zer01

What did the first cell phone cost? The first laptop? Every new piece of technology goes through a cycle where things are wildly inefficient and barely operable, but over time they're refined in a loop of iteration and improvement.

Vacuum tubes gave way to the silicon transistor, which immediately moved the idea of "personal computing" from a complete impossibility to something that was a pipedream that was technically possible to do. From there things like the Apple II made paths to make personal computing actually usable and affordable. The iteration cycle continues, drives demand for new things to do, which drives demand for the internet. Eventually we arrive at the iPhone where I can now have a low-latency, high definition, video call for (basically) free with anyone in the world. Try explaining that vision to someone in the 90's who has a pager, pays for long distance, and buys stamps and they'll tell you it's impossible or a pipedream.

The crypto/web3 industry is just finding its feet with some new tools in the proverbial toolbox (distributed consensus and smart contracts). There's a lot of people building on it and iterating every day, but in the same way that the IETF were unsung heros of bringing everyone Youtube, there are a lot of folks hard at work at making things usable and practical for mass adoption. Mass adoption just comes last.

The eth classic fork was because of the first high profile hack of a smart contract leading to massive loss of funds (way way back in 2016 - https://en.wikipedia.org/wiki/The_DAO_(organization)). The Ethereum community back then was a fraction of a fraction of a percent of what it is compared to the size today, and that early on in the network I don't think it was a detrimental thing to do like it would be today.

> No one can save you from your own deadly mistakes.

Alternatively, "You really really have to give a shit about your own security". Imagine if banks had some skin in the game in terms of their security story. Why was I able to have 2 factor on my world of warcraft account many years before my bank account?

You're right in that crypto is a cold world of immutability, but in the same way that exposing servers and data to the internet (along with all the hacks, identity theft, etc that came with it) ultimately led to better security protections like ASLR, DEP, Yubikeys, etc, I posit we'll see rise of new technologies to help combat these issues as well to help offset the risks as much as possible. Hardware wallets, multi-sig contracts, and now multi-party computation are promising new tools to help make the blockchain space more operationally safe, which enables the whole thing to scale.

Right, so what's happening right now is much more akin to the early days of the internet than anything else IMO. In the same ways we couldn't have ever predicted Facebook, Google, iPhones, etc, in the 90s it's hard to say exactly what impact crypto/web3 will have on the modern world.

There's actually something truly new and tangible that crypto has spurred - the ability to drive consensus in a trustless manner automatically and the ability to execute computer programs that are deterministic, immutable, and will run forever. With those new tools in the global toolbox I suspect that some iteration of them will be in use somewhere in our future, but no-one exactly where. Are NFT game assets the ultimate expression of crypto? No, but Friendster and HotOrNot weren't the ultimate expression of the internet either.

The ability to network 2 computers together was also new and tangible thing that the internet as a concept brought, but it wasn't before a huge amount of foundational work in the form of IETF protocols, router hardware design & production, software network stacks, and wireless communications before it really took off. Mass adoption was one of the last phases, and I still remember a day when people would call you crazy for putting your credit card anywhere near the internet.

IMO that's the phase we're at, so for most people it's just not ready yet, but it doesn't mean that there aren't a lot of people out there trying new and novel things with these tools ¯\_(ツ)_/¯.

If you just want to store and host files like a website, there's a few projects in that vein that I know of - Arweave (https://www.arweave.org/), IPFS (https://ipfs.io/), and Filecoin (https://filecoin.io/).

IMO these projects are aiming at a new form of sovereignty on the internet that doesn't/can't exist currently - the ability to have your data be permanently stored and accessible on the web. Google can decide to kill Google Photos, and every email provider on the planet can delete everyone's old emails if they so choose. It's unlikely, yes, but the ability to put something on the internet permanently surely has some novel value to it, even if just as an open building block to something bigger than the sum of its parts.

A massive part of what's going on right now in the crypto space is people experimenting with these new protocols and tools like smart contracts and DAOs (https://en.wikipedia.org/wiki/Decentralized_autonomous_organ...) and attempting to figure out new and novel things to do with them. Web3 is a moniker du-jour to try to encompass these experiments in finance, governance, art, and collaboration.

