580 karma · joined April 1, 2011
In the 18 months since I assume they have assembled a decent security team and while most likely Uber dropped the ball here at least they recognized the need for security before they got burnt.
These days whenever someone proposes creating an air gapped network for a secret project I spend a lot of time enumerating the extreme costs of this configuration. Some of these costs are lowered development productivity, additional hardware and the extra people required for the more intense monitoring.
Air gapped networks are unpleasant to work on but can be a good security mechanism if you truly appreciate the costs.
Sadly however, I'm having trouble with The Peripheral (his latest), maybe it'll grab me but it has yet to do so.
Lyft and Uber will both tell you if the price for the ride you're requesting will be higher than usual so in that sense their prices are just as knowable.
I think a fair price would be one that an informed and unencumbered buyer and seller reach. One reason why it can be hard to get a Taxi in New York if you're trying to leave Manhattan is because the prices aren't always fair and that drivers would rather seek a fairer transaction (in contravention of regulations).
With unlimited time off there's no longer any reason to stockpile days for that giant trip I keep putting off or to think of vacation days as being money that my employer owes me.
Before leaving the US I had 6 weeks annual leave, 4 rostered days off, 13 public holidays and usually a few extra days of stand down when the office was closed over Christmas (call it 50 days off).
Even coming from that I don't feel worse off now that I have unlimited time off.
The E-3 isn't explicitly a dual intent visa but my understanding is that you can't be denied an E-3 specifically for having applied for a green card. If you're on an E-3 and are seeking a green card talk to an immigration lawyer.
I agree that in many situations tax loss harvesting isn't helpful and even in the best case it's not amazing but if over the long term it can be worth the 50 basis points that the robo-advisors claim then it might be worth paying 15-25 basis points for it.
Hearing about Schwab's entry into the market makes me think that I should at least hold off to see what changes an established broker makes on the robo-advisor market.
Thinking about it, basis points feel too expensive for something that's done entirely in software. I suspect competition from existing players will drive the price right down.
Does anyone have any thoughts about whether automated tax loss harvesting is worth the 0.15-0.25% fees that the robo-advisers charge?
They sell a subscription service that provides access to a catalogue of their exploits to Government groups (law enforcement and intelligence agencies mostly). Depending on the company the list of acceptable clients will vary, some of these firms sell only to the federal agencies of 5-Eyes nations, others will sell more broadly than that, some may only sell to ${Local SIGINT agency}.
Government groups might do any number of things with these exploits but typically law enforcement will use them to execute warrants to help in their surveillance of suspects. Intelligence agencies may use them in the same way (pursuant to their authorizations). Other customers might somehow try and defend friendly networks with the information but this doesn't work.
I'm not sure what in particular tptacek objected to but my guess is characterizing them as part of the Government. The Government isn't keeping any secrets here (except for the ones they're presumably contractually obligated to keep by Endgame / VUPEN / etc) and the vulnerabilities have been discovered before the Government has contracted with the supplier.
I guess that'd have the same net result though since it's much more feasible to hire for if it's been formalized.
The guys in that article have been working on finding bugs in non-Google products for a little over two years and you can see their past results through the advisory credits they've received at Microsoft and Adobe as well as from open source projects like FFmpeg.
For example see Ben Hawkes on this list of Google CVEs in other companies' products: https://www.google.com/about/appsecurity/research/
Many of Google's recruiters (especially the sourcers who are looking for candidates) are temporary contractors.
These contractors generally have a tenure measured in weeks and they are vying for one of very few full time positions. This high turnover, low institutional knowledge, and desire to distinguish themselves would be my best guess at explaining why the "Do Not Contact" note is not being respected.
It's actually a big part of the culture at Riot Games, the idea is that we're trying to be the most player focused company so it is important that we all play, it helps us make a better game.
The submitted link is Mike Hearn agreeing with and elaborating on Brandon Downey's original thoughts on the matter.
One of my non-day job focus areas was security education, I ran several classes/events to try and teach people about writing secure software. A public example I can give is the Hardcode Secure Coding competition which I was one of the organizers and judges. See http://googleonlinesecurity.blogspot.com.au/2013/05/the-resu... (I'm one of the guys in the desk photo).
Another example of my 20% projects was a dashboard that compared the number of security reports that had been reported against various parts of Google. It compared them with a lighthearted metaphor and was displayed in a relatively high traffic area in the hopes that it would draw the interest of people who did not track security issues day to day.
A final example is that I worked a little bit on Glass, but only as an interested outsider. I helped out with some security reviews of internally developed Glassware on a volunteer basis as well as wrote my own Glassware to help test the platform.
Blocked off time varied, Hardcode required a lot of blocked off time (including a trip to Singapore). My other projects generally needed a couple of hours at a time. In an average week I'd work two half days on my side projects (not every project every week).
My managers were both very supportive (and all round great guys), it helped that I could explain the potential benefits of all my projects and that they were not completely unrelated to my day job (performing security assessments and code reviews of non-Google code/systems). There are probably limits to what my managers would endorse, but I never got anywhere near those limits.
For the probationary period the employer can fire you for almost any reason (like in the US) but afterwards there's a procedure involved where the employer has to show cause and give the employee a chance to rectify the issues before dismissal.
It's not like a trial week that last 3 months, it's more regular employment but you receive tenure (or a sort) after 3 months.
I wish people would stop saying this, 20% time is not defunct at Google.
Bugcrowd maintains a list of websites that have bounty programs: https://bugcrowd.com/list-of-bug-bounty-programs/
http://linux.slashdot.org/story/98/12/20/2348230/good-new-se...
If you fit in the second employment related priority categorie (EB-2) and aren't from China or India your visa process has no backlog. EB-2 status is granted to people with Masters degrees or Bachelors + 5 years experience.
Just be careful because Wizards of the Coast might disagree with you about what is and isn't public information. Especially when you are showing the rating and number of votes and rating straight from Gatherer.
We definitely don't play the blame game but we do keep track of bug statistics so we know where best to spend our time and effort. It can be useful to know that projects using framework X have more issues than framework Y or that maybe we should arrange to run some security classes at office Z.
Bugs like this one are fixed with the help of the product team, they're usually the ones writing and pushing the fix (since they know the project best) and it's a good way to get some practical security experience spread around the organization (and increase awareness).
We do write post-mortems for serious issues to delve into the root cause and to help stop it from happening again. We have a lot of initiatives in place to improve the security of our products overall through both awareness raising (training, newsletters, security puzzles) and technology changes (scanners, static analysis, framework hardening).
P.S We're always looking for security people to join us at Google (send me your resume, email in profile) or by bug hunting for bugs to submit to our vulnerability reward program.