jwcrux

This is absolutely the case (source: I'm a former pentester in charge of the social engineering).

SE had two guarantees for every organization we were hired to pentest.

* We would get the information/access we wanted

* It would be easy

Chris is a pioneer in this branch of the industry and has done a great job of highlighting the importance of social engineering through his research, books, and the CTF at Defcon (which is awesome to watch if you get the chance).

How is this different than /r/netsec, /r/pwned, etc.?

Generally, a system like this might work by handling queries via two ways:

* A "point" system - spend "points" (or credits) to find a user by license plate. * You can buy credits with money directly, or you can earn them by contributing information

That way, if you're a data contributor, you have access to the information without having to pay. That's how data.com works.

You can build golang from source pretty easily. If I remember right, it's just downloading the tarball and running ./all.bash or something like that.

Looks like standard security patches for libraries needed by Tails, not security holes in Tails itself.

I don't think Ghost is static, though. TMK everything is stored in a sqlite db.

Why not offer both options? Bring in a piece of code you want to talk about, or have the option to do a coding challenge.

Either way, you're asking the candidate to develop code, and then explain their decisions in a meaningful way.

Counter Strike: Goat Offensive

How is this any different than Magic?

Unfortunately, it's likely that in many cases the anonymity won't be preserved simply due to the probability of multiple candidates having the exact same job experience.

Take the example profile (which doesn't appear to belong to an actual person). We can create a google search that is something like the following:

site:linkedin.com AND intitle:" | Linkedin" AND intext:"Data Engineer" AND intext:"Distributed Systems Engineer" AND intext:"Software Engineer in Azure"

And, if it belonged to an actual person, would likely show up in the results. If there are multiple candidates with these titles, you can add more conditions, such as the employers to narrow it down.

Interesting. Do you have any more resources about how these bots are made?

> Only TREDNET (sp) has replied till now.

...And they said?

This would do it: inurl:"/ganglia" AND intitle:"Host Report" AND intitle:"Ganglia::"

Ok... did you tell Samsung before linking it here?

It was mentioned in the article, but the fork of Kippo by Michel Oosterhof (https://github.com/micheloosterhof/kippo-mo) is the way to go, since it has full SFTP/SCP support.

Otherwise, you'll see quite a few clients try to connect using these methods and fail immediately.

This is pretty much an exact replica of the methods used by the Internet Census of 2012.

That second sentence (initially targeting...) is quite a sentence. Maybe consider breaking that up.

Looks like ads.

That's ingenious - good work, and I'm glad it's working out well.

Put the macbook in an oven - should solve the problem./s

On a serious note, I'm not sure what it means for a cable to be corrupted.. wouldn't this just mean a bad cable? Could you elaborate?

Here's [1] an example of using Masscan to scan the IPv4 space for shellshock.

[1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

I'd be curious if this would be considered against the google compute engine ToS.

If so, it'd be simple for Google to wipe them. Otherwise, I have no doubt the tor directory authorities will be keeping an eye on these for malicious activity and will mark them as Bad Relays if any is detected.

It's possible the project doesn't (currently) have all the features they like when hosting on Github. Nothing says the project won't be moved in the future.

Whoops, typo - try here: https://jordan-wright.github.io/blog/2014/12/19/what-happens...

Also - I've added more information here: https://news.ycombinator.com/item?id=8775530

Assuming it's a legal entity that will be performing these seizures, I'm curious to know the case against these servers. To my (albeit somewhat limited) knowledge of the Tor network, these DA's exist solely to maintain the integrity and structure of the network, and to provide a list of known relays to clients.

I also understand that this list of trusted DA's is hardcoded into Tor clients. Since this is the case, I'd be curious how the network could be restored if there is a coordinated action on these servers.

Very cool. Twitter is a great ecosystem for providing useful bots. I, for one, am quite partial to my own Twitter bot, @dumpmon (http://twitter.com/dumpmon) which crawls pastebin and other sites looking for password dumps.

Neat! I maintain something similar here: http://github.com/jordan-wright/boilerplate.

This is very close to the Python Rapportive API library I have out on github: http://github.com/jordan-wright/rapportive.

Why not use PRAW? It's very mature, useful library using the Reddit API.