klt0825

By reading from the actual memory address, yes. Defeating kASLR with side channels is meh. Reading from actual addresses is a different matter entirely.

Bigger than KASLR it seems.

https://twitter.com/brainsmoke/status/948561799875502080

Not good.

"Do you think maths is discovered or invented?

To tell you the truth, I don't think I know a mathematician who doesn't think that it's discovered."

Anyone else struck by this? It has really never occurred to before that I've always assumed that we were simply discovering math versus creating it.

Seeing this at 11 is honestly what made me interested in computers and pushed me towards my current career, so seeing that it is 20 years old is sort of a shock.

I can also certainly can relate to the portion of the audience that found phreaking much more interesting than hacking and the fact that the phreaking scene is all but dead is pretty sad.

I tend to agree with most points. I always credit my undergraduate CS education with teaching me about how to think about a variety of computational problems using a variety of languages as lenses. I actually think that is why I've been able to succeed in a number of different development roles (Web Developer, Mobile Developer, Reverse Engineer). If I had had multiple semesters of learning only language/framework-X features, I think I would have been worse off for it.

That being said, it did take me a while to appreciate that this was what my education gave me and obviously, no approach works for everyone.

For now. Reading into it, it seems like they found one of the useful UAFs that facilitates a memory write instead of your less useful CALL virt_func. Flash is just a means to create an infoleak by over-wrting the vector length, it is likely that you could do the same without any dependencies by just targeting IE itself.

This is actually one of the reasons I do what is now called "Intermittent Fasting". I found in my teens that I was much, much more focused and alert on an empty stomach. I've always assumed it had to do my insulin response to meals as low-carb diets had a similar effect but not eating during the day was just easier.

Agreed, don't run AV at all. It is always fun to take something from metasploit, see that is detected by most AVs - change one or two strings that are obvious choices for signatures and watch detection rates drop to close to 0. Even behavioral or heuristic detection is absurd sometimes (IE is writing into the process memory of notepad? Probably fine). It is a really tough problem to solve, to be fair to AV vendors.

I would be interested to see what the blood levels of EPA/DHA were in the patients studied, the article isn't really helpful in that respect and it may be important.

Burnout in tech circles is like Depression in the population in general. 90% of people who say they have it really don't and the people who say it doesn't exist have no idea what in the world they are talking about. But for those who have it, it is un-mistakenly terrible.

I put in 80+ hour work weeks for 4 years straight at my last job and it got to a point where I was physically breaking down and developed a slew of transient (but terrifying) neurological problems. It got so bad I actually saw a neurologist who basically said that I was seeing the manifestation of extreme stress and had to stop (He actually pushed me to find a new job, interestingly.)

To your point, it never dawned on me that I was working too much. I had various problems that needed solutions and I was much too engulfed in the pursuit of their solution to really see what was happening until it became impossible to ignore. I'd venture to say most people with burnout are not driven there by someone or something but by themselves.

2 is particularly relevant and more than solid grasp of CS is required depending on what you choose to do within the field. Malware Analysis for example can require understanding data structures, calling conventions, x86, compiler internals, etc.

Security is actually one of the few fields where I think you see a really interesting mix of theoretical and applied CS. Things like complexity theory, formal program analysis, etc pop up quite often.

Frankly, this is a bigger problem that isn't nationally recognized. The mayor is under federal investigation for his campaign and I've lost count of how many officials have been arrested or investigated at the federal level.

Living near the district, I'm shocked daily by how nobody seems to care that the corruption is so widespread.

I couldn't agree with you more. I actually said this at my last job interview when asked why I was leaving. I've learned more in the last 6 months being surrounded by much smarter people than the 6 years of being "the smart one".

I won't lie though, the ego-hit of being "the dumb one" when surrounded by truly brilliant people is hard - 100% worth it - but hard.

"Snowden's hacking prowess"

So we're back to this. First the "Snowden had a Hacker Certification" nonsense (ignoring that CEHs are required by DoD for OPS jobs and aren't exactly high-quality to begin with) and now deleting log files equaling "hacking". I guess it is easier to make him seem like some super skilled hacker than admit that oversight and access controls were probably non existent.

Selfishly, I really don't even care about Snowden at this point but I do fear that the trend developing is to paint him as a "Hacker" putting security researchers as the next major "threat".

Not a Snowden fan in the least but ignoring the fact that CEH certification is "highly valued" for quite a few DoD jobs (http://www.eccouncil.org/Support/dod-8570), this reeks of attempting to write off terrible access controls and oversight on whatever network he had access to by pinning it on those terrible "hackers".

I am sure these hackers are going to need to be dealt with using new invasive legislation, right? So frustrating.

Exploits or vulnerabilities? If they are handing out fully built exploits, I have a problem with it. If they are just vulns then yeah, it is probably MAPP which isn't news really.

I've been reading far too much about the downsides lately when trying to decide if I want to do it, so this was a fun diversion. I'm 28, fresh out of a CS MS program, work full time at a job doing computer security 'research' and really still feel like I don't know as much I as I want too.

