marcinw

(I am one of the developers of Doorman). Some background, from osquery's site: "osquery allows you to easily ask questions about your Linux, Windows, and OS X infrastructure. Whether your goal is intrusion detection, infrastructure reliability, or compliance, osquery gives you the ability to empower and inform a broad set of organizations within your company."

I wrote Doorman as a way of utilizing osquery's TLS remoting endpoints, allowing me to dynamically configure an endpoint with custom queries, as well as run ad-hoc queries. We use osquery and Doorman at my company to gain visibility into our laptops in a manner many remote control based applications don't provide. Besides gaining remote administration functionality to osquery, we developed Doorman with a security-first attitude. We favor tools like osquery that don't expose remote command and control capabilities over tools like Chef or Puppet that concentrates super powers in the hands of a few people.

One of the stronger points of Doorman is it's builtin rules and alerting engine. It is one of the few security tools that I honestly can say I "set and forget" with respects to the rules we write. Want to know every time someone installs a new Chrome extension? All listening sockets on external interfaces, and the process name and user/group its owned by? New root certificate authorities added to the keychain? Done, all thanks to osquery introspection capabilities coupled with Doorman.

Proper Python would use the csv module for this operation, as your CSV export would break if `header` or `dataset[key]` contains a comma.

Matt Levine sheds more light on this story[1], backed by evidence whereas the NYTimes is just hearsay. Why would Barclay's screw over institutional investors who account for a large majority of their $4 billion in revenue for HFT who bring in only $3 million? Because without HFT (which is a bad, bad word to the ATG's ears), nobody would be trading on it, and nobody wants to admit that. It just doesn't make sense.

[1] http://www.bloombergview.com/articles/2014-06-26/barclays-no...

In addition to SQL injection, many "advanced search" engines will compile regular expression patterns from user input. Depending on the language, this can range from a simple Regex DoS to Code Execution (I'm looking at you PHP).

Right, like getting access to the DOM was ever a hard thing to do. I was specifically referring to web apps in that point, but because you insist, I'll just reference [1].

Another vector to get rogue JS into a user's browser is cache-poisoning, something the article also brings up.

[1] http://media.blackhat.com/bh-us-12/Briefings/Osborn/BH_US_12...

Java, Python, etc don't have a DOM to consider.

When you're just an XSS away from an attacker doing:

  function encrypt(plaintext) {
    $.post(plaintext, ...);
    return plaintext;
  }

then you lose. The post talks about this, and XSS isn't the only way either.

And that's your problem. I was the same way, though I live in NYC. With every pay raise I upgraded my lifestyle. Whether I was making $50k/year or $100k/year, I wasn't saving anything more besides the shit I was contributing to my 401k. My savings actually grew smaller over the years, until I made a conscious effort to save money. An effort so simple, I kick myself for not realizing it sooner.

Several simple ways I found to save money living in NYC (not SF, but close enough). Note these figures are on a per-year basis.

  - Scrap web hosting, move to AWS and S3 (~120 saved)
  - Get rid of cable, stick with cheap Internet (~1000 saved, Internet ~40/mo)
  - One night less at the bar each week (~2500 saved, that's just for a $40 tab)
  - Skip buying coffee every day (~500 saved)
  - Get a cheaper phone package (~120 saved)

In the end, I think a good rule of thumb is to keep your daily expenses under $20. You want to dress well? Wait for Banana Republic to have a 40% off everything sale, and buy clothes then. Buy clothes you're actually going to wear more than once (this is easy for guys, women have it harder).

I don't know your lifestyle or actually care what you spend money on, but complaining you can't save money is a bullshit excuse. I was bullshitting myself too, and I think everyone's got spending habits they can curb without impacting their lifestyle.

Quitting social networks and using Tor and PGP isn't going to protect you from a nation-state intelligence agency. To suggest so is laughable and naive. We're not even at amateur hour yet.

You're better off reading Grugq's post[1] on developing good OPSEC, and even then you're far and away from it.

