amlozano

You aren't the only one that has noticed:

https://0ver.org/

More seriously though, for these projects, the first version is version zero. If they make no major backward incompatible changes, why would they ever release a version 1?

I totally thought Anvil had self-hosting. I was seriously considering it for my next project. Now not so much.

I was wondering where I had heard this term before, and then remembered this is also a good unlock in universal paperclips.

Spoilers; https://universalpaperclips.fandom.com/wiki/The_OODA_Loop

TreasuryDirect.gov should get a special callout for forcing you to use an on screen keyboard to click your password, with of course paste disabled.

Regarding over the top accomplishments in resumes: every resume writing workshop tells you to do this. I don't think you should be rejecting these first just because someone listened to the advice of "sell yourself".

For sailing maybe not, but a vehicle can in fact be made that can go downwind faster than the wind https://youtu.be/yCsgoLc_fzI

I think NIST has actually recommended against forced rotation of passwords (unless they are breached) since at least 2017.

"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator."

- NIST SP-800-63B Digital Identity Guidelines - Authentication and Lifecycle Management

--

A large part of me wishes they made this a SHALL NOT. It would have caused chaos with other standards, but it would have been the right thing to do.

Because it makes sense for everyone. Making the system perfectly handle an infrequent use case is a waste of resources for the larger system. A manual, buggy process is likely fine. The time spent to make it perfect would be large. That time can be spent making sure people get better service in other, more common scenarios.

Penetration testing / security consultancy falls into this trap too. All the downsides are present.

It is weird, though maybe not so weird if you think about it for a few minutes, how closely aligned law and offensive security are with business practices.

One of the things I want to do with my consulting business going forward is to explicitly depart from this model. We will see if the market accepts it or not.

"The FBI said it uncovered the scheme through the work of two confidential informants and surveillance of the alleged plotter’s account on the Meta-owned WhatsApp messaging platform."

I wonder why ISIS was so insistent on using Whatsapp over something else.

Louis Rossmann, who has been outspoken about Apple's repair hostility and is a right-to-repair advocate, has released a video where he goes over his take on this site: https://www.youtube.com/watch?v=agG108sxkyo

It's a pretty good take, and points out some key criticisms: lack of parts for common repairs, lack of support for older devices, and, of course, no schematics.

Maybe check out Tauri then

https://tauri.studio/en/

It seems to be something mostly specific to the EVGA version of the card, which is a real head scratcher.

I've often wondered the same thing, but about personal health information and educational information (HIPPA, FERPA). If you intercept that data and store it, transmit it or even just allow real time access to it are you suddenly on the hook for all that those laws require?

I think its worse than cheapening the reputational cost, it has put a concrete ceiling on the financial cost - something like users affected * 2 years of free credit monitoring.

As someone who is pretty much an app sec engineer, I feel like this rings true.

Furthermore, part of me suspects that the tangible business risk of application security flaws isn't felt until after a breach, when its far too late to change things. Even then, sometimes the cost of a breach does not justify the expense of building a robust secure software development life-cycle.

If you discard any quantum computing, this is similar to the plot to the series of novels starting with "Off to Be the Wizard" by Scott Meyer. A fun, quick little read about a person who discovers the source database of reality, and then promptly starts messing with it.

How hard are these things to build? It certainly looks like a complicated medical device, but is there a simpler DIY version that gets the job done?

I used to trust the California Olive Ranch brand for olive oil, but lately noticed they started labeling their some of their bottles as imported and accidentally bought some. It tastes fine, but if I recall correctly the problems with olive oil usually come from imports where laws and regulation rules change from country to country.

Luckily I live close to a real olive mill, but there really is no way to know. Plus you have people arguing the vast majority of olive oil sold in the USA is "authentic" for some measure of authentic, which is really hard to discern: https://www.aboutoliveoil.org/the-facts-about-uc-davis-olive...

This feels like another one of those areas where as a consumer following the research and knowing what products are good to buy is almost a full time job.

Tell that to us Windows and Linux people

When talking about passwords specifically in our reports (I work at a security company too), I tell our team to use the same language as NIST 800-63B, since its the best "standard" for passwords and authentication I can find.

The relevant bit here is this:

Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function. Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash.

They are specific about the type of KDF required: "one-way key derivation function".

The examples given later are PBKDF2 and Balloon.

You are right. I still think we should call "Password Hashing Algorithms". "One-way password storage" maybe. Or something. Just get rid of the word hashing.

Edit: NIST uses "one-way key derivation function" in their requirements, which I like, but that perhaps unfairly excludes other potential functions.

We often use 'hash' as a sort-hand way of saying 'Key Derivation Function' when talking about secrets like passwords. https://en.wikipedia.org/wiki/Key_derivation_function

These functions usually use hashes as a primitive, but there is more to them than that. Using a plain hash to store passwords is usually a red flag that the storage is insecure. I see it when doing source code audits: some legacy software using md5 without a salt.

To be precise I think security community should make an effort to separate the two terms more often. I've been trying to be more precise when writing and reviewing assessment reports.

About a year and a half ago it was a very common vulnerability to find when doing web application assessments. Especially if uploading Excel spreadsheets was somehow involved.

Its less common now that most major parsers are turning this feature off by default though.

Have you tried Conan[1] by chance? I've only used it for small projects, but it was pretty nice.

https://conan.io/

Another thing to bear in mind is that people who commit espionage are often coerced into doing it by blackmail or threats. This is one of the primary reasons for background checks beyond simple criminal background checks: you want to make sure the people you trust don't have anything in their history that can be used to blackmail or otherwise coerce them.

HttpOnly doesn't really do much to stop an attacker that already has XSS. The attacker just makes the XSS perform the interactions they want directly instead of bothering to steal the cookie.

James Kettle wrote a good blog post that argues that webstorage is probably a better spot for session tokens here: https://portswigger.net/blog/web-storage-the-lesser-evil-for...

+1 for the Embody, I love mine.

Try to get it on sale or something though, its stupid overpriced.

When you buy a new pair these days, pressing that button causes the headphones to say "Configure the action button in the Bose Connect App"

Yeah, but if you download the app again today you will see a new prompt that forces you to agree to waive your right to class action and agree to arbitration over privacy policy violations. No option to cancel or opt out of course. Nice timing Bose.