Shamiq

That's neat -- similar to a short squeeze.

Yea, I'm thinking about cases similar to HTTP parameter pollution, and what the program expectations are. You'd be right to argue environment variables should not be user controlled. :)

Shamiq

9 lat temudiscuss

Will need to double check some machines to make sure these two don't bite me:

On Unix systems the environment variables SSL_CERT_FILE and SSL_CERT_DIR can now be used to override the system default locations for the SSL certificate file and SSL certificate files directory, respectively.

The os/exec package now prevents child processes from being created with any duplicate environment variables. If Cmd.Env contains duplicate environment keys, only the last value in the slice for each duplicate key is used.

Shamiq

9 lat temudiscuss

https://www.udacity.com/start-mentoring

Shamiq

9 lat temudiscuss

Not that far off: https://en.wikipedia.org/wiki/Life_expectancy#/media/File:Li...

Shamiq

9 lat temudiscuss

triplebyte mentions taking a particular problem from CtCI and solving it within 30min on a whiteboard (pen/paper, plaintext editor).

Shamiq

9 lat temudiscuss

The email address field in your user form isn't public. you need to add it to text in your description.

Shamiq

10 lat temudiscuss

dang, this is excellent. thank you so much :)

Shamiq

10 lat temudiscuss

oh, I scrolled down and only saw the purchase option.

Shamiq

10 lat temudiscuss

I don't have access to the full article, but the premise is interesting. at what transaction volume would I be better of running my own fgpa hardware?

Shamiq

10 lat temudiscuss

Awesome project! This is a step in the right direction for better access management.

Shamiq

10 lat temudiscuss

hah -- i found the same result with gofmt, golint, and go vet

Shamiq

10 lat temudiscuss

That could be a decent hack to get started. Ideally, I'd like for it to be a feature of hackerone et al, assuming security@ as a service providers become the point of interaction with the external security community.

Shamiq

10 lat temudiscuss

oh, i know -- i got spoiled working at matasano where we'd usually get the first crack.

Shamiq

10 lat temudiscuss

I would love a Marauder's Map for bug bounty programs: Show me who is working on what, where they're finding bugs, and help me identify where I can most efficiently spend my time. Lots of 'feel bads' if I report a bug that's already been reported, and thus don't get a payout.

Shamiq

10 lat temudiscuss

I'm color blind, and the charts you use are unintelligible to me.

Shamiq

10 lat temudiscuss

Congrats on the launch! Why the choice to build on Kubernetes?

Shamiq

10 lat temudiscuss

Just stick it up on medium for the time being. you can always figure out a 'real' blog later :).

Alternative is using github pages with something like jekyll.

Shamiq

10 lat temudiscuss

You've got a point there, but I'd ask why not remove the packages that aren't being used? Here's some of the raw data about which system libraries are lagging in security patches:

  liblwres90 1:9.9.5.dfsg-3ubuntu0.6
  mysql-common 5.5.46-0ubuntu0.14.04.2
  libmysqlclient-dev 5.5.46-0ubuntu0.14.04.2
  libmysqlclient18 5.5.46-0ubuntu0.14.04.2
  rsync 3.1.0-2ubuntu0.1
  bind9-host 1:9.9.5.dfsg-3ubuntu0.6
  libisccc90 1:9.9.5.dfsg-3ubuntu0.6
  libisc95 1:9.9.5.dfsg-3ubuntu0.6
  dnsutils 1:9.9.5.dfsg-3ubuntu0.6
  linux-libc-dev 3.13.0-74.118
  libbind9-90 1:9.9.5.dfsg-3ubuntu0.6
  libxml2 2.9.1+dfsg1-3ubuntu4.6
  libdns100 1:9.9.5.dfsg-3ubuntu0.6
  libxml2-dev 2.9.1+dfsg1-3ubuntu4.6
  libisccfg90 1:9.9.5.dfsg-3ubuntu0.6

Shamiq

11 lat temudiscuss

Cool idea -- I'll go get the golf clubs!

We'd love to be at the point where Patchwork notifications are ahead of public releases, and get you patched before the vulnerability is widely exploited. In fact, one of the crazy ideas we've been kicking around is how to detect 0days without installing an agent on production machines.

Submissions

Pain in the PaaS: The Problem of Lagging Security Updates at Heroku

Show HN: Patchwork – Real-time notifications for OSS vulnerabilities

TRO LLC: Hacktivist Hedge Fund Seeks Crowdfunding

The pitfalls of Test-Driven Development

An empirical study of passive 802.11 Device Fingerprinting

Double-Dip: Using the latest IE 0-day to get RCE and an ASLR Bypass

LibreSSL: The good and the bad

comments