ejcx

Yes it’s unfortunately standard for expensive scanners too.

Our goal was to make something easy to run and deploy with similar results to something like openvas or Nessus.

I personally think accuracy issues are because security vendors don’t want to show that their expensive software found nothing, so they dial down the accuracy. This works using the same methods as a Nessus, banner grabbing and indexing issues.

We are going to keep working on this and look for ways to make it more accurate, but I’d say our results with this versus our expensive scanners was pretty much the same.

This is really our use case. A little bit of packaging around a pretty good vuln scanner you can set up in 10 minutes

I’ve managed Nessus in a past life and it was a nightmare.

Feel free to ask any questions you have. We have quite a few folks from Cloudflare's security team here.

350 people across a 25,000 person company sounds more like performance management than layoffs, especially since they are still hiring.

I think Uber has way overhired but this doesn't seem to be the signal a lot of you all are making it to be.

Cloudflare | Austin, TX | Security

I'm looking to fill two roles on my team. We have a great security team and work in an environment where we are kind of in the middle of everything. Everyone at the company loves working with us and we have a huge amount of momentum.

Corporate Security Manager. We need someone to help shape our IT and Corporate Security roadmap and the future of our corporate security postures. This person will have a ton of ownership and influence over the way our company works.

Senior Product Security Engineer. I'm looking someone who can own the security of our newest products, coming out of our product strategy team in Austin. This person will work closely with our engineering teams things to securely build things like Warp, Cloudflare Workers, etc.

Feel free to email me directly. My first name evan at cloudflare's domain.

It's not rooted in reality and a gross oversimplification of the problem. GSuite is exposed to the open internet. Dropbox is exposed to the open internet. All of these services have permission models with "elevated access".

1) Your idea has been shown not to work (it's called perimeter security) 2) With the huge shift to cloud services you need a new solution anyways

From the blog posts slack has released we know nothing about their security practices.

They have a lot of high quality security features and you can see they actually work because they alerted Max that his account was compromised.

Saying their security practices are extremely poor based on an incident they had in 2015 when their company was 1/20th the size it is today is ridiculous

You can read our SOC3 (public facing SOC2) if you're curious about your availability question: https://www.cloudflare.com/compliance/

There's a lot of good info in there

Congrats Tejas!

Really interesting stuff here. The little cluster in North Carolina is "Amazon Wind Farm US East".

I wonder if Amazon announces an electricity play soon, or if it's just related to sustainability efforts? Their use of wind is actually described more here: https://aws.amazon.com/about-aws/sustainability/

There's more than one way to burn out. Some employees will push themselves to burn out. I know first hand.

You're correct. No js bloat. In order to load Js files it has to be in accordance with the AMP spec and they have a strict list of js you can load.

I don't think anything about Bowie or PG county is notable given its location. The entire DC area is propped up by the defense industry.

Everywhere else in the country is really different. DC didn't even experience the 2008 great recession

Cloudflare | SF, SJ, Austin, London | Onsite | https://cloudflare.com

Cloudflare's Security team is hiring a variety of different skillsets. We are looking for people who can take ownership over the security of specific parts of our stack.

    - Edge Security / Infrastructure Security
    - Product Security / Application Security
    - Technical Program Managers 
    - Identity and Access Management
    - much more.

If you have any questions please reach out.

Way to go Rick! You know you've made it when people write blog posts about your hot takes on Twitter

I'm not a C# expert by any means. Is the IntegrityHash of the plaintext, and not the ciphertext? https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

That would be a really serious flaw. If not, hand rolled AES-CBC-SHA256.... why not just use an AEAD implementation? This is exactly why I look at these. There's a lot of nuance to that one decision, and so it usually gives quite a bit of signal about the project as a whole.

