rmac

... and safari

Kimono had a beautiful chrome extension which allowed me to easily extract things quickly without needing to write any selectors / scraping. Much love to this team; best of luck!

this is great!

sadly all the cool fraud api stuff can only be used by issuers (e.g., banks) in production :(

I couldn't find language that states the fed has to share data back with private entities. I did see provisions allowing the fed to share submitted data with other federal agencies and even some health care operators.

Where does it state that private cos get access to this data?

So is there room to build products to help facilitate the sharing of data as mandated in CISA?

Is there a standard or format for how the government will expect this threat data to be packaged? STIX / TAXII?

Startups; assemble!

chromeos

tldr:

1) LTE uses broadcast messages to do push notifications. These are unencrypted and unauthenticated. Researchers can trigger them silently by spamming you on Facebook, and triangulate your location since the LTE network only sends the pages to the geographic location you are in.

2) LTE supports crash reports that can potentially include your GPS coords. A rouge base station can request these from your phone without setting up an encrypted channel due to shitty baseband implementations.

3) something about denial of service

the excellent paper is here: http://arxiv.org/pdf/1510.07563v1.pdf

The information us excellent for a someone like .e who knows nothing about M&A. However the consipra t theory undertones were perhaps a little too cute; they insinuate that dell colluded with emc to structure the original VMware deal so it would enable a future mega-merger. It does make for good reading...

Using the venmo api you can get an entire friends list of any user, all you need is their ID.

I was hoping this demo would have crawled all of venmo but it looks like it is querying the api in real time. Mine only got to 3 degrees

I wonder how common it is for malware to obfuscate later stage payloads?

If I hide my executables inside an image (or zip, pdf, docx) and download them with URLDownloadToFile, will this evade detection?

As a long time user of googles web based terminal (accessed normally through google cloud platform console by listing your VMs and clicking the SSH button):

I love it because I don't need to worry about key management and can access my machines anywhere that has a browser.

However, my few gripes are:

1)when copying text out of the web terminal window that spans multiple lines (on Mac osx chrome), newlines are inserted.

2) ctrl v doesn't work (nano/pico)

3) Ctrl c sometimes doesn't work

Why is ARM interesting? Running android natively is one of the few things I can come up with...

We started out with the idea that companies don't want to manage these devices (fortinet, dell, etc), and designed a new IDS from the ground up with this is mind.

Its too hard to find good security people to do low end triage and analysis and the products mentioned above weren't designed to be cloud managed.

We employ good security people who review alerts across our entire infrastructure, so we get better as we grow.

We're starting out with something that resembles a managed IDS/IPS but built with the things I wanted after building an IPS product @symantec. Better search, cloud managed, and tuned / triaged / and alayzed by our analysts.

Right now its built on-top of Bro and using tech from Gravitational (www.gravitational.com)

Founder here; happy to answer questions about how this works. Reach out to ryan@traversalnetworks.com if you want to chat privately.

As a novice mobile engineer I might go to stack overflow to see how to implement things like exception handling, caching, etc.

I'd like to know the best way to do these things, given your corpus of data. Decompile snippets of code from the most popular mobile apps and show me how they do all these things that everyone has to do.

you've essentially described what google is trying to do with gnubby/u2f, now hamstrung by FIDO and converging UAF standards. If you are interested a high level explanation is here: https://docs.google.com/presentation/d/16mB3Nptab1i4-IlFbn6v...

the idea being you mint a new keypair per service and the private keys are stored securely on your device (currently yubikeys but soon all devices will have a secure way to store key material (e.g., secure enclave, TEE, secure elements)), public keys get stored on the service you want to authenticate against.

the rumor is a bluetooth dongle will come out before year end...

It's only supported in chrome, with other browser support at least 6 months away (guess). After getting a test webapp to work with u2f tokens on chrome I wouldn't say it's easy. YMMV.

You need to include this js: https://demo.yubico.com/js/u2f-api.js

... which isn't really mentioned anywhere. That js file loads an embedded chrome extension and handles all the heavy lifting.

The documentation (if there is any?) fails to mention that your appId has to be https; any http appIds will fail with an obscure error.

Can you elaborate on 'authentication time made it totally impractical' ?

Does this mean it was slow? I'm using gpg-agent on osx with a neo-n to ssh into boxes and it's not noticeably slow.

Insecure enterprise software and poor security practices mean death to firewalls and to vpns will take a long, long time. People hide behind these things for a reason.

Google is right here though, this makes things easier for employees and probably saves them money (no vpn); unfortunately most orgs don't have the staff/expertise to pull something like this off.

More importantly though, I think google builds all their enterprise web apps in-house (speculating). Most orgs who do have intranet apps use 3rd party off the shelf software so pulling off Google's BeyondCorp architecture is less likely as they can't control or easily modify how they work. Ergo, VPNs are here to stay.

Even for those orgs who write their own internal applications: do you really want to expose your internal analytics dashboard to the internet?! GASP.

The problem with open source security tools (e.g., bro, suricata, brakeman) is that they require security expertise to operate, continually. In my experience many small/medium organizations who actually care about security don't have such expertise in-house and can't find good security people to hire. This limits them to buying commercial solutions which (also in my experience) tend to blow.

We need more security engineers, but the problem is I don't even know what that job title requires. The author pokes fun at CISSP, but how else can I figure out if someone is 'good' at security? They are already so rare and mostly employed by google (joke).

LTE seems to work well enough with less bandwidth (~60MHz). However I'm not sure what kind of range you can get with 3.5ghz. Surely at least a few city blocks?

Wireless last mile might be an option if the FCC actually opens up the 3.5ghz "innovation band" : http://www.fcc.gov/blog/35-ghz-new-ideas-innovation-band

Taking this even further: use uber/lyft as vehicles to do market research and/or customer development.

I only pick up in Atherton... ;)

Why drop the .io and spend cash on the .com?I'd guess it was somewhere in the 10k-60k range...

Does the tld really matter? My hunch is that .io is perceived as a toy product TLD and .com is where 'real' business is done?

This kind of sentiment sucks though because other startups probably see it as well and will needlessly shell out cash for a .com.

so if not hosting, care to speculate how docker is going to make $? Enterprise support / services?

Maybe a premium docker repo (mentioned above), where you pay for ... something?

How about competing directly with quay.io but they link up all the networking pieces for you automatically? a docker sdn! :P

I would guess he means "how are they going to make sustainable $"

Their public acquisitions:

  Fig: cluster deployment configuration
  Orchard: hosting
  Koality: continuous integration

Hosting?

The iOS8 WiFi probe MAC randomization implementation is quite flawed in that it's enabled only when you have location services off AND cellular data turned off! [0]

[0]http://blog.airtightnetworks.com/ios8-mac-randomgate/

which parts of the above code/api allow access outside of the sandbox?