k4ch0w

Usually there are mailing lists you can sign up for, but they can be spammy. Organizations I have reviewed have a vulnerability scans happen every month. I think it's a best effort kinda thing unless you have a dedicated security team monitoring daily. The juicy bugs will usually make their way into your front view like ShellShock, Heartbleed, Spectre, drupalgeddon etc. I'd say just by the willingness to ask this question and stay on top of updates you should be fine.

New vulnerabilities are discovered everyday and it doesn't even include the ones that are never publicly disclosed.

Salesforce pays me much more than what Google talked to me about, So this isn't true. MSFT also was pretty close the SF offer for me as well. I also have friends at Netflix and they make much more than what Google offered them. I'm in Security so it may be different for Devs.

I have limited experience by building my own apps for learning purposes. Getting CSS working in multiple browsers exactly the same is always a pain point.

I'd second this class. I have done both and if you're brand new to machine learning I'd do fast.ai first. You gain a greater understanding from Andrew's course, but if you're not going to become a practitioner fast.ai is better.

Thank you OP I haven't laughed that hard in a while. I honestly have no words for some of them. Water 2.0?!

I would say learning a bit about the security implications involved. You don't have certain things given to you like other languages.

You have to watch what compiler flags you use, like someone turning off stack cookies, not using clang's sanitizers. Check out https://clang.llvm.org/docs/AddressSanitizer.html it would have prevented the Heartbleed vulnerability if it existed at the time.

You need proper bounds checking everywhere! You should fuzz your code with something like AFL and if you don't have the time to setup test cases for it, just send your program random junk and see if you can get it to seg. fault.

Multithreading is hard, and detecting multithreaded bugs is even harder. Random monkey testing can sometime's help find these, but they are very hard indeed. Monkey testing is just literally if a monkey was smashing your keyboard and your program was open, what would happen?

Know the most vulnerable function calls by taking a look at banned.h from Microsoft's SDL. It looks like it's no longer on the official website, but the author put it up here Take a look at https://github.com/x509cert/banned/blob/master/banned.h. Sometimes you can't avoid using these functions but know why they can be considered bad.

A proper Makefile is your team's best friend. The same can be said with one build machine for your whole team. It is easier now than ever to build and distribute it between your team with Docker. This is just a personal opinion, but I think downloading all the exact library versions you need once and putting them in a Docker image will save your team some pain in the future.

I think the OSCP is a great place to start. As others have said in the thread, go bug hunting, do a technical write up and go to meet ups/conferences. I have always been able to get a better job by networking and meeting people.

AI, specifically GAN's I expect to see more cool use cases.

Typescript will be more heavily adopted.

I am seeing more startups using GCP over AWS, it'll be interesting to see if this continues. I do a lot of due diligence and is purely speculation on personal experience.

Kubernetes in use for development using minikubes on individual developer machines.

Privacy concerns by the general public and what happens with their data. I don't expect an uproar in 2019, but I think people are realizing how much is collected on them.

I share the sentiment that a recession is mounting, no one can time the markets though. Ideas that make me lean that way are ridiculous valuations on non profitable businesses, Corp Tax cuts are ending, uncertainty in what China is doing, rise of gig economy with a decrease in steady income and fresh grads with a unwanted degree and high student debt loans. We may be at the later stage of a debt cycle too according to Ray's book. Check out https://www.principles.com/big-debt-crises/.

Hackintoshs, its a lot of work and really buggy.

Vi is on every linux server.

Easy to move between words, sentences, pages.

Macros are amazing.

IDE's are really, really slow to load when you just want to edit one thing.

Sometimes the syntax highlighting errors that aren't there can be an eye sore, ES6 syntax on Webstorm for example.

So many things seem unnecessary in an IDE, I won't ever need some tab or button, so why clutter my screen with it? I would say it's also true for a lot of the features you get. You probably don't need most of them, but there they are distracting you.