The first thing I do whenever someone writes their own password manager is to read the Encrypt function. This one is AES-CBC with its own hand rolled integrity scheme. Not very strong by modern standards

Cloudflare | SF, SJ, Austin, London | Onsite | https://cloudflare.com

Cloudflare's Security team is hiring a variety of different skillsets. We are looking for people who can take ownership over the security of specific parts of our stack.

    - Edge Security / Infrastructure Security
    - Product Security / Application Security
    - Security Compliance
    - Identity and Access Management
    - much more.

If you have any questions please reach out.

Cloudflare's Security team is Hiring.

We are hiring across all of our security teams. Program Management, Edge Security, Infrastructure Security, and Product Security.

Our security team works closely with every part of the company. From the Warp product that was announced today, to legal, customer support, engineering, sales, etc. If you're interested, please apply or reach out.

https://www.cloudflare.com/careers/departments/security/

No browsers present that to users as a secure context, so nobody is being tricked.

More HTTPS == Better. If you can load this over HTTPS you should, no matter what circumstance. The browsers iconography will handle notifying people when the context is secure or not.

Good to know. I will buy this doc and give it a read, thanks.

Jtsummers, I don't disagree with you. The reality is the DO-178C is no different than PCI or other compliance standards, and there are ways to game it with docs.

With that said, if formal methods were really required to fly the plane then they would add it to the DO-178[D] without hesitation =]

Even aircraft software doesn't require formal methods. I have a copy of the DO-178C on my laptop. It's mentioned once in the glossary, once in the appendix A, and once in appendix B.

Formal methods would be great, but most people don't have extremely complex state machines where lives depend on it being right.

My bet on Apple is they miss their phone production projection and blow away the services and accessories projections.

Thanks. Candidate experience is super important so having a bad interview experience sucks.

We try to run a pretty tight ship on the security side of things, and I know most of the other hiring managers are the same way.

Personally, I make sure I give every candidate I talk to my work email address and invite them to email me if they have any questions or snags in the process.

Im a Hiring Manager at Cloudflare on our Security Team. We are hiring in San Francisco, San Jose, Austin, and London. Our Security Team is looking for folks with a variety of skillsets. https://www.cloudflare.com/careers/departments/security/ Our company is growing quickly, has tremendous impact on the internet as a whole, and bringing to market some of the coolest and technically challenging products to build.

We need help:

  1) Working with other teams to make our product great and secure.
  2) Detecting, monitoring, and responding to security alerts and incidents.
  3) Securing the platform and infrastructure that runs our 155+ datacenters.
  4) Working as a program manager to drive company wide security initiatives.

Im a Hiring Manager at Cloudflare on our Security Team. We are hiring in San Francisco, San Jose, Austin, and London. Our Security Team is looking for folks with a variety of skillsets. https://www.cloudflare.com/careers/departments/security/

Our company is growing quickly, has tremendous impact on the internet as a whole, and bringing to market some of the coolest and technically challenging products to build.

We need help:

  1) Working with other teams to make our product great and secure.
  2) Detecting, monitoring, and responding to security alerts and incidents.
  3) Securing the platform and infrastructure that runs our 155+ datacenters.
  4) Working as a program manager to drive company wide security initiatives.

It has nothing to do with law. That's just the easiest way to send them data, especially when some apps might not have back ends

I met quite a few folks on the Plaid engineering team and was really impressed with the people I met and how they were approaching building their product. Congrats to them, and a lot more work to do!

Im a Hiring Manager at Cloudflare on our Security Team. We are hiring in San Francisco, San Jose, Austin, and London.

Our Security Team is looking for folks with a variety of skillsets. https://www.cloudflare.com/careers/departments/security/

Our company is growing quickly, has tremendous impact on the internet as a whole, and bringing to market some of the coolest and technically challenging products to build.

We need help:

  1) Working with other teams to make their products great.
  2) Detecting, monitoring, and responding to security alerts and incidents.
  3) Securing the platform and infrastructure that runs our 155+ datacenters.
  4) Working as a program manager to drive company wide security initiatives.