[1] http://grugq.github.io/blog/2013/06/14/you-cant-get-there-fr...

I hear people say all the time they drink a lot of water, but when you ask them to measure it out, it's a joke.

The answer to this problem is to sit at your desk with a gallon of water. You'll find you've finished at least 3/4 before the end of the day contrast to the 2-3 cups you'd usually drink.

We've solved this in the Matasano NYC office by:

* Going downstairs for coffee

* Playing a round or two of darts

When I worked in machining, we all had anti-fatigue mats at our stations. Everyone wore Red Wing boots (sneakers are terrible for you), and I heard no complaints of foot pain.

For one, a built-in theme editor that exposes you to remote command execution in the presence of another vulnerability, such as cross-site scripting (XSS).

We're working on it, but you can expect to start them this evening.

Neils Ferguson, et. al of Cryptography Engineering (p. 95) suggest that truncating a HMAC-SHA-256 to 128 bits should be safe, given current knowledge in the field.

When it comes to the social stigma of taking a nap at work, just ask if they'd prefer you take a smoke break every hour. Usually, people will get the hint. If not, too bad.

Am I only the person ever to like Load? I know it's not their best, but I still enjoyed it.

Hmm, where to even begin....

I take it you've never ridden the subway.

-I is an HTTP HEAD request (which may return a different response code than a traditional GET). To print the headers in any kind of request, use lowercase -i.

Wow, 61% of websites that responded with an Access-Control-Allow-Origin header had a value set to "*". This allows for the website to be access in a cross-domain manner (think XSS, global wild cards in crossdomain.xml, etc).

I'm worried to think how site operators will adopt CSP (Content Security Policy) once it starts to gain traction.

That's the trick. I find having a coffee and then closing my eyes for 15 minutes leaves me more relaxed yet full of so much more energy than before to take me through the rest of the day.

There's plenty of those to go around...

I must admit, as an American male, a little older than you, my score was also so low, I'm too embarrassed to even mention. All those years of cheating on vocabulary tests (merely by memorizing the words 5 minutes prior to taking the test) in high school did not help. It's one of the those things I look back on in life and regret. Does anyone have any suggestions on ways to catch up ?

edit: forgot to mention, while I am a native English speaker, both my parents tend to speak Polish most of the time, while I always reply in English. I have to wonder how much this had an affect on me.

Accept header is all but useless these days. Servers rarely look at the Accept header that is sent with the request, and browsers can rarely know ahead of time what type of content to expect when merely clicking on a URL. Check out this blog post by Eric Law on IE and the Accept Header (http://blogs.msdn.com/b/ieinternals/archive/2009/07/01/ie-an...)

Carriers of today hold 90 aircraft, 2 RAMs, 3 Phalanxs and 2 Sea Sparrow launchers (specs from Wikipedia page on George H.W. Bush aircraft carrier). I'm pretty sure with all this they can defend themselves pretty well.

I'm semi-alright with them moving towards four commercials per hour (every 20 min would be better). One thing I hope they do not do, as other stations have done, is place those ridiculous promotions (often for other shows) in the bottom corners of the screen, covering vital information such as a interviewee's name, location, and other text, etc.

How many of you treat conferences as mini-vacations? I find that in my field, going to a couple conferences throughout the year makes up for a couple days of vacation, as long as I don't have any work on my plate.

Also, I find that being single and having friends that (on the majority), make less than I do, makes it difficult to plan trips to places you'd have to fly/rent a hotel for. Trips consist of ten friends carpooling, getting a group rate at a ski resort, and renting out a condo for next to nothing for a weekend.

No, "someone who creates web apps" is a web application developer.

Mike Rowe is also an Eagle Scout if that matters anymore to you.

I remember working with several of the Parallax PINK modules back in the day as well. http://www.parallax.com/Store/Accessories/CommunicationRF/ta...

If memory serves me correctly, some peers at my university had wrote a web interface to control the lights on the Christmas Tree in the commons area.

Not to mention, government TLA's do their own "research."