ejcx

I think it's the author's name for perimeter based security

I'm sure Marriot had an IDS that created 10000+ alerts per day.

I'm sure they also had a credential rotation policy, hired 3rd party pentesters, had a vulnerability management program, etc

Securing systems is really hard. A lot of the old school recommendations create more issues than they solve, like rotating every database login password every 90 days or so.

I ALWAYS run 3rd party JavaScript on my payments page. That's what Stripe is, after all.

In this blog post the author identifies probably 1 questionable third party resource. As scary as it sounds it's not exactly easy to just compromise major JS providers and start stealing cc data. It's possible but instances of it happening are extremely rare.

Knowing what you're loading is more important than not loading anything. It's not realistic to expect no third party js in today's world, and even versioning+SRI has issues because it solves one problem by creating a new one.

There are actually quite a few aspects of your blog that I think we will emulate in the near future, with a twist, to solve more similar problems. This problem set was super different though.

Adding a public facing SSH interface to our production hosts was a bit of a non-starter and we would have had to hack together auth on top of that (not just for us, but for our customers too). That's a lot of additional surface area and operational burden we didn't want.

BTW we should catch up over a beer sometime =]

So much cloud encryption is a total checkbox. As a security professional I sometimes don't have a clear threat model that the magic crypto is meant for.

I work at Cloudflare, but regardless think this is awesome for security. Being more resilient to coffee shop type attacks and other DNS issues is great. It's a really user friendly and simple step in the right direction.

I live near your new place on Polk. Love it. Keep it up!

It's amazing to me how volatile tech stocks are even today.

I remember buying Amazon and Netflix 5 years ago when each of them fell 33% on an earnings miss and it has worked out really well buying on "miss".

Hacking a company is against the law. Full stop.

Seems like a knee-jerk reaction. In reality it will probably be more than a year before anyone even notices any change to GitHub associated with the acquisition.

Chrome.

This is not the feedback you're looking for, but I honestly could not stand how something has hijacked the scroll wheel up and down.

I think the hardest part is the planning process and communicating rapid change.

Startups and fast growing companies grow quickly and changes happen rapidly. If priorities are constantly changing and communication/the planning process isn't really robust you won't have remote people who are successful.

What we REALLY need is these Micronesian money stones to be logged on the immutable blockchain.

I love this! If you're a part of a security team and you are not automating your processes and procedures then your team is going to drown. You must automate.

It seems like some simple checklist app but having a non Jira process that takes only a few minutes is so valuable, and "security reviews" and "threat models" as part of your SDLC take insane amounts of time and honestly aren't super helpful.

I've worked with quite a few people at Coalition and know a lot about them. This is a pretty neat company and team in a really boring space, which I think means there's a ton of opportunity.

No our DNS is fine. Some folks have issues accessing our site if their ad-blockers are on.

Segment | Engineering | SF, Vancouver | Full-time | https://segment.com

Segment is growing quickly and hiring great engineers to help us scale our engineering org. If you would like to see all of our job postings, https://segment.com/jobs.

Some work that our engineers are doing:

- https://segment.com/blog/the-million-dollar-eng-problem/

- https://segment.com/blog/5-advanced-testing-techniques-in-go...

- https://segment.com/blog/secure-access-to-100-aws-accounts/

I'm a part of the security team and would love to find software engineers who are interested in learning more about security, or experienced security engineers! Here are a few roles we are hiring for:

- Cloud Security Engineer: https://segment.com/jobs/1085006-Cloud-Security-Engineer

- Senior Product Engineer: https://segment.com/jobs/1031768-Senior-Product-Engineer

- Site Reliability Engineering Manager: https://segment.com/jobs/1027425-Site-Reliability-Engineerin...

Those are CSP violations not CORS violations.

There are different levels of maturity with your security headers, and Sqreen's cookies are scoped to a completely different subdomain my.sqreen.io versus www.sqreen.io. It looks to me like they are doing everything right.

There is no shame in having your CSP header in Report Only. It's complicated to manage your assets, especially when using a tag manager where it's not obvious what the hell the URI/hosts are that will be loaded.

But, if you're using vault for only Secrets Management on AWS you are using a nuclear warhead to destroy an ant-hill.

It's quite frankly not a good experience and really challenging to automate running Vault in a modern environment, all something that is very simple with SSM.

You note this, but I have 2-3 people reaching out to me per week stuck/struggling with vault, who find chamber/SSM and have solved the problem with 1 day of work.

If Okta is down our infrastructure should continue to function and scale up and down as needed.

If there was an emergency we have our root accounts to recover access, but it's a good point that we should probably have a second IDP as a backup.

Hey. I'll make sure to update the blog to include a shout-out to aws-vault! We were heavy users for the last few years.

We are sometimes wary about contributing stuff like this upstream because it's not always accepted, and then we are in a weird spot maintaining a fork (it happened with the bitly oauth proxy when we added okta support). I'll see what type of work it would take to make it fit in to aws-vault nicely!

AWS has a lot of resources that are not per region.

The GDPR line is about improving our least privilege access story. There's a lot more to GDPR than that, though

We use ECR and have all of our images in our hub account, and make them readable from the prod/stage/dev accounts using a cross account policy.

For S3, it's more complicated because of object permissions and all the insanity that comes with cross-account writing etc.

Edit for more info: No explicit promotion process for containers. Engineers build images in our CI pipeline when their pull request is approved and merged to master, which is pushed to the hub account.

Op here. I don't think you read the blog post! Our entire engineering org has a grand total of 0 AWS keys!

Per-account isolation is great for security and especially reliability, if you run in to constant ratelimit issues like we do.

OP here. You _can_ do this but IAM Policy wise it is a mess and not very maintainable.

You end up needing to constantly grant and revoke access to individual resources if you went this route. Instead, it's nice to give engineers access to everything that's in their account, and not worry about IAM policies.

I honestly don't know of the feature parity between the two, but we are definitely Okta power-users having added close to 500 apps in the last year. I don't know if we could drive all of the same processes we have built (especially on the HR side) using GSuite.

Thanks for posting this here. I'm the author of this blog post. Feel free to ask me any questions you might have.

Just weird and a bad blog post. The author also wrote this: http://scripting.com/2018/02/23.html

The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure, is what I can gather

In the last few weeks he's also wrote:

- http://scripting.com/2018/02/21.html

- http://this.how/googleAndHttp/

- http://scripting.com/2018/02/08.html

Must be nice to be Quintin Clark. Showed up in Sept of 2017 and was awarded $34MM worth of stock according to this S-1.

It looks like a healthy business. Congrats to dropbox.