agnokapathetic

Yes. They were about to have their enterprise lunch eaten by GitLab

This is great, still recognizable, flexible and somewhat fresh.

Compare to Slack’s logo rebrand: https://news.ycombinator.com/item?id=18923719

and 100KB/s is the max ingest rate?

“Imagine if instead of treating a conference as a passive chance to see a broad range of hacking demos, we all treated it as a chance to study up on the latest techniques. Something between workshop and lecture series...” - Dave Aitel

https://twitter.com/daveaitel/status/1111979964780503045

For those out of the loop like me, the Apache 2.0 license exceptions they are addding are:

> As an exception, if, as a result of your compiling your source code, portions of this Software are embedded into an Object form of such source code, you may redistribute such embedded portions in such Object form without complying with the conditions of Sections 4(a), 4(b) and 4(d) of the License.

> In addition, if you combine or link compiled forms of this Software with software that is licensed under the GPLv2 (“Combined Software”) and if a court of competent jurisdiction determines that the patent provision (Section 3), the indemnity provision (Section 9) or other Section of the License conflicts with the conditions of the GPLv2, you may retroactively and prospectively choose to deem waived or otherwise exclude such Section(s) of the License, but only in their entirety and only with respect to the Combined Software.

I’m a YouTube premium subscriber and I never watch any “original content”. I simply enjoy zero advertisements.

Paradoxically the target demographic willing to pay to be ad free is probably worth far more to advertisers than those who don’t— making it difficult to justify the product offering.

Though I’d certainly use YouTube significantly less if I had to sit through the ads.

Don't need ground truth for crowd-sourced annotation just need agreement between n-different users.

1 randomly present captcha to few known-safe/low risk users 2. Compare answers with answers from higher risk user's Captcha responses.

OMEMO just implements the Double Ratchet Algorithm that Perin and Marlinspike created for Signal as an XMPP extension.

[1] https://en.wikipedia.org/wiki/OMEMO

[2] https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm

The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities by Mark Dow et al. https://www.amazon.com/dp/0321444426/ (https://www.amazon.com/dp/0321444426/)

This book will give you the fundamentals of application security testing.

https://www.mlflow.org is open source.

Emphasis on "negotiated".

The entire negotiation and key agreement stack is a larger codebase than all of Wireguard.

After RSnake introduced slowloris in 2009, it’s been something of a minor miracle that L7 attacks have stayed as rare as they have until now. Don’t understand why SYN Floods have been the preferred way to DDoS until recently-they’ve been obsolete for nearly a decade..

What could possibly go wrong?

Not only unreported but weaponized by the US Government.

TL;DR for DRACOs

what it is: they made a poison which will kill a cell when two-parts of the poison touch each other in a certain way (think bubble gum in mission impossible). They've designed the parts of the poison so it should only trigger when a virus is present.

why no big pharma compnay will touch it: the criterion for "virus present, KILL CELL" is potentially highly highly error prone, could easily go haywire killing all the cells.

Contrast to Immunotherapy -- the state of the art in clinically approved cancer treatments which uses the body's own immune system to selectively kill cancer cells (which also faced significant finanical barriers to its development), even if the signal goes haywire, the body's immune system still has fail-safes to not killing all of its own cells.

disclaimer: i am not a biologist, but i took some basic college bio courses

From wikipedia: "Differentiation between infected and healthy cells is made primarily via the length and type of RNA transcription helices present within the cell. Most viruses produce long dsRNA helices during transcription and replication. In contrast, uninfected mammalian cells generally produce dsRNA helices of fewer than 24 base pairs during transcription. Cell death is effected via one of the last steps in the apoptosis pathway in which complexes containing intracellular apoptosis signaling molecules simultaneously bind multiple procaspases. The procaspases transactivate via cleavage, activate additional caspases in the cascade, and cleave a variety of cellular proteins, thereby killing the cell."

From the paper (http://journals.plos.org/plosone/article/asset?id=10.1371%2F...) :

"In its simplest form, a DRACO is a chimeric protein with one domain that binds to viral dsRNA and a second domain (e.g., a procaspase-binding domain or a procaspase) that induces apoptosis when two or more DRACOs crosslink on the same dsRNA. If viral dsRNA is present inside a cell, DRACOs will bind to the dsRNA and induce apoptosis of that cell. If viral dsRNA is not present inside the cell, DRACOs will not crosslink and apoptosis will not occur."

except pivot into a higher-privileged management network full of juicy--and typically totally unpatched--Out-of-Band management equipment (consoles, IPMI, industrial gear)

I've been using https://github.com/Olical/react-faux-dom with d3 without issue. The project lists the following caveats:

   It's great for...

