m0nastic

Wire fraud, for one. That's pretty much a textbook example of it.

I can at least entertain the argument about being pro-bank, and pro-totalitarian; but tptacek has gone too far in believing that anti-humans should have rights!

Where does it end? If you recognize anti-human's rights, then they'll want to get anti-human married, and what happens if an anti-human wants to marry a human? A catastrophic release of kinetic energy, that's what.

We need to avoid this slippery slope! It's Protons and Electrons, not AntiProtons and Positrons! (I'll be Kickstarting bumper stickers for the cause later this week).

I have a soft spot for interactive fiction. The only game I ever finished writing was an IF game that took place on my college campus (I created it using AGT[1], and was impressed that I could keep track of time to have locations behave differently when visited.)

I was super proud of myself for about a half a day before my roommate showed me that he had created our dorm as a level in Duke Nukem 3D, which proceeded to occupy all of us over a local IPX network for weeks.

It seems like smartphones and tablets definitely represent an opportunity for a resurgence, You could even utilize the platforms built-in text-to-speech and whatnot.

[1] http://en.wikipedia.org/wiki/Adventure_Game_Toolkit

I just hope (selfishly) that this doesn't impact their release of the Digitizer (which I'm currently super excited about).

I did not; which I actually think is even more of a testament to how positive the experience (and interviewing with Cody in particular) was.

I just want to echo the sentiment that Cody is a great person to be offering this.

I had the experience of being interviewed by him a while back, and he made what could easily have been a very intimidating (especially as it was a long interview in a series of long interviews) technical interview both immensely enjoyable (by the end it felt like being part of an exciting conversation), and actually went out of his way to explain a bunch of stuff to me.

I wish there were more things like this.

The Apple documentation on Quartz 2d is pretty good (although depending on how familiar you are with the rest of the system, you might need to follow some of the links to read about the other parts):

https://developer.apple.com/library/mac/#documentation/Graph...

That's suggesting that they have even the slightest compulsion to not be hypocritical. I'd expect them to hit him hard on this (and good for them, even if their reasons for doing so might be dishonest).

People's answers to whether or not you need to learn CS fundamentals have a habit of being self-rationalizations, so be careful with what advice you take (I say as I'm about to give advice).

How useful things are in "the real world" varies greatly. The consensus seems to be that a lot of people say they go through their whole careers without ever using any of the things you learn in CS (for example, you'll hear a lot of "I've not once ever had to implement quicksort"). I don't doubt that these people are correct, it seems pretty apparent that you can certainly have a go at being a developer without knowing all the fundamental theory.

Some people seem to take this as a point of pride, however; like knowing those things would be a drag and a waste of time. I find this attitude perplexing, although I'll admit that it might just be a flaw in my wiring.

I want to know EVERYTHING. Literally, I want to know everything. This can't happen, obviously (both for reasons around the limits of time, and also my intellectual failings), so I try and prioritize.

If you decide that you really do want to learn all the fundamental stuff, I'm sure people will suggest all sorts of ways that they've been able to do so. Pick and chose the things that people say that seem appropriate to your case, but obviously, everyone learns things differently, so don't expect there to be a good foolproof path you can take.

What I've been doing (and keep in mind, I'm an idiot, although I hope slightly less of one every day), is really a brute-force approach.

First, I looked at the curriculum at a bunch of well-regarded CS undergraduate programs (I picked MIT and Stanford, mostly because in addition to being pretty well-regarded, both have a lot of material online). I looked at what their early intro CS classes looked like, what books they used, what the lectures looked like, etc.

For books and topics which overlap between schools, that's an easy choice as to what materials to use (for instance, it seems like almost everyone uses CLRS for algorithms, so you can pick that one and at least feel comfort knowing you're in good company. I actually used CLRS in school, so this second time around I picked up Skiena's algorithms book ((mentioned effusively by tptacek on here a number of times)) and have been going through that.

If you literally just pick out the books from the undergrad classes at a couple of good CS schools and read them completely (and do all the exercises), you'll be a good part of the way there. That's not to say you get the same experience as being there (you don't), but presumably taking four years to go enroll in an undergrad program isn't on the table as an option, so you're making due the best you can.

And yes, the real knowledge will come from actually using the stuff you learn in the books, so the whole time, be writing programs ("ABC"...Always Be...Computing).

After the third or fourth "level" of classes, is usually the time in undergrad where you then start to specialize. After the core curriculum, you'll find that not everyone takes every class, you just have some number of classes from the "CS bucket" that you have to take, and you pick from it based on schedule and interest. Here is where you have an advantage over people actually in school, however. You don't also have to be taking philosophy (although maybe you should, again, in my case I want to know everything, of which philosophy is a definite subset), so you can spend as much time learning as many things as you want.

Want to learn about compilers? Read a book and build the projects. Graphics? Networking, Functional programming (assuming the intro books were predominantly imperative), whatever you want.

