ramimac

Cedar | Full Stack, Engineering Manager, Product Security & more | Full-time | REMOTE-friendly! (U.S.) + hybrid/in-office options in NYC, SF & Salt Lake City | https://www.cedar.com/careers/

Cedar is a health-tech and fintech company focused on reimagining how patients engage with the increasingly complicated and expensive healthcare system. Full-time positions are open across multiple teams and tech stacks; many other roles available beyond those listed below. Our tech stack prominently features React, Python, and Django. We are a post-series D company with over $350M raised and growing quickly.

Engineering Manager: https://www.cedar.com/careers/view/?gh_jid=2572428

Full Stack Engineer: https://www.cedar.com/careers/view/?gh_jid=2806490

Solutions Architect: https://www.cedar.com/careers/view/?gh_jid=2554778

Product Security Engineer: https://www.cedar.com/careers/view/?gh_jid=3371538

Please reach out to Sandy (sguan AT cedar.com) or myself (rmccarthy AT cedar.com) with Hacker News in the subject if you'd like to discuss directly!

It sounds like you're thinking of the second-chance queue, which is a very different mechanism than "boost articles": https://news.ycombinator.com/item?id=11662380

Scott Piper is essential reading on this topic: https://twitter.com/0xdabbad00/status/1474176588468031510?s=...

I hope this is a precursor to new Cryptopals challenges!

(In case anyone else was curious - looks like the original authors are currently at Apple, Bridgewater, and Fly.io)

Curious if you'd contradict recent coverage corroborating reports that FB isn't hitting hiring targets? https://www.protocol.com/workplace/facebook-docs-hiring-recr...

Very cool! In case you're not already aware, https://twitter.com/searchbound talks a lot about his experience building ranchwork.com

For you and anyone else in agreement, https://sso.tax/ sounds right up your alley.

Cedar | Security, Full Stack, Tech Lead, Engineering Manager, Product Design, Solutions Engineer & Architect | Full-time & REMOTE | NYC, SF, Salt Lake City | https://www.cedar.com/careers/

Post Series D startup with over $350M raised to date, Cedar is a health-tech company focused on reimagining how patients engage with increasingly complicated healthcare systems. Positions open across multiple teams and tech stacks, please reach out and apply below if interested!

Application Security Engineer(s): https://grnh.se/e66abff01us

Engineering Manager: https://grnh.se/326c1b2f1us

Tech Lead, Platforms: https://grnh.se/1b26f9f71us

Full Stack Engineer: https://grnh.se/ca8f86241us

Solutions Architect: https://grnh.se/c130a2dc1us

Solutions Engineer: https://grnh.se/16dfff0b1us

Product Design: https://grnh.se/c44af7671us

Check out our other openings at https://grnh.se/d747c2f21us!

Happy to answer questions, shoot me an email - I'm a security engineer here.

Rami McCarthy

first initial + last name @cedar.com

Tech stack: React, Python/Django

Disclaimer: Have worked with many smart folks who now work at Zoom.

I agree that Zoom has had numerous security and privacy failings. I think it is important to color the characterization of their security teams with a timeline however.

Looking at that gist - the majority of the content predates the conclusion of the "90 day security plan" [1]. The team, and product no doubt, has changed immensely in the past year. That doesn't wallpaper over the history here, but there is completely different security leadership (e.g the current CISO didn't start until late June 2020 [2]) and staffing in place at this point that means your statements on their team likely aren't reflective of Zoom today.

[1] https://blog.zoom.us/ceo-report-90-days-done-whats-next-for-... [2] https://blog.zoom.us/zoom-hires-jason-lee-as-chief-informati...

This somewhat sounds like https://mubi.com/ or https://www.criterionchannel.com/?

This is exactly the point!

If they actually aren't looking for people who just cram CTCI or leetcode, coming to this answer from first principles is demonstrably far more difficult than you'd expect achieved in an interview.

It's definitely true to say it is framed as foundational in some quarters, however. Consider the common "CISSP required" "entry level" roles that are regularly shared and pilloried

Calling it equivalent to a masters was also a marketing coup, there was plenty of discussion and pushback on that characterization when it was announced

It makes sense (to me) that ransomware isn't mentioned, as this is a checklist of controls - not of threats. Many of these controls do help in preventing ransomware: 2FA, "Backup, test your backups, then backup again", "Isolate assets at the network level", etc.

https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop... is a pretty good primer on spoofing (SPF, DKIM, DMARC)

Unless they're rapidly editing this based on the thread you missed the mention. I currently see "Ensure that your domain names are protected" under "Your company." It doesn't really mention spoofing controls and deliverability, but does talk about registration and hijack prevention!

While I'm generally a fan of the Sqreen checklist that this is built on, looking over it with fresh eyes I have quite a few quibbles:

"Require 2FA wherever possible" - Given the target audience, it would be nice if this was explicit about the reason to use hardware keys (including those builtin to TouchID + chromebooks).

