift cluster, which seems like pretty much the same amount of hardware/engineering).

If I could, I'd just send it to the cloud (to the cloud!), but I need it to be local and internally controlled (however, the developer niceness of S3 or Azure blob storage is what got me thinking about just making my own Swift object store).

This is both awful, somehow unsurprising, and COBOL is a piss poor scapegoat.

I've talked on here in the past about how crazy it is that some of my customers had huge financial systems that were written in COBOL, quietly still plugging away.

The most important of which is a system which processes billions of dollars of transactions a day, and has done so since the early 70's (when they purchased the what was then off-the-shelf software). You can imagine what a maintenance nightmare it must be (both because it's old, very important, and written in a programming language which predates the cotton gin).

Assuming that they can't just rewrite the system (which might be a reality), they can certainly sit down a bunch of developers and have them learn COBOL. COBOL isn't even a particularly difficult language, we were writing pretty decently-sized programs after a few months in high school (and if the system is that old, it's probably not even using any fancy language features).

If only the military had some means by which they could take people without past exposure to some skillset and train them to be competent at that skillset. Maybe part of that training could involve having to climb over a wall, or some sort of rope course.

Do people wonder about why there is no General Motors John Gruber?

Apple has a lot of people who write about them because they check off all of the boxes in the type of person who would write about them. Just having a product (or an ecosystem in the case of Android) doesn't necessitate any of those things.

Apple is appealing to typography people, product design people, elitists and snobs, creative people, "creative" people, etc. A lot of those people are their customers.

They're also a single company, which serves to focus all of that ephemeral chatter into a more palatable narrative.

There are other companies who have a similar level of scuttlebutt about them, but all of the ones I can think of are video game companies (like Bungie, or id software), and it's certainly not to the same scope, even if it's of similar temperament.

I feel like you don't understand what a community is...

Hacker News is an online community. It has a pretty open membership policy, which is that, if you show up here over a period of time, and manage to not get hell-banned, you're a part of the community. Congrats!

Part of being in a community is that it's pretty common to have a kinship with other people in that community. This place isn't a real-life place, so naturally, that kinship might not develop as quickly, or spread as deeply as one might in person. But you'd be surprised that it can still develop.

So, "the vast majority of HN users" might not actually know who raganwald is, but I'd bet they've probably seen at least a few of his comments, at least if they've spent any amount of time here. However, "the vast majority of HN users" aren't actually the community. There's nothing stopping them from being part of it, they just aren't. Which is fine (I don't consider myself to be, for what it's worth).

But when someone who is a part of the community has something good happen to them that's of interest to the community, people share it.

The fact that this story is popular is a triumph of community, not a shitty side-effect of this place not operating the way you wish it did. I hope it continues to feel this way, lest it really turn into a shitty link aggregator that you so wish it were.

In the scenario you describe above, the unencrypted contents of your email are now generally stored on at least 4 machines (maybe 3 depending on what the recipient's POP settings are), with only one most likely being under your control (the client you wrote the mail on).

The benefits of encrypting the message as well as the transport are mostly for dealing with that fact.

"Why server-side development in Javascript? Seems like a headache."

People like to use what they like.

You would then basically have the airport screener version of Antivirus software (signature-based).

I suspect you'd end up having all the same problems that Antivirus software has (basically an arms race, I guess quite literally).

I'll walk back calling it a "textbook example" (because I suppose ultimately it's probably up to the quality of the lawyers involved), but the part of 18 USC 1343 that I think would be argued by the prosecution in the "pastebin cc numbers example" is:

"...or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice..."

I think the government would have a relatively easy time arguing that posting people's credit card information (specifically all the data necessary to make use of that person's funds) is a scheme for "obtaining money or property by means of false or fraudulent pretenses".

The defendant's attorney might argue that just posting the information isn't itself a scheme (in the same way that say, listing the home addresses of members of rival ethnic groups over the radio in Rwanda isn't an incitement to violence), but if I were that defendant, I wouldn't be sleeping easy.

I was referring to tptacek's statement:

"This is, literally, an argument that if you stumble across a text file full of credit card numbers, expiration dates, and CVV codes, it should be lawful for you to put it up on Pastebin."

Which, when carders are caught on forums doing the above, they are charged with wire fraud.

I agree with you completely that I don't think Weev's acts were wire fraud.