robotdan

What happens when you turn it off? Does that mean your child can say anything and receive anything from another user? Or is the incoming chat still filtered?

How can filter tech still suck so bad? My kids can't even use their chat without looking they speak in hash tags.

Did they build this in house?

The Inversoft guide posted does have a corresponding GitHub repo. https://github.com/inversoft/2016-security-scripts

I think scripting all of this is great - but also agree that it is important to understand what is being performed.

So many people get some of the most basic security wrong. It is great to see people trying to educate instead of just pointing out issues. Thanks for this work.

Agreed - it is a bit long. But if you want to set something up from top to bottom it may be worth it. Cool - I saw the link to Github as well, looks like there is code to do much of what the article outlines. Awesome.

Ha - I like it. I want to replicate this so that when our sales team closes a deal then can press a button and queue the noise! :-)

Looks like a good Friday afternoon hack.

While it is great to point out the security shortcomings and encourage better security practice. The ends justifying the means argument for illegal hacking seems vapid. It is still an illegal activity. I believe there is always a alternate motive.

A new virus? Oh, better stock up on Symantec Anti-Virus. How many virus's have been written by those selling you the cure? Security troubles? I'm sure there are plenty of security 'consultants' ready and waiting to take your money.

Maybe I'm too cynical.

A gamer? :-)

Any specific reason you guys chose MySQL over PostgreSQL or Oracle?

Dang - that thing is intense. May have to take an evening to get through it.

Could you put this in an eBook format?

Haswell or Skylake? It isn't an old one is it?

Do you have the eBook version on iTunes, Amazon etc?

Agreed, but if I'm a dev - I prefer something free to start with, generally I'm not going to spend a lot of money when there are free alternatives.

I like how Atlassian does it - they more or less give it away for free for small companies and then once you can afford it they start charging more. Unless I can get going for free, probably a non starter.

Interesting take. I didn't see this as a put down of any potential client but more to say it is difficult to grow so quickly. Imagine the load on game servers if you grew to 125 million users over a weekend, this load is considerably different than that of an authentication server.

I know that I've found that above the base features that many frameworks provide such as DJango - if you start pulling the thread on features like forgot password / reset password - I quickly find there is a lot of coding to be done.

Click reset, store a unique id, send the user an email with a link including the unique id, verify that ID on the request and then allow a password change. Then to be secure that unique id needs to be timed out once it is generated to ensure the link is only good for a short period of time, etc.

Not to say anyone couldn't code all of that, but some of the simple features once fully thought out end up being fairly complex. In my experience many of the out of the box options still need to be extended to be fully realized for enterprise usage.

I don't have a ton of experience with DJango specifically so I could be mistaken - perhaps it does more than I know.

Mo users, mo problems.

Cool stuff, kind of a like a speed reader approach.

It looks like even Facebook struggles with this stuff, not as easy as it looks.

The hype of AI defeated common sense... curious what 'critical vulnerability' was exploited. Sounds like a PC way of saying we $@*#!# up. :-)