"Accustom your team to locking their computers" - This is good advice, but I'd recommend configuring locking on inactivity a higher leverage effort

"Hire your first security engineer" - "do we have a security roadmap? do we manage to deliver on it?" is not a good heuristic for whether you need a security hire. I'd argue that most startups will lack a formal security roadmap when they don't have dedicated security staff. For example, the linked First Round article [1] has a more actionable recommendation, with justification: "Onboard your first, full-time security hire between 30-100 employees."

"Set up a bug bounty program (NEXT)" and "Monitor your user’s suspicious activities (NEXT)" being placed before "Have a security incident response plan (LATER)"

[1] https://review.firstround.com/how-early-stage-startups-can-e...

Just in case you weren't aware - this Checklist is adapted from the Sqreen SaaS CTO Security Checklist. Sqreen is a RASP that was recently acquired by Datadog. Keep in mind that potential bias before diving in too deep on the sales pitch!

Honestly, I'm sure there are better sources - but this might be worthwhile just for the irony: https://www.tenable.com/blog/why-you-need-to-stop-using-cvss...

It's a hard problem - and depends on your target market. That being said, in my experience most companies with the maturity to go hunting for a tool like this will also have established vendor security requirements. On a baseline "trust" level - having an identity associated with the project beyond a new "brand" can help bridge that gap, especially if there are folks with strong personal reputations attached.

On the product side, https://www.enterpriseready.io/ does a good job breaking down expectations for SaaS (https://www.enterpriseready.io/features/product-security/).

In the long term, you'll find many of the largest possible customers will demand an on-prem option, and/or some level of external attestation (e.g. a pentest, SOC2, etc.)

I acknowledge this is a lot to throw at someone getting a product going, and don't want to be discouraging, but security products have an even larger expectation - especially because I expect your buyer and user personas to be security-centric

Regardless of the tool itself, there is a huge trust barrier to overcome here as a hosted solution for inherently sensitive Incident Response related data. Looking at the site, there is nothing to indicate this would be viable for my organization from a security perspective.

In terms of features/functionality, I could see some synergy with building in IR Tabletop/simulations.

I would highly recommend anyone interested in pentesting smart contracts look at the work Trail of Bits has been putting out: https://blog.trailofbits.com/?s=smart+contract&submit=Search

Start with "246 Findings From our Smart Contract Audits: An Executive Summary" [1]

[1] https://blog.trailofbits.com/2019/08/08/246-findings-from-ou...

Exposing resources to a specific "evil principal" via Endgame would be reasonable in some attack simulations/red team engagements

Slide 62 does present some of that context:

Survey was sent to 25k founders in the MicroConf database, 673 respondents (534 completed the survey)

If you're interested in the security posture here, I saw a good talk on bug-hunting in OpenEMR at BSidesCT last weekend: https://www.youtube.com/watch?v=wSvlhFQzUNg

If that were true, it'd be interesting to see if they push out support for close-captioning. It's an accessibility push, but also would leverage a lot of the same capabilities...

Are you asking from a career or technical perspective?

This report isn't particularly technically complex, a majority of this sort of leaked data is widely available on clearweb forums. The minority requires building relationships and/or paying and/or developing a reputation that gets you access to more exclusive forums or circles. You then have to regularly crawl those forums, and avoid identification of your crawlers (as the more exclusive forums/site watch out for that sort of activity pattern). Then you just index the data and can perform searches or analysis.

https://scylla.sh/ is a free example covering just breach data.

From a career perspective, this is a subset of threat intelligence. The more interesting companies in this space often are leveraging military-style HumInt to gain access to these marketplaces and data, and often have leadership from that sort of military or government background. Most folks I'd assume are just standard engineers however, as a majority of the work is probably not specific to "dark web monitoring for intelligence."

Scott Piper's security maturity roadmap [1] is generally well regarded and outlines some recommendations that I would say are fairly "one-size fits most." AWS also recently released their "Foundational Security Best Practices" in Security Hub. [2]

[1] https://summitroute.com/downloads/aws_security_maturity_road... [2] https://aws.amazon.com/blogs/security/aws-foundational-secur...

What about this implies parallel construction to you? The OGUsers databases (well, actually a couple, they've been hacked multiple times) has been publicly available for a while. Also, the discord chats and Vice article include details on selling accounts with desirable names - even if not explicitly linked to OGUsers (I don't recall off the top of my head if it was called out), you could track hacked accounts, see they were sold or discussed on OGUsers, and then give a look at the DB. That seems an obvious route of investigation to me?

Just for reference, the former example you give is just a bug bounty as far as I can tell.

The discussion of relative merit of bug bounty versus a pentest is well trod ground, so I won't rehash here except to say I would never consider a bug bounty replacement for a pentest, and if you're asked for a pentest report as part of third-party vetting etc. many organizations will be concerned to see a bug bounty program compiled report.

The latter example sounds like https://cobalt.io/. I've seen several reports and all I can say is if I were vetting a third-party or otherwise looking for assurance of security posture I would still want to see a "real" pentest from a reputable firm.