   - Static D3 components or other such libraries (things like Backbone should work too!)
   - D3 components with simple state and event interaction, like tooltips on charts
   - D3 components such as progress bars that can be animated using react-motion, for example

   It's not so great for...

   - Physics based D3 components or anything using a lot of DOM mutation and state
   - Linked to the previous one, brushing and filtering of selections using the built in stateful D3 tools
   - Essentially: Anything with a lot of DOM mutation from timers, events or internal state will be hard to useation from timers, events or internal state will be hard to use

But I've mutated state in an onMouseOver event, redrawn and it's buttery smooth.

  node
    .on("mouseover", (d) => window.requestAnimationFrame(() => this.setState({selectedElementId: d.id})))
    .on("mouseout", (d) => window.requestAnimationFrame(() => this.setState({selectedElementId: 0})))
  
  node.filter((d) => d.id === this.state.selectedElementId)
    .select("text")
    .style("text-decoration", "underline")
    .style("font-weight", 'bold');

- Write prose. I find my verbal fluency (and my inner monologue) become far more dull when I haven't written anything in a while

- Keep alcohol consumption to a minimum, even a single glass of wine impacts memory formation and recall.

- Get lots of sleep

I created an Nmap script to find this on your own networks:

https://gist.github.com/jwpari/3369a537b422ecfa23f5

Use with:

  nmap -T5 -p 9200 -Pn --script=+elasticsearch-cve-2015-1427 10.0.0.0/8

Another thing to keep in mind is that a lot of these lists are compliance-driven.

   - Hosts which process credit cards (PCI)
   - Hosts which reconcile the general ledger (SOX)
   - Hosts with medical data (HIPAA)
   - Hosts with student data (FERPA)

The problem is that while the security of the enumerated hosts is taken quite seriously, systems which have security trust relationships which grant access to the enumerated hosts are not locked down.

   - PCI Payment Processing Application server: locked down.
   - CI system with deployment keys to said host: zero authentication.

CobolOnCogs [1] was purely a joke, this is an actual framework (also a joke, but with actual functioning code [2]).

[1]: http://www.coboloncogs.org/INDEX.HTM

[2]: https://github.com/azac/cobol-on-wheelchair

The technical reason is that while the iPhone 5s has the Secure Enclave co-Processor (SEP), it does not have an Apple Pay Secure Element (SE).

The SEP is a ARM TrustZone-like separate processor running a stripped down L4 derived microkernel. This manages encryption keys, the secure boot-loader and OS update signing.

The Apple Pay Secure Element is a separate chip which runs a Java-Card-OS. "Cards" in the java-card-OS are cryptographically "personalized" by the payment network (VISA, AMEX, MasterCard) with per-device keys and the device personal account number (DPAN)--the tokenized device only credit card.

This is the same java-card + payment network personalization that physical chip-and-pin cards, Google Wallet and most other NFC payments use.

So my guess is that the Payment Networks were not comfortable using the Secure Enclave Processor and preferred to reuse the same technology used by chip-and-pin, with a separate Secure Element chip.

Source: https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20...

While this works fine for most single-role customer facing applications (the kind most startups are building), as a security engineer most Single Page Apps (SPAs) which handle authentication like this (client side) have horrible authorization issues.

I've seen many SPAs with totally unauthenticated API endpoints. They'll control what a user's allowed to do with the UI and hide unauthorized functionality, but direct requests to the backend still allow any request.

The thing to keep in mind is: don't trust the client. The final word on authentication and authorization should always be done server-side.

For ECC djb and Tanja Lange have put together a great list of how possible it was to tamper with each of the ECC primitives listed: http://safecurves.cr.yp.to/rigid.html

A quick way to check if a server supports the heartbeat extension (won't tell you if it's patched or not)

    echo | openssl s_client -tlsextdebug -connect host:443 | grep heartbeat
    TLS server extension "heartbeat" (id=15), len=1

Be careful with:

  --default-names do not prepend 'g' to the binary

On OS X (a BSD derivative with BSD-grep), --default-names will put GNU grep in your path. A lot of things in OS X depend on BSD sed/awk/grep. Omitting --default-names links then GNU variants to ggrep/gsed/gawk.

It would appear so! Why then is Verizon Enterprise Solutions getting called in to "save the day" with Healthcare.gov?

In my opinion, the most helpful text for transitioning from development to security would be:

http://www.amazon.com/The-Software-Security-Assessment-Vulne...

Beyond that add in a bit of system administration knowledge e.g. in-depth knowledge of operating systems and networking, and you have everything you need to break many many systems!

The author of sqlmap added DNS exfiltration for blind SQL injection last year. Really creative technique (DNS stack doubled the size of sqlmap code-base).

Paper: http://arxiv.org/pdf/1303.3047.pdf

Slides: http://www.slideshare.net/stamparm/dns-exfiltration-using-sq...