griffinmb

This is not the same company. The OP Tiny Corp accused them of Trademark infringement on Twitter, due to exactly this kind of misconception.

Agreed that there’s no way to do this meaningfully and securely.

Looking forward to the archeological audits of LLM-developed apps x years from now that are a total mystery to the product owners…

Yeah, it doesn’t fix the issue at all. Rough to have a security product demo be fundamentally insecure.

I created/maintained a popular project for years[^1], and recently passed ownership to someone else. It's been great seeing issues resolve, PRs merge, etc, after languishing for a while :)

[^1]: https://github.com/nccgroup/sobelow

The point is that with a powerful Effects system, devs calling the logger would have to account for the network call in their own code. Someone might have wondered why that was needed and gotten this addressed before it was ever widespread.

Effects can definitely help, but a strong type system allows you to encode security concerns for compile time feedback as well.

See https://gmb.is/refinement-types.html for a non-Haskell example.

Given that he's now un-retweeted it, it looks like even amasad agreed it wasn't a good look.

Based on your retweet[1], you still seem to be publicly punching down.

[1]: https://twitter.com/pnegahdar/status/1402018604233732098?s=2...

You probably know this, but correcting for anyone reading. C is generally considered statically but *weakly* typed.

It’s versioned, which is an improvement on “agility”

Yep, that’s the way!

This class of bug (CSRF bypass via route confusion) is probably more common in Phoenix apps. I’ve found a handful of apps vulnerable to this issue with Sobelow.

People create (for example) a get ‘/profile’ and a post ‘/profile’, and the action intended to correspond with post requests really just pattern matches against params.

I’ve also seen at least one app implement this properly, matching against the HTTP method as you described.

Sure, the "passive" was what I was calling out as incorrect. And as you noted, a compromised trusted CA affects all domains. Which is another thing this article gets explicitly wrong.

> If DigiCert’s Key Management System is compromised, all of their SSL certificates will have to be revoked and re-issued. But if one of the other CAs is compromised, it would not affect Medium’s site.

This is a horribly misinformed article, and is incorrect about the most fundamental arguments it is making. E.g. Among many other issues, it implies that a compromised CA would allow passive MitM.

Agreed that you don't gain anything if you're using 1Password. But users may be required to set up MFA to access something like GitHub organizations, in which case having it available in 1Password is convenient.

The docs don't seem to disagree with me.

> Besides, you shouldn't need to plug it that way to pair it either.

Agreed. And glad that's not necessary for the latest generation.

> You missed charging the Apple Pencil on the ipad pro.

You plug the Pencil into the iPad to pair it. It comes with an adapter that you use to charge it with a regular cable.

I made the switch from web development to security a few years ago and initially took a 10-15% pay cut. I didn't get any certs and wouldn't necessarily recommend them. Instead, I joined various bug bounty programs to get practical (and resume-lite) experience.

Having implementation experience (via webdev) in addition to the bug bounty experience was a plus when I was interviewing.

If you're in a tech hub like SF or NYC there is plenty of security work. But, yeah, I would expect some kind of a paycut since you are moving from a (potentially) senior position to an entrylevel position.

I mean, I read the codebase, which is why I'm saying it's small and easily understood. Sure, it has some specific things to know, and some ("magical") helpers like automatic view functions. But it's no more its own platform than any other micro-framework.

I'd be interested to know what you believe the ups and downs are, aside from speed.

Phoenix is really a very small framework, and its codebase can be easily understood in just a couple of days. Phoenix being "large" is a common (but unfounded) criticism that seems to stem from Elixir's superficial resemblance to Ruby.

*college

Also, it isn't entirely clear what you are trying to say. If you are suggesting that school-based screening is also problematic, then you are probably on the right track.

It has been more than 7 months since the issue was reported, I don't see how this lacks professionalism. They even created a temporary fix.

> Since launch Quit Genius has grown to 300,000 registered users, with over 20,000 people officially smoke-free in the app (which Quit Genius defines as having not smoked for over 28 days).

I'd be interested to know how "smoke-free" time is established. Are users self-reporting that they have or haven't smoked with the app? And 28-days of not smoking is great, but it feels dishonest to call that "smoke-free".

> Healthy employees save the company money and are more productive, and Quit Genius thinks it can not only help employees get healthier but give employers a way to track that progress.

Dystopian.

I think the issue is more that nonce reuse with stream ciphers like GCM result in a more catastrophic failure (i.e. secret key disclosure), whereas reusing the IV with CBC will only disclose whether some plaintext was encrypted multiple times. In an embedded platform where there is no easy way to ensure a nonce is not reused, the potential info disclosure may be preferable.

In general, I think Ruby does a good job of being unsurprising. I like that most things work as I'd expect, with the syntax I'd expect. But then you've got weird things like `File.read("|ls")` that are entirely surprising.

I'm sure it's possible to do this securely, but in general this seems like a sure-fire way to expose your secret keys.

Their response (on their homepage) is awful: http://nomx.com/

"nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx

- UK blogger makes false claims he can access nomx remotely

- UK blogger fails to access nomx remotely"

Could be useful for proof-of-concepts. Though, if you are a site-owner and your form can be submitted with this, you should probably consider implementing anti-csrf protections.

Unless I'm misreading it, the t-shirt is internal only, and only for the team that specifically handled the issue.

I believe that the real reason is that Webkit needs privileged APIs and unique executable memory regions for the jit. Giving third-party developers that access would make jailbreaking a simpler process.