When the internet was early, people were doing the same, and it gave rise to new forms of art, online gaming, radically different access to banking, ecommerce, and low latency, (basically) free, video calling anywhere in the world. Imagine trying to explain Twitch.tv or Facebook to someone in the early 90s when people were paying for long distance calls and stamps. The groundwork for these things was being created as people were inventing DNS, HTTP, etc etc, but in the same way that NeoPets was not the ultimate expression of online gaming (but had influence on it nonetheless), the things we're seeing today are not the ultimate expression of what "web3" will eventually be but instead a bunch of passionate people trying to figure out what revolutionary things can be built with these new unique tools.

I typically use DRF + Django for the backend and then have one “view” that renders an index.html with a context bridge (passed via a global JS variable) so I can bootstrap the front end with enough server side state to load quickly (and do feature gating and whatnot).

Seems to be a great combo to me - you get all the awesomeness of Django/DRF and none of the more archaic html temperate rendering stuff.

The only bad bit I’ve found in Django is lack of real websocket support when it’s needed. Server side events are great to have.

I love Python, and I love Django, but I think async support would be a bad idea personally.

I’ve written a lot of things using asyncio and steered into it hard when it was first stable, but I’ve found it cumbersome and (zooming out) pretty unnecessary in the grand scheme of things.

Asyncio is cooperative concurrency where you’re supposed to politely yield back to the event loop when you’re blocking on IO, but the event loop doesn’t bawk (that I’ve seen) when things are blocking accidentally. I’ve chased a number of very real bugs around this in production and I will say it’s some of the most infuriatingly difficult to pin down set of bugs I’ve encountered to date (for example, redis is fast enough to not notice any issues until your redis query grows slow enough that you do, and at that point things behave strangely with no clear indication why).

Remember, even printing things to stdout is still technically a blocking IO operation. Same with reading/writing any files. Lots of issues can crop up in weird ways with stuff like this.

On the other hand, the “boring” Python threading library is preemptive concurrency, meaning your libraries can’t hold things up even if you wanted to. In general give me preemptive concurrency any day - I find it easier to carefully code around state mutations than diagnose why a library might be blocking the event loop. I haven’t noticed a massive perf difference between the two and to guarantee that I don’t have weird “you’re blocking accidentally” sorts of issues means I’ll stick with threads any day of the week.

Also exception handling in asyncio land is (again just from my experience, it’s been a couple years) not great, I subscribe to the mantra of letting things crash, but things silently crashing is a deep seeded behavior change that seems to go against the Python mantra of “throw exceptions and let things fail”.

For now I keep things boring with Python, and if I need massive concurrency just rewrite things in elixir (which is preemptive concurrency and the actor model which is super powerful as a combo).

Malware detection uses it as a heuristic to peg specific “variants” to each other. Basically LSH is great for comparing corpuses of data that are slightly different.

If you hash the data using something like SHA256 and even one byte is different, it’ll produce a radically different hash (which is by design). With LSH you can have a measurement to say “corpus A has a 90% overlap with corpus B”, or in a single bit flip case, a very high correlation.

For me it’s actually more about isolation and security. I touch and build a lot of random code and docker gives me some good assurances that a transient dependency of a dependency somewhere in the pits of NPM install hell won’t do things like install malware on my computer.

Sandboxing/isolation is a very good mitigation against software supply chain worries IMO

My hope is that those of us who feel like spinning wheels can show solidarity through a simple gesture of clicking a button, and those of us who may need it can find tangible proof that there are other Americans out there who care, share your sadness, share your anger, and are thinking about this problem and ways to solve it.

Stay safe everyone.

(Stack is Vue + Elixir/Cowboy/Plug)

I'm firmly in this camp as well. A strong code quality metric is how easily understood something is - we write code in all sorts of states of minds at all hours of the day. If others can read your code and understand it, it means you can too when it's time to extend/modify it. This is also why things like Ruby's over reliance on metaprogramming bugs me - sometimes duplication is fine, and I'd much rather have some duplication than a wrong (or hard to discover) abstraction.

