DrewHintz

8 ms·

1.
by DrewHintz 2y ago
I’ve had luck with a workflow similar to: git clone a repo Open goose with that directory Instruct it to discover what the repo does Ask it to make changes to the code, being detailed with my instructions. I haven't tried computerContr
2.
by DrewHintz 2y ago
I tell it to discover that itself by asking leading questions: “What does this repo do?” “How do you run its unit tests?” “What does file foo do?”
3.
by DrewHintz 2y ago
I'm guessing an "internal tools scaffold" is something like Goose: https://github.com/block/goose Instead of just generating a patch (copilot style), it generates the patch, applies the patch, runs the c
4.
by DrewHintz 5y ago
Square | AppSec, vulnerability discovery, pen testing | Remote in North America We're hiring people to find vulnerabilities in Square products and services! The team is brand-new with lots of opportunity to choose the type of AppSec w
5.
Oura Ring TemPredict Covid-19 Study [not yet peer reviewed](researchsquare.com)
2 points by DrewHintz 6y ago|0 comments
6.
Tesla Has a New General Counsel(wsj.com)
1 points by DrewHintz 8y ago|0 comments
7.
by DrewHintz 9y ago
"Consumer Gmail content will not be used or scanned for any ads personalization after this change." Original post: https://blog.google/products/gmail/g-suite-gains-traction-in... Disclaimer: I work for G
8.
by DrewHintz 10y ago
https://security.googleblog.com/2013/05/disclosure-timeline-...
9.
Late Stage Startups Trip SEC Rule 701 Long Before IPO(forbes.com)
1 points by DrewHintz 10y ago|0 comments
10.
by DrewHintz 11y ago
Here's the tweet: "The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request." https://twitter.com/countywire/status/700887823482630144
11.
by DrewHintz 11y ago
Sure thing, I'm happy to help. Our code is at https://github.com/google/password-alert and feel free to email me any questions at drew@overt.org However we haven't published a good design document about the c
12.
by DrewHintz 11y ago
> isTrusted can apparently be spoofed isTrusted cannot be spoofed in this situation, which is its intended use in Chrome. A Chrome extension in the isolated world is receiving events from the main world and checking isTrusted for those e
13.
by DrewHintz 11y ago
> Yes, we're pushing the notification to a new tab (which can't be blocked or interfered with) We went through a similar iteration with Password Alert. If you're setting focus on the new tab, an onBlur event could indicate
14.
by DrewHintz 11y ago
This can be protected against by the extension looking at keyboardEvents and verifying the isTrusted attribute. Here are details about how we do this in Password Alert: https://github.com/google/password-alert/blob
15.
by DrewHintz 11y ago
> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?
16.
by DrewHintz 11y ago
I agree that it's not yet ready for general use, but what hardening do you expect to happen in the coming months? I'm one of the original end-to-end authors, but haven't worked on it recently.
17.
by DrewHintz 11y ago
Thanks, that's a fair point. However I've been surprised to see that in well-executed attacks, even the best of us can at least occasionally fall for password phishing.
18.
by DrewHintz 11y ago
A while ago this was sort of leaked on HN, but someone called it "really unlikely": https://news.ycombinator.com/item?id=8566485 https://news.ycombinator.com/item?id=8566022 Now we've publicl
19.
Password Alert: a Chrome extension by Google to detect password phishing(googleonlinesecurity.blogspot.com)
11 points by DrewHintz 11y ago|3 comments
20.
by DrewHintz 12y ago
This diff appears to contain the patch: https://launchpadlibrarian.net/185571456/apt_0.7.25.3ubuntu9... For example, you can see the change in cdrom: handling code as mentioned in the security notice.
21.
by DrewHintz 12y ago
It's not actually related to Project Zero. There are quite a few people here at Google, both on Project Zero and on other projects and teams, that routinely find vulnerabilities. Here's a list of some of the vulnerabilities: http
22.
by DrewHintz 12y ago
Just someone reading source code. Coincidentally, the same way Heartbleed was found.
23.
by DrewHintz 12y ago
> Is there any evidence of this having been used in the wild anywhere? No.
24.
The End-To-End encryption team at Google is doing an AMA(reddit.com)
4 points by DrewHintz 12y ago|0 comments
25.
by DrewHintz 12y ago
You're welcome! I know this because I work on the same team with him. I'm not familiar with what Codenomicon did and won't publicly speculate.
26.
by DrewHintz 12y ago
No. Neel found it by auditing code. See CVE-2011-0014 for a previous OpenSSL bug he found by auditing code. See CVE-2010-0239 to witness his awesome ability to find bugs by auditing assembly code.
27.
by DrewHintz 12y ago
A good friend saw the SXSW screening of the first two episodes and loved it. He's founded a failed company, founded a successful small company, coded for a failed company, and is currently in SF coding for a startup. A lot of the jokes
28.
by DrewHintz 13y ago
If your browser gets JavaScript crypto from webmail.example.com every time you visit webmail.example.com then there's nothing stopping webmail.example.com from serving malicious JavaScript crypto that steals your keys or unencrypted da
29.
by DrewHintz 13y ago
https://www.facebook.com/photo.php?fbid=10201142599660581&se...
30.
by DrewHintz 13y ago
For XHR, don't forget the option to do stateless CSRF protection by requiring a custom HTTP header: https://code.google.com/p/browsersec/wiki/Part2#Same-origin_...

More ›