HNHacker News
TopNewBestAskShowJobs

gavingmiller

2,058 karma · joined May 9, 2010

Director of Application Security
submissionscomments
gavingmiller··on 1 bug, $50k in bounties, a Zendesk backdoor
It’s a good callout, shouldn’t have editorialized like that.
gavingmiller··on 1 bug, $50k in bounties, a Zendesk backdoor
Not even close to the point I was making: If you want to get taken seriously, write to audience.
gavingmiller··on 1 bug, $50k in bounties, a Zendesk backdoor
The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of reports - without clear impact, lots of vulnerabilities look like "just another bug". Notice that Zendesk took notice once mondev was able to escalate to an ATO[1]. That's impact, and that gets noticed!

[1] https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b...

gavingmiller··on 1 bug, $50k in bounties, a Zendesk backdoor
zendesk is 6k employees, they have general council on staff
gavingmiller··on Include diagrams in your Markdown files with Mermaid
3 is hardly a sea shanty of vulnerabilities for a 7 year old library. I think you're conflating releases with vulns.
gavingmiller··on SolarWinds CEO blames intern for password leak
In no way is this an interns fault. If your entire infrastructure relies on the secure password of ...

checks notes

... a single intern! then you're doing it wrong.

gavingmiller··on Slack account takeovers using HTTP Request Smuggling
Anyone know if the `smuggler` tool used is available online? Can't find any reference to it in github or elsewhere, and I'm not familiar with it.

Edit: Found it here: https://github.com/gwen001/pentest-tools/blob/master/smuggle...

gavingmiller··on Thank u, next
> Why’d he quit? ... he told me this: at each stage of a company’s growth, they have different needs. Those needs generally require different skills. What he enjoyed, and what he had the skills to do, was to take a tiny company and make it medium sized. Once a company was at that stage of growth, he was less interested and less good at taking them from there.

This is an aspect that gets overlooked in many businesses & careers. I've heard it phrased that companies go through 3 stages: Startup, Scale Up, Optimize. The above quote is a sub-stage of Scale Up. Some people are built for just a single stage and knowing how and where your skillset fits in is crucial to career happiness. As well as knowing when to encourage employees to move on.

Great post and I wish @steveklabnik continued success in his career!

gavingmiller··on The Devil's Hair Dryer: Hell is other people, with leaf blowers (2016)
> TVs blaring in waiting rooms when you'd prefer to just sit in silence.

When I can, I turn the TVs off. No one has complained yet.

gavingmiller··on Losing 100 pounds in 276 days
> Getting motivated to lift 2x a week is another issue...

Was in the same boat until I started doing group classes. Used that to build accountability, motivation, and a "vocabulary" of how the gym works. Now I could spend hours at the gym by myself and love it. Find what works for you, cuz lifting is a blast!

gavingmiller··on Ask HN: What mistakes in your experience does management keep making?
Not training managers on how to manage.

When devs are promoted into management or team lead positions they are not given adequate training on what it means to manage / lead. Thus devs don't learn what good management is, and the stereotype of the bad manager perpetuates.

gavingmiller··on Cisco's Talos team analysis of WannaCry worm
Password protected zip. And/or wrap in another zip is usually enough to thwart Gmail
gavingmiller··on List of Sites Affected by Cloudflare's HTTPS Traffic Leak
As a happy customer of 1Password, it would be great to see you connect with Have I been pwned?[1] for watchtower notifications.

[1] https://haveibeenpwned.com/

gavingmiller··on DHH answers: What makes Rails a framework worth learning in 2017?
corrected - thanks
gavingmiller··on Rails 5.0.1 has been released
I'd love to DM you with some questions about Toronto. Can you ping me via my profile info?
gavingmiller··on An insider's look at what he gave up to create a classic game
> 'progressive' practices such as unlimited vacation

Unlimited vacation is not progressive and it is also unhealthy.

It causes feelings of guilt while on vacation. Often there's an unspoken obligated to check-in (email & chat) when on vacation. And leads to taking fewer vacation days not more. When leaving a company, they have no obligation to pay out accrued vacation days since there is none defined (this may be a Canadian thing). Additionally, it can also come with the unspoken culture of overtime, since it can easily be made up with "more time off".