If you get the CISSP and are a good manager you will most likely end up triaging bugs and not actively testing. This is a compliant I have heard from new members on our team. Security isn't always sexy, and people actually get pissed off at me for breaking shit and halting releases. At the end of the day too, no one gives a shit if I break into a box, they just want me to tell them it's secure enough today. It can be a thankless job sometimes.

You don't need a SANS class, they can teach you a lot but there are places for newbies that get more for much less. It's better to get a job and see what they need you to do on a daily basis, then choose a SANS class to get better at that specific skill. I'd just put your resume in now as a sysadmin and see what happens. We hire plenty of people with devops/sysadmin backgrounds and teach them as we go.

Certifications are pretty much not required. Some are seen as a joke and will actually get you weeded out if they are on your resume.

Compliance is very... very dull and is seen as a joke to serious security folks because the bar is set very low. I would say avoid this completely if you want to enjoy coming to work. (Sorry for compliance folks out there)

Six figures is common for a lot of people on here. Security makes more than some software devs depending on your skill level and company. I don't know what you do now, but you would most likely be matched or higher depending on how strong your skills are.

I'd say the hardest thing is you always have to learn new technology and keep up to date with the latest trends. CI/CD pipelines, containerization, blockchain (rolls eyes), cryptography, different cloud environments, smart phones, cars, etc. You will almost definitely encounter something you have never seen before and need to learn as much about it as possible in order to secure it.

Use a turtle

https://www.theverge.com/2017/11/2/16597276/google-ai-image-...

When the debate is over, slander becomes the tool of the loser. - Socrates

I think just realize everyone learns to code in different ways and environments. Some people self teach and others learn in academia. You should respect that they learnt to code at all. I'd say just be honest in your reviews and help them improve. Don't be a dick about it, but honest and fair critique is something most people will appreciate.

I just like being here because I don't feel like I'm crazy for the thoughts I have. You guys make me want to be a better human by pursuing things that really matter and steering me away from the BS other people get dragged into.

Things of value added were

Deleting my FB when other people are flabbergasted by the thought and I feel so much better for doing so.

Always looking for constant ways to automate my job to free time up to think/rest.

Realizing that working 80 hours won't get me some amazing outcome at a company because pursuing that game(the rate race) is completely out of my control.

Learning about stoicism and really realizing no one cares about me and that's not a bad thing, but a good thing.

I love to lurk here because people hold each other to a high standard of information. If you say something that sounds false, someone will call you out on it and ask for your source. I don't know any of you, but you are some of the coolest f###ers I have never met.

The people you spend the most time with affect how you think and what you do.

This is amazing for secure code reviews. I have already spun up and instance and am demoing it for my team.

Is it possible to get Jira integration?

Can you test bitbucket.org connection with credentials some place I am not seeing? I can't tell what is causing it to fail.

Is there a way to add markers in the code and then a queue to clear it? I.E I mark hotspots in the code and want a developer to review them or edit them.

I think a current pain point would be no flat file upload. I understand you only need the .git directory and this was designed with a developer in mind. A lot of times when doing a secure code review we don't get credentials, we just get a current clone of the code. I just tried to do it using the instructions and had some trouble ended up just cloning it on the host machine. I usually get a zip/tar of the code.

Another feature that would be awesome is export a search to a CSV file. I could script together something for Jira integration with that pretty quickly. Something to get the line affected #, branch and filepath.

The subscription to searches was a brilliant idea. I wish I thought of it.

SSO already integrated? Nice man!

I'd make the discussions default too, I discovered that after playing with it for a bit. It's an awesome feature.

I look forward to seeing more of it.

No micro-managing

Clear direction

Trust

Let me choose my own hours

Blocks meetings I don't need to be in

For Third party libraries I use https://github.com/jeremylong/DependencyCheck

Read how to win friends and influence people. I used to have similar issues and you just need to understand what people want out of an interaction. My crippling social anxiety is put at bay by constantly pushing past my comfort zone. It's a slow process but eventually it kinda just stops.