The argument that "all code gets sloppy so let's just have very verbose code from the get-go" is pretty insane to me.

> I also write Go code without missing generics, but that’s because I’m also fluent in other languages, and tend to use those when I want something ill-suited to Go, rather than trying to force Go into that shape.

I think this should be the main takeaway from people learning go - it's not suited for everything. Technically you can write "World of Warcraft" in pure assembly, but it doesn't make sense to do - you're using the wrong tool for the job. My problem is I hear a lot of people advocating for golang with a one-size-fits-all, theres-nothing-better, sort of mantra.

I have things I absolutely reach to golang for, but the sweet spot I've found is to re-implement a prototype I've built in some other language (like Python) when I need the speed. Trying to actually create new things in golang is tedious and I end up fighting the tooling more than most other languages (sans maybe C++ or Java).

This has absolutely been my experience as well. Golang is good at being fast, but to say that it helps write better code because of its missing batteries/features is just silly I think.

"I want to interact with a REST API and pull a field out of its response JSON" is an incredibly common workflow, and yet to do that in golang is far from trivial. You need to define serializer types and all sorts of stuff (or you can take a route I've seen encouraged where people to use empty interfaces, which can cause runtime exceptions).

Same deal with a worker pool. Concurrency is great, but instead of providing a robust, well written solution as part of the language itself, it gives you a toy like this https://gobyexample.com/worker-pools (still the most common result on Google) that is only 80% of the way there. Then you find yourself bolting things onto it to cover your features (we need to know if things fail, so let's just add another channel. We also need finality, whelp, another channel it is), and before you know if you have an incomprehensible mess.

This PNG parser in Elixir uses pattern matching in an elegant way.

https://gist.github.com/zabirauf/29c89a084901cab8bc6b

Parsing binary data can be...nontrivial. The beauty is in the code that doesn't exist.

Yeah if you're going to sling shit like this, link to your sources. I've handled incidents involving both ecosystems over the past year and they're pretty comparable.

NPM also bought a security company (https://blog.npmjs.org/post/172793182214/npm-acquires-lift-s...) and integrated NSP directly into NPM in the form of `npm audit`.

Ruby/Gems has `bundler-audit`, which is equally good, but a separate project with a looser integration.

I'm just coming off a 7 month stint in an RV myself, and you speak the truth, and it's clear you've actually done full time living on the road.

Dealing with sewage is a huge pain in the ass - especially if you're in the northern regions during winter, finding a place to dump out can be a real nightmare (not to mention frozen tanks, etc).

Another thing people don't really think about is cooking - you can do it, but as someone who enjoys cooking I ate like shit a lot of the time because it was more convenient not to have to worry about prep on a tiny counter, cooking on basically a single burner (I have 3, but if you use one it covers the other two ️), and then doing dishes by hand with hot water you need to wait for.

Recently moving back into a house has made me appreciate a lot more of the little things like how I can just go jump in the shower real quick (and not bump my head while showering), easily get amazon packages, etc. Traveling was a whole lot of fun and definitely had its upsides, but it also has downsides a lot of people don't think about (or try to write off as not a big deal).

Having used Bulma for a few years now to build everything from product to open source stuff, I highly recommend it!

It's currently in use both at https://phishfinder.io and https://certstream.calidog.io

This...is actually 100% true. One of the biggest struggles I've personally had in security is to not be super jaded and cynical. Helps immensely to not be in an organization that tolerates (or even rewards) shoddy security practices (at least that's how I solved it).

It almost always pays to have your finger on the pulse of whatever industry you're looking to recruit from.

If someone posts a neat article on something that's relevant to your problem space, don't be bashful and reach out to them (same with useful github projects, etc).

Twitter is another one if you've already curated a good base (or your developers/security folks/designers/etc have), just start DMing people who look like they're great and passionate about what they do.

> is to act as a minimum level legitimizer for those willing to acknowledge a lack of experience

True, but there are a lot of bullshit certifications out there that either 1.) vastly over project the actual knowledge people glean from it (CISSP and friends) or 2.) are unrecognized to the point that they're useless.

