jjarmoc

6 ms·

1.
by jjarmoc 11y ago
I don't know.. Google confirms they covered my area. I really don't look for house cleaning services, so maybe I just didn't get targeted for ads.
2.
by jjarmoc 11y ago
When I hear about companies like this going under, I always think how odd it is that I've never previously heard about them. Then I realize, that may have been part of the problem.
3.
by jjarmoc 11y ago
He never 'got a lawsuit.' Instead, he got some comments from the contact to whom he reported it that criticized his approach. It's not even clear just who this person was. It seems he had trouble locating a contact to repo
4.
by jjarmoc 11y ago
> So far as I know (this is sort of my profession), there's no federal "burglars tools" law regarding malware. To be fair, many "burglars tools" laws require possession of the tools WITH INTENT to perform a crim
5.
by jjarmoc 11y ago
I feel like that's a reasonable timeframe from 'hmm, something is odd' to 'we're pretty sure we fully understand the impact, time to notify users.' There's a balance between early notification and misstati
6.
by jjarmoc 11y ago
In the comments, they indicate that they're in the process of sending out emails to users. Sending lots of emails takes some amount of time; hopefully those are arriving in inboxes now. It's low key given the impacts as they unde
7.
by jjarmoc 11y ago
No, I don't think you did. I certainly haven't seen anything about the root cause. Let's hope it comes in time.
8.
by jjarmoc 11y ago
This is one of the things that scares me. If an attacker had access to dump their credential digests, could they also have modified the site to silently log credentials upon entry? From their statements so far, it doesn't seem that ha
9.
by jjarmoc 11y ago
> I just write down my passwords. People may laugh, but for many people that's a huge step up. I've tried explaining password managers to family members, and I've failed. The usability just isn't there for many clas
10.
by jjarmoc 11y ago
"Answer unclear, ask again later"
11.
by jjarmoc 11y ago
I would also appreciate more detail, but that shouldn't be their first priority. They note that they discovered the breach on 'Friday' so I imagine they have an ongoing Incident Response right now. They may not have or be re
12.
by jjarmoc 11y ago
> Maybe there are people out there who will accept much more inconvenience in exchange for avoiding the risk associated with a cloud-based service. But, for me, the inconvenience is simply too much. Sure, it's a balance everyone has
13.
by jjarmoc 11y ago
While LastPass seems to be responding well, I find their entire service exceeds my tolerance for risk. If you don't use a password manager, you've got 99 problems, but a centralized store of your credentials for everything that&#x
14.
by jjarmoc 11y ago
Thanks!
15.
by jjarmoc 11y ago
~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~ NCC Group Atlanta. Austin. Chicago. New York. San Francisco. Seattle. Sunnyvale. Application Security Consultant Full-Time,
16.
by jjarmoc 11y ago
> Any interview process that requires a substantial time investment by the candidate pre-interview is broken. I disagree, but accept that this depends largely on the desired outcomes. If the candidates goal is to spray-and-pray by apply
17.
by jjarmoc 11y ago
~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~'`^`'~ -,._.,- ~ MATASANO SECURITY - Chicago. New York City. Sunnyvale. Application Security Consultant Full-Time, work visa sponsorship avai
18.
by jjarmoc 11y ago
Yes, it likely will. That's probably why the article mentions a deprecation of "Non-Secure HTTP" rather than prescribing a specific TLS version. It's the sort of language that will stand the test of time as newer proto
19.
by jjarmoc 11y ago
The differences are significant when it comes to the security of the underlying protocol, and the downgrade is why it's important you refuse to support SSL entirely. SSL of any version (v2 or v3.. the v1 you refer to was never publicl
20.
by jjarmoc 11y ago
Please, can we stop calling it SSL? SSL means something very specific; something that people should no longer be deploying. The article notably uses the term 'Non-secure HTTP' which at this point in time means HTTPS leveraging TL
21.
by jjarmoc 11y ago
> I can work either from home or from my office. My office is fine but I'm usually more productive in the comfort of my home because I'm less likely to be distracted. This is definitely different for each individual. For me, I
22.
by jjarmoc 11y ago
> I’m curious exactly how many times a candidate gets to apply to Matasano. Undefined. Personally, I applied twice, ended up coming to work here the second time through. > Do I have to do the microcorruption.com and the cryptopals.com
23.
by jjarmoc 11y ago
He seems to see anything that doesn't include pitchforks and torches as apologetic.
24.
by jjarmoc 11y ago
> There's no way to tell for sure if something like this is intentional or not. Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that i
25.
by jjarmoc 11y ago
So, it's my comment you quoted questioning whether this can be called a backdoor. I don't intend that to be apologetic for Apple. I called it a 'significant vulnerability' but at the end of the day, it's a privileg
26.
by jjarmoc 11y ago
While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this
27.
by jjarmoc 11y ago
... and where do the tools come from? Tools are either made by expensive humans, or forged by the Dark Lord Sauron in the fires of Mount Doom. There's also the matter of who will run those tools. It's not like fuzzers output expl
28.
by jjarmoc 11y ago
Right, just rung strings on the demo and you'll see the custom PNG chunk: ``` jawh<img onload=with(document.createElement('canvas'))p=width=4968,(c=getContext('2d')).drawImage(this,e='',0);while(p)e
29.
by jjarmoc 11y ago
I first learned about this technique from Cody Brocious' post ( http://daeken.com/superpacking-js-demos ) about his WebGL demo 'Magister' ( http://demoseen.com/windowpane/magister.html ). T
30.
by jjarmoc 11y ago
> What if on April 1st they announced something that was so drastic that people thought it was an April 1st joke but it wasn't? I've been surprised lately how few people seem to recall Google's launch of Gmail on 04/0

More ›