theboss

414141. I know I'm not alone out there =]

I'm curious. To people who have purchased bitly, why? I feel like setting it up would take as long as writing your own. My very first web project I ever did was to write a url shortener and it took me less than an afternoon. A good engineer I'm sure could do it in less than an hour.

For the price, what does it get you?

What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention.

<script>javascript</script> is the first payload you try when looking for the stupidest XSS you can find....

As someone who has only just entered the `real world', I found it so incredibly odd that people's employers very often get involved in these internet dealings by firing someone because they use a sexist/racist/whatever-ist slur.

To people out there. If you are going to talk about somewhat controversial topics, the ``my opinions are my own'' you put on your twitter probably isn't enough protection.

This actually starts before steroids were invented.

What's a native client do if Google still stores all your emails, receives all your email's, etc. It's not like once you read the email in your client Google forgets it ever saw the email.....

Ah thanks I never realized.

I'm seeking work to freelance as a security consultant on short engagements or small projects. Because of this my going rate is quite low.

I specialize in webapp security, cryptography, android security, and love PHP (developers nightmare is a hackers dream).

Contact me at my profile's email address

I'm a recent grad with my MS in CS. I mostly focus on information security and cryptography. I want to know everything about the two subjects.

I'm about to start working at a SaaS startup security company.

This is like....seriously one of the worst documents I've ever read.

My post is "on paper". In reality, projects are squeezed for nickels and dimes.

My point is that while open-source should be better, right now it seems that everything is equally not good enough.

There are pros and cons to both closed source and open source. Open source is nice because the community can audit the code and see for themselves, but closed-source is nice because a company generally has the resources to maintain and build software correctly.

Both of these are hypothetical, however. We've seen tons of vulnerabilities from both. IMHO Open Source works a lot better on paper but once projects get very large auditing them is really hard...which definitely cuts down on the amount of eyes looking at them.

There's a difference between not allowing spaces and not hashing. They could have just written a bad PW policy that doesn't completely make sense

You're drawing conclusions from information that doesn't lead you to one.

In high school, I didn't know there were such things as "top colleges". I knew Harvard and Yale existed and were good...but beyond that I honestly didn't even know MIT existed. It's probably because my family has been in America for only about 60 years now and my generation is the first to go to college (honestly just guessing here..)

So I applied to college and went to a pretty big state school (for my area).

I'm really blessed to end up where I've ended up after graduation. I know so many really really good classmates who have a lot of talent and never even get a glance when looking for jobs at some of these companies. It really just isn't fair sometimes...

I think you're going to see a huge amount of digitaloceans since "production" for me isn't exactly getting a lot of traffic, so it's on a $5 instance.. So I predict digitalocean will rack up a lot of $5 instances and win.

I accidently upvoted you and now I have NP idea how to remove it.

It depends on what you do. A secretary will make far less than the chief of police but they both happen to be government workers....how is that not obvious..?

I mean...there are plenty of really good people who don't smoke marijuana too, and they do an exceptional job recruiting them from schools in the DMV area.

At the University I went to, anyone who expressed interest in security and had good grades could get a ridiculously generous scholarship (tuition + $20k stipend + books + $1000 for conferences, and a guaranteed summer internship). A catch to this is you must be able to get a clearance, and if your clearance is denied you lose the scholarship and have to pay back the money.

Basically, all the students who were not into that kind of stuff went straight for it and had jobs at 3 letter agencies on graduation.

Yeah a lot of security people like marijuana but a lot of them don't.

The way I looked at it was "If I'm going to choose to smoke marijuana I have to be twice as good as everyone else in order to ensure I get a job that does not require a security clearance" (which is odd because I later chose not to smoke marijuana).

But...there are plenty out there who already have no problem getting jobs at these agencies after being clean for 1year or just not being interested in those things.

I don't know what you mean. Cross fit undoubtedly has pretty good equipment compared to a globo-gym, but globo-gyms will have everything you need 99% of the time. A squat rack, a bench, and some barbells...Places to do pull-ups, dips, a huge array of dumbbells....

It also isn't hard to find gyms with bumper plates that are powerlifting/oly friendly, or specialized gyms that have whatever your in to (rock climbinb gyms exist, etc)... You just have to do your research

Like I said, there are a lot of reasons for backlash. I didn't even touch on most of them.

I disagree that their goal is "Sports conditioning training". Because this is not consistent with their who their clientele is. Their vast majority of their clientele is average people, with no prior lifting experience, who have heard of it.

cross fit is really an infiritating thing. The people who do it are sometimes diehard fans with absolutely no knowledge of how to build strength or an "elite athlete". A lot of people just like the brand...

But the diehard fans aren't the worst part. Cross fit the organization loves to shut people down who speak poorly of them. They also have made a lot of unsubstantiated claims about the type of results that can be expected by following cross fit programming (which is laughably bad). Its also thought that they run the cross fit games unfairly since there is a conflict of interest in sponsoring their top athletes and putting on the cross fit games where their sponsored athletes and no sponsored compete.

The worst part is the bad programming and the dangers of having a coach who is instructing you to do things that are obviously bad ideas. Extremely high rep oly lifting is a reciepe for disaster since the lifts are very skill based.

With all that said. One thing about cross fit is really good. They have got people training with barbells and started a lot of people down a path where they can start getting information they need to train better and smarter. But I'll be saving my 100 a month..

I learned not a whole lot happened in Spain in the year 2000.

http://en.wikipedia.org/wiki/2000_in_Spain

Funny. I typed up my edit2, hit enter, and had a reply from you basically saying the same thing. Also, I never said anything about use-cases, signing code, etc. Only "does this safely get you the primitives", not about what you can do with them. The "you say" in your explanation are not what I said.

There are a ton of other problems associated with crypto code. I'm talking about crypto primitives being provided by the browser. The rest of the problems associated with it, I'm not asking about.

You're echoing the problem that my question is asking if it solves...

Edit: Also, you definitely need more than the code to come from a "trusted third party", otherwise we would see SaaS startups on HN providing "crypto as a service" (god help us).

I'm only talking about solving this 1 problem related to js crypto...

Why can't browsers just build crypto primitives in that can be called from js?

I don't understand what people's obsession with browser crypto is...but I don't know enough about browser's to think of a reason this solution is bad. Any guidance?

edit: I understand that this won't solve all the problems...but at least the problem that you are constantly being served this chunk of potentially unsafe code.

edit2: I've been doing some thinking. Even though I didn't really get a response I think the reason is that it doesn't buy you the ability to do anything new safely. You still have the old problems of other dom elements mucking with your dom elements that control the code, or whatever the site does...so it doesn't really buy you anything...it's just work for nothing.

I still think it would be a useful start to one day having safe browser crypto

Also all browsing, including your cart, is served over HTTP until you go to the checkout page. You can't browse over https even if you explicitly ask for it. They don't need to ask Amazon for data if they have a router between you and them.

I don't know about that. Have a source? This is a pretty bad practice so I would be very surprised to see google doing this.

Oh yeah. It's impossible to know who has your plaintext password on the backend (even steam who RSA encrypts your pw with a public key before sending), but this certainly is a bad practice and certainly makes it look like they do not have robust security practices.

I actually have no idea what you're talking about.

All I know is they sent her plaintext passwords to her, which she redacted before sending to me....

She's a computer person too so she knows all this jazz.