Having worked with unlimited vacation, if I am ever offered it again, I will decline and negotiate defined vacation into my employment agreement.

gavingmiller··on A Tale of Security Gone Wrong
Your solution of mapping to a grading system A,B,C,D; or terrible, crap, better, best was mentioned in another thread about this article. It's a common thought, however it's incorrect because you're still leaking substantial information about passwords. By storing entropy of any kind: whole number, graded, > threshold, etc you are weakening your password hash. This is completely unnecessary where better solutions exist: TFA
gavingmiller··on A Tale of Security Gone Wrong
It's an assumption on my part, and anecdotally a correct one. Having included this entropy example in a number of talks and asking the audience what's wrong, the majority of the technical audience did not know, nor did they have an appropriate guess.
gavingmiller··on Work in Silicon Valley and Spooked About Trump? Canada Wants You
One friend is in a townhouse in North Vancouver. Rented for a while, then bought. Real-estate is stupid silly there. I've also heard talk of people moving to Victoria as an alternative.
gavingmiller··on Work in Silicon Valley and Spooked About Trump? Canada Wants You
I can speak a bit for western canada; Vancouver has seen many of the larger/top companies open offices: Microsoft, Facebook, Amazon, etc. so plenty of jobs to be had there. I live in Calgary and have seen many peers move to Vancouver for better job prospects.

Re: SRED credits - I've been a part of the application process twice. Documentation can be a bit cumbersome, but not much more than 5 minutes summarizing the weeks work in a spreadsheet (for each employee), and tracking their hours spent on related tasks. Add in source control and the numerous artifacts that software devs come up with, means low amount of effort for high payout. And by high payout, I'm talking 1-2 devs salary in a 10 dev shop. We also hired a consulting company that specialized in SRED applications which saved us a ton of overhead. Cost 10-20% of payout, but was worth not having to deal with the application and/or any audits had they occurred.

gavingmiller··on 2016 Stack Overflow Developer Survey Results
Question - are you primarily a windows or mac developer? Because the counter part on mac is sublime text and I see a ton of that!
gavingmiller··on Millennials Flee Vancouver for More Affordable Cities
I'd agree 100% on this. As a Canadian, looking at our future career prospects it is in our best interest to learn how to work well as remote employees.
gavingmiller··on Nissan Leaf electric cars hack vulnerability disclosed
Troy Hunt's original story has more technical details which are worth the read: http://www.troyhunt.com/2016/02/controlling-vehicle-features...
gavingmiller··on Request For Research: Basic Income
This has actually already been studied/tried in the 70's in Dauphin, Manitoba [1][2]. The experiment saw a decrease in accidents, injuries, and mental health issues.

[1] http://www.cbc.ca/news/canada/manitoba/1970s-manitoba-povert...

[2] http://www.winnipegfreepress.com/local/dauphins-great-experi...

gavingmiller··on TrendMicro Node.js HTTP server listening on localhost can execute commands
That's not what this means at all. In any given company there are X individuals across Y teams involved in deploying a piece of software (never mind an emergency patch). Stakeholders in this context refers to all those involved to make it happen: devs, QA, PMs, documentation, marketing, etc.

The problem isn't solved as soon as a patch is released. This is serious damage control. Handled poorly it blows up. A lone dev doesn't/shouldn't hold all that responsibility.

gavingmiller··on Hello Barbie Security Concerns
Moving the obvious Privacy & Security implications aside, the idea of accessing all of my child's conversations with their doll is disturbing. For parents using this "feature", it normalizes the environment of surveillance which has broad reaching implications for society as a whole: "I listen to my child's conversations therefore the gov't should be able to listen to terrorists".

The research cited re: "role playing helps kids cope with traumatic events is independent of a responding doll/toy", is powerful and parents are best served by creating an environment where a doll/toy is a safe place for confidences vs another vector for helicoptering your children.

gavingmiller··on Race conditions on Facebook, DigitalOcean and others (fixed)
This right here is the heart of race condition bugs, and is NOT race condition safe. When running multiple web servers and without a "validates_uniqueness_of" constraint on your database, multiple requests hitting multiple different web servers can claim multiple discounts for the same user. Problem only grows as your number of web servers grow!
gavingmiller··on MSBuild is now open source on GitHub
The value isn't in creating a new version of MSBuild. The value is in getting PR's merged into mainline. If you've ever done any CI based work, you'll know how valuable this release is! (says the ex .NET developer)
gavingmiller··on Speeding up Rails 4.2
Sam has also blogged about this for Ruby specifically: http://samsaffron.com/archive/2013/12/11/call-to-action-long...
gavingmiller··on Spec-me-maybe: Introduces the “maybe” syntax to RSpec
It does; considering situations where this would be seen as a realistic/novel approach for fixing flapping tests. No need to examine root cause! sigh
Page 1 of 6Next →