Well if you could change the source code on the voting machine it's something as simple as you show the Voter their choice to confirm on the frontend but the backend has been manipulated to always vote for someone else instead. The voter would never know their choice was altered. An example is as simple as the following:

def selectCandidate(voter_id, choice):

    if choice == 1:
       return {"Voter":voter_id, "Displaychoice": "Candidate 1", "Choice": "Candidate 1"}


    if choice == 2:
       return return {"Voter":voter_id, "Displaychoice": "Candidate 2", "Choice": "Candidate 1"}


    if choice == 3:
       return return {"Voter":voter_id, "Displaychoice": "Candidate 3", "Choice": "Candidate 1"}

    raise Exception("Should never happen :-p")

I'm much better at writing and understanding code than writing a technical blog. I tried once when I open sourced a new tool, but quite honestly it sucked. It sucked hard. I only ever published one post and nothing else because I just can't write as well as I code. https://samaritan.ai/blog/reversing-docker-images-into-docke...

I think too, you know people from work will see it and you also worry if it may affect the way they view you professionally.

It takes a lot of effort to make it pretty, convey the message and make sure the paragraph flow is there. It's a skill and I think you develop it with time. However, speaking for myself the return on investment just isn't there.

I have the same problem. You know I have tried 3 different types of noise canceling headphones and you and still hear the conversations. The other problem is when it's a particularly hard problem, I need no music to be playing.

I just don't go into the office at all anymore. I stay home and I just outperform people's expectations and that allowed me to negotiate to stay at home.

Open office spaces just do not allow me to get that deep focus to solve the challenging problems, also the constant tapping on the shoulders and the quick "How's it going" conversations take me out of flow. I don't think businesses understand how annoying the random noise is too introverted engineers. It's more productive for salespeople and PMs but I doubt it increases engineers ability to get features built. I think it severely hinders them.

It depends on the language it was compiled in. It'll help you retrieve the binary, but you need to use the right tool to get the source code from it. It's not different than download an app on your host machine. It just make it easier for you to see what people put in an image. Android/Java is a language you can get the entire source from excluding if they obfuscate it.

I would manage a private registry.

It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.

https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...

You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.

https://github.com/P3GLEG/Whaler

I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.

Alcohol - Only socially. Maybe 1-2 beers a month

Coffee - 2-4 espresso shots a day

Learn the OWASP top 10

Use vulnerable VM's and practice like Metasploitable and https://github.com/SecGen/SecGen

Get the OSCP

I also highly recommend being good at some programming. This is for source code review and quick scripts/exploit development.

iOS my mum struggles with the android. She doesn't understand how to get her photos/videos off it cause of the folder structure. I wish I got her one.

Check Google, Bing, Virustotal, Parse HTTPS Certificates including the metadata (Censys.io is great for specific queries), subdomain bruteforce with a good wordlist, download source code found in Github and regex search for HTTP urls, then parse them.

Now don't do it by hand people have already built tools. I recommend sublist3r https://github.com/aboul3la/Sublist3r, however, grab other subdomain bruteforcer wordlists and append them all together.

Go to https://opendata.rapid7.com/, download the reverse DNS and Forward DNS and grep for your domain. I.E grep "*.mydomain.com" These are amazing.

I will make a note, sometimes if you are looking for servers related to a company specifically people miss ones that aren't in a company's zone file. You need to use a service like Shodan or Censys which regularly scan the internet and index these. It can be a pain to parse through these results but if you are strapped for ideas on getting a foodhold try this. I have found some juicy servers with this in mind.

If you are on a pentest it is completely ok to ask your client for permission to view their zone file/route53 as well. This will save you a lot of time up front.

I think one cool thing teachers are doing is making the homework assignments available as jupyter notebooks. You can have the coding exercises there and a little write up about what they need to make happen and they can try things in real time.

I think CS can be a dry topic and not everyone will enjoy it. I think adding some visualizations like the videos from 3Blue1Brown can be cool. It's sometimes hard to visualize how an algorithm works by reading it. https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw

Best of luck