> the excessive profanity is unprofessional and distracting

I strongly disagree. Most security shops I've been in are made up of people who are blunt and speak exactly like that. You absolutely do need to be able to conduct yourself professionally in a professional setting, but when giving advice to folks I tend to use the most informal language I have, which sometimes means this level of profanity.

Not sure how it's distracting.

This is along the lines of the advice I also give people, it generally boils down to a few things:

- Be hungry - I'm willing to spend hours with someone who's hungry and just lacks knowledge or a mentor

- Be humble - Always underplay what you know, especially in a market where people wildly overestimate their skillset being humble sets you aside

- Do open source stuff - It's a great indicator not only that you're willing to fail publicly and be ok with it, but it's also a great way to show your progression as an engineer. It also shows you can deal with occasional asshats on the internet (hopefully).

- Differentiate yourself somehow - Being knowledgeable about IT is only one of those ways (though probably the best IMO), if you can have security skills and a sense for business, or security skills and hardcore networking experience (think Cisco certification), etc you'll almost automatically shoot to the top of any stack of resumes.

SANS certifications are the only ones I think hold any actual water. People tout the CISSP like it teaches you anything but the very basics and use that to call themselves professionals, which is a huge red flag in hiring.

> Your variable pricing is super interesting.

Thanks! My goal is to make this extremely affordable protection.

> I’d love to know how that turns out.

Me too! If you follow me on twitter you can keep tabs :) https://twitter.com/fitblip

> What’s the average company size that you’re targeting?

This is where things get somewhat complicated. My goal was to make this protection as ubiquitous as possible (since this is only the first in a line of security products I have planned), which means my target is basically every organization on the planet.

That does definitely mean that large companies are going to benefit greatly from this at an extremely small fraction of their budgets, but if that's the cost of making this affordable to small companies as well (1-2 man IT shops, startups, etc), then so be it.

Hey all, CEO of Cali Dog Security here. This is our first product and we're excited to show it to the world! We're also looking for feedback!

Announcement blog with more details here - https://medium.com/cali-dog-security/announcing-phishfinder-...

Happy to field any questions you may have here! :D

Hmm, that's an interesting thing I haven't given much thought to.

I think that it would be somewhat difficult to pull off a correlation attack/leakage as the CTLs tend to dump in batches vs every poll returning new results, but I think once you remove a lot of the noise (cloudflare SNI certs, testing domains, etc) it'd potentially show some interesting patterns.

https://github.com/CaliDog/certstream-python/blob/master/exa...

This demo would be a decent starting point to that analysis if you'd be interested in toying with it!

Thanks for the heads up! It also isn't displaying the favicon properly it seems :-/.

https://media1.giphy.com/media/R54jhpzpARmVy/giphy.gif TL;DR - Curse you Webpack! ::shakes fist::

Interesting! I haven't been able to attend Defcon in the past few years so I haven't seen that talk (or heard of his research), but it's something I've thought about for a while now - using CTLs as a means to jump into the early process of setting up webapps and whatnot.

Thanks for the video!

Oh very cool! I hadn't seen this. Good stuff! http://cdn.ebaumsworld.com/mediaFiles/picture/718392/8489089...

> I would have to check regularly on CT logs

You would indeed, which is part of the reason I released this service + libraries, so some enterprising developer can build a nice alerting service with it for folks just like you!

> Do I tell the mozilla that "someone issued cert id 4d8effdd25 for my nextcloud installation

Not exactly, I believe you'd probably contact the certificate issuer who issued the original certificate to have them issue a revocation, but my sincere hope is that folks running CAs will eventually come up with some better method for flagging certificates as bad/malicious than "just email Symantec support", since I wouldn't wish that on anyone.

This is (imo) the most correct response to this query. The idea behind the CT lists is that browsers will flip into a "if it's no publicly identifiable, it's not valid" mode.

The Coinbase Engineering blog actually just put out an article on this very topic today - https://engineering.coinbase.com/moving-to-expect-ct-d0d26a0....