Basically, learn as much and from as many topics as you want to.

That won't help you in the short term ace programming job interview questions (and to be honest, I'm not sure if anything can really be that helpful as a short-term solution).

Again, I want to reiterate, you can have a long and successful career as a software developer doing none of these things, but the one thing I'd say is that once you do have a good grasp of actual CS fundamentals, you'll probably be surprised by how much easier it is to solve problems. Not that those problems are unsolvable without it, but that they are much more easily solved (and in some cases able to be avoided completely).

I know that people complain about Wolfram when his posts show up here (which I understand, even if I've always found his bizarre combination of eccentricity and stupendous ego endearing), I thought this was super interesting.

Surprisingly, I think he only mentions NKS once in this whole entry, and it includes a nice shout-out to Rob Pike.

There are certainly careers in which getting started at age 30 is unlikely to bring success (gymnast, child actor), but computer science/engineering is most certainly not one of them.

You may find that when you get out of school, you don't find a lot of resonance interviewing with 20-something year olds at startups, but contrary to what it seems like here, those people are the vast minority.

It's also entirely possible that after finishing up a degree in CS you find that you don't want to actually work as a professional programmer. That's also fine (it's hard to tell what you might still find interesting in 4 years, and hopefully a big part of your education will be in gaining exposure to things you might not have otherwise thought about).

I'd say if you find CS interesting, and have the ability to pursue a CS education (which not everyone does), than go for it.

1.) Twitter is also asymmetric

2.) I'm pretty sure that what seemed like a good third of the sixties Batman TV show episodes involved Batman showing up to the Bat Signal only to have it have been a trap. (and yes, I consider the TV show to be the canonical Batman).

Make no mistake, you are here commenting in an elite forum of digital movers and shakers. If that idea makes you laugh, then just think what that says about CNN's sources for other subjects.

I don't have any kind of knack for predicting things, but I'd argue that it's at least as likely for the "Star Trek computer" to be what things like Google Now turn into (which as far as I can tell, isn't open source at all).

I would be very surprised if the aggregation of technology required for this type of interface doesn't require a company with a lot of services know-how to champion (I could see Apple, for instance trying to go down that path, but I don't think they've ever shown any aptitude for online services).

Maybe after someone makes it, a shitty, open-source knockoff will show up; but I don't think what's laid out in this article is a foregone conclusion.

It might just be my OCD showing, but 'clear' is my number one by an order of magnitude.

next 20:

  177 ls
  167 cd
  122 brew
  120 vim
  119 cabal
  117 cindy (an alias for ssh'ing to my local dev box)
  115 sudo
  114 tmux
  111 man
  110 less
  110 openssl
  109 rm
  108 whois
  107 ghci
  107 lein
  106 ssh
   86 strings
   75 smbclient
   75 racket
   65 nc

At the risk of being tautological, I think it's chilling because if he told the 10 girls he "doxed" about what he had done, I'm pretty confident a sizeable number of them would have the chills.

People don't like to feel like they're being taken advantage of, which would be a pretty common reaction to finding out someone had done all of this profiling on you to get you to go out with them.

It's not outright nefarious, because, what is he really doing that's different from a dating site filtering results by your criteria; except that these aren't people who have joined a dating site.

This sounds like the kind of thing Tim Ferris would recommend doing; asymmetrical information warfare in the battle of the sexes.

In our copyright class in school, we were taught that photographers do give up copyright in the specific case of work-for-hire (with all the criteria for determining work-for-hire that entails; a la CCNV vs Reid).

I've certainly had to get "work-for-hire" verbiage stricken from client contracts, but I'd love to be wrong about that.

As far as I'm aware though, except for that, copyright is granted to the "artist" who created the work[1].

[1] With one famous exception: http://www.techdirt.com/articles/20110713/11244515079/can-we...

I've been a security consultant for ~13 years or so (predominantly application focused), and I'd say that all other things being equal, a good portion of it is web apps.

That's mostly just an artifact of the fact that so much software over the past ten years is web-based. I'd say maybe 80% of the client work I've done has been web-based (with maybe 10-15% non-web application, and the remainder network stuff).

But it's not the same everywhere. I would posit that one of the differentiators is the size of the company (i.e.: bigger security firms probably do more web-based stuff than more boutique places, mostly due to the clients that big firms service).

At the last place I worked, I ran a 10-person consulting division, and it was maybe 50/50 web app/non web-app testing. We were eventually acquired by a giant telco (two actually), and fast-forward a couple years, and the now 200-person consulting division is mostly doing PCI-related web-app testing (I have since left, although I think I stayed longer than I should have).

The larger the company, the larger your clients (generally), and the less agility of your sales process (ie: sales people tend to have a much easier time selling web application testing, as there is a huge number of clients who need it, and it's easy to put together statements of work around it).