Interesting, the question about family/friends is what peaked my interest. My girlfriend of 10 years is about ready to kill me if I commit 4-6 more years.

This hits home as I just finished a very well known part-time course-work only (with a pseudo-thesis option) program.

I actually have a little different opinion - what's killing the value of an MS in CS is the fact that CS curriculum is becoming Software Engineering under a different name. Let me be clear - there is NOTHING wrong with Software Engineering but as someone who is more interested in NP completeness, computability, static analysis, machine learning, etc - much of what passes for CS cirriculum in course-work only programs simply isn't.

I wish more universities taught courses along the lines of real 'hacking', or at least close to it. I just finished a course about Malware and Vulnerability Analysis/Reverse Engineering as part of my MS and it was fascinating. What is also interesting is that you actually have a fair bit of traditional computer science topics mixed in (SAT solving, algorithm analysis, compiler design, etc) but in a way that is so much more interesting than they are formally taught.

I'm not opposed to this at all but I question how exactly enforcement would/can work. We don't know with 100% accuracy who was responsible for Stuxnet, Flame, Operation Aurora, etc and especially with code, it is going to be exceedingly difficult in most cases to get evidence such that blame can be leveled with any certainty.

That was actually my first thought as well. To be fair, it was C with Simple Object Orientation so not quite as terrible as misidentifying C++ straight up though it was still a bit of a fiasco.

From their perspective, I'm sure (over)hyping everything new they analyze as the next 'big deal' helps business even if they are wrong about the details on occasion.

Almost always when I visit. There are very interesting things that just never make it to the top-stories for one reason or another so I don't want to miss them.

I have been keeping a list of books I used to augment my CS Masters Degree courses on various topics, here are the relevant ones I have found useful for the topics you have listed:

--Computer Organization--:

Computer Systems: A Programmer's Perspective http://www.amazon.com/Computer-Systems-Programmers-Randal-Br...

I liked this much better than Computer Organization and Design by Patterson and Hennessy which everyone has encountered at some point. The developer-centric view was very cool.

--Computer Security--:

Kernel Exploitation: Attacking the Core http://www.amazon.com/Guide-Kernel-Exploitation-Attacking-Co...

Most 'hacking' books are goofy. This one is very good and doubles nicely as a hackers operating systems text.

Web Application Hackers Handbook http://www.amazon.com/Web-Application-Hackers-Handbook-Disco...

Very nice overview for web concerns.

--Operating Systems-:

Operating System Design and Implementation http://www.amazon.com/Operating-Systems-Design-Implementatio...

I don't agree with Tanenbaum's views on micro vs. monolithic kernels but this book is a great mix of theory and implementation.

Linux Kernel Devleopment http://www.amazon.com/Linux-Kernel-Development-Robert-Love/d...

I used this to get a feel for the monolithic implementations of topics covered by Tanenbaum.

--Networking--:

TCP/IP Illustrated Series. More than you would ever want to know.

We used Concepts of Programming Languages (http://www.pearsonhighered.com/educator/product/Concepts-of-...) in my undergraduate Comparative Languages course which was very good and seems to cover much of the same material as the course.

I sadly lost the book when I moved but I remember loving both the book and the course and learning a ton thanks to seeing a number of different language types side by side. I have fond memories of trying to wrap my mind around Prolog the first time I saw it.

I think people underestimate how their relatively late release hurt them for the low-tech consumer. A number of people probably went with Iphone or Android before the first WP devices came to market and now are too entrenched to change.

For developers, I think the same story holds true. I know a number of people who were fairly excited for the platform but ended up going with something else because they got tired of waiting for the original release and wanted to start writing apps to make money. The reputation MS has developed (old, evil, bloated, etc) also doesn't help. Not saying it is true, just that it exists.

At 27, I agree. I wouldn't work for pennies to be able to solve interesting problems and learn new things but I would certainly take less if it was reasonable.

It seems like at most companies, developers have a shelf-life before you are too experienced to hire or are expected to move into management. I don't know that anyone should fault people for taking full advantage of their earning potential while they can.

This is a very good point. I thought I knew a lot about programming/CS until I decided to get my M.S. Now, the more I learn, the more I realize I don't know.

It is actually a little defeating in the sense that I have had to accept that I will probably never know as much as I would like to.

MIR seemed to have broader coverage of evaluation metrics for IR systems, better coverage of UI related concerns such as interface design, better coverage of Multimedia retrieval and better coverage of web-search.

I liked intro to IR better for almost everything else. For the size of MIR, the coverage of things like LSI, Clustering and Probabilistic Models seemed shallow in comparison.

I actually used this as a supplement to Modern Information Retrieval (http://www.amazon.com/Modern-Information-Retrieval-Concepts-...) for my IR class this semester. I found the Stanford book to be much more detailed in terms of the mathematical formalities behind the models/concepts and ended up preferring it.