So my advice, if you're interested in the more interesting types of security work, is to look for a small-to-medium-sized place. Actually, regardless of the type of security work you're interested in, I'd recommend a smaller firm. I've worked at enough of both to think that there's a certain size (either of head count or revenue) where you start to do less interesting work.

Dan is characterizing Rubin's position around security as non-inclusive. Not that "nothing was secure", but that any feature (X) that was prioritized was done so not just without taking security into account, but with a belief that security was at odds with said feature (for all examples of X).

Basically, in a bastardized form of the "Good, Fast, Cheap. Pick two."

I don't know who was the responsible party for Android's terrible security track record, but Dan knows a lot more about mobile security than I do, so I'm hesitant to say he's slandering anybody.

This is a nice effort. I'm probably in the tiny majority of people who have been using Vim for ~15 years but have never bothered with any customization or plugins (I'm also a philistine who uses the arrow keys for navigation).

Yeah, Gui-less was an option on Server 2008, but not the default. The default for 2012 is what they call "server core" (no GUI, no desktop services).

I was surprised when I took a look at Windows Server recently. I'd sort of mentally written it off a decade ago, but Microsoft has done a commendable amount of work in improving it.

Again, I don't think there's anything about it that I'd tell current Linux admins to swap out their servers for (even ignoring the license costs), but they've improved Windows Server enough that I no longer recommend that existing folks abandon it.

Also, for what it's worth, Powershell is quite possibly the best thing Microsoft has come up with in 20 years. Yes, it's embarrassing that it took that long to get Windows command-line administration to what Unix people have been doing since the 70's, but they've implemented it in a genuinely smart way.

That's not really true. The current version of Windows Server by default has no GUI (and almost no services). It's configured completely from the command line (or if you follow Microsoft's guidance, remotely via powershell remoting).

I certainly wouldn't recommend any shops currently using Linux servers to switch them out, but Windows Server has come a ridiculously long way from being super sucky to being a good server operating system.

I can also confirm that Raytheon is building up this capability (although less so than Northrop and Lockheed).

If you're curious what companies are actually committing to vulnerability dev you can search any cleared jobs site for "offensive"; the companies that have listings are who you'd imagine them to be (minus a couple placement firms that just put people right at the Fort).

The idea with homomorphic encryption is that you can have the host perform computation against the cyphertext without decrypting it. They've gotten this to work, but it's still much too slow to be of practical value. It'll get faster naturally though, even if they don't actually refine the algorithms.

From what I can gather from this link they are just concentrating on encrypting the data stored in something like S3, and having an application that you've developed handle the decryption/encryption.

Thomson Reuters, the parent company of Westlaw (the contractor who presently has the contract in DC)

There's a lot of information about Lockheed's implementation (search for Lockheed Kill Chain presentation), but here's a specific presentation they gave at black hat:

https://media.blackhat.com/bh-us-12/Briefings/Flynn/bh-us-12...

The high-level takeaway is that they developed a response methodology (modeled after a military killchain) that breaks up an attack into different phases, and they then have protection (and more importantly, detection) processes in place for each phase.

The idea is that for an attack to be successful (ie: data is exfiltrated, which is predominantly the type of attack they are concerned with) that doesn't just magically happen. Each phase of the kill chain has to be bypassed, so you have multiple places to detect (and hopefully prevent) it.

You also have the benefit of asymmetrical information, which is to say, that when you stop an attack inside the kill chain, you have all the information that got them to that point, whereas they don't necessarily know why the attack was unsuccessful. That allows you to build a knowledge base specific to the attacker so that future attacks can be stopped earlier on in the process.

Lockheed's kill chain implementation (and ours as well) is lacking the last phase of response that is present in the military one (mainly: they can launch a missile strike or send tanks, whereas we are obviously slightly more limited in our response).

Basically, this process came about as a reaction to reality of the defense situation (which is that for all intents and purposes you can't actually stop them from getting into the network, you have to have a response plan to mitigate attack success that includes your systems getting compromised).

You don't (for the most part). You'd actually sell it to one of about a dozen small firms around the beltway who purchase vulnerabilities (who in turn either license "exploit-packs" to the government, or who work on specific tactical campaigns using said exploits).

That's good to know actually; I think that'll probably be a good approach for my application.

For what it's worth, it was seeing a video of you giving a talk about Titan that made me start looking into it. It seems super neat.

I'm currently playing around with it for a large internal development project. My only concern (and why I'm leaning towards using Neo4j at least initially) is that I don't really yet have a good indication if I'm going to be dealing with enough data to warrant a big distributed solution.

I'm actually right now mostly messing with TinkerGraph (an in memory graph database that's part of the Tinkerpop utilities that the Titan guys make).

It's lyrics from a Clash song (technically a reggae song they covered, but most people associate it with them). It's about the police misusing their power.