scottpiper

6 ms·

1.
by scottpiper 4y ago
I live in SLC, and I saw one of these show up over a year ago. The location was about here: https://www.google.com/maps/place/40%C2%B047'58.0%22N+111%C2... It was a very well built setup that I assumed (as di
2.
by scottpiper 6y ago
Author here. Thank you. I haven't made the repo for this doc public, but the LaTeX setup is based on an older document of mine here: https://github.com/0xdabbad00/research/tree/master/emet_unco...
3.
Public dataset of Cloudtrail logs from flaws.cloud(summitroute.com)
1 points by scottpiper 6y ago|0 comments
4.
Denial of Wallet Attacks on AWS(summitroute.com)
1 points by scottpiper 6y ago|0 comments
5.
AWS Security Maturity Roadmap for 2020 [pdf](summitroute.com)
1 points by scottpiper 6y ago|0 comments
6.
Show HN: CloudTracker – Helps implement least privilege on AWS(duo.com)
1 points by scottpiper 9y ago|0 comments
7.
Show HN: CloudMapper, open-source tool for visualizing AWS environments(github.com)
56 points by scottpiper 9y ago|10 comments
8.
by scottpiper 9y ago
Thank you for posting this, but doesn't "Show HN" mean you're linking to something you've made? I'm the creator of flaws.cloud
9.
by scottpiper 9y ago
I live in Salt Lake City, Utah. I do AWS security consulting. I would love this. I've lived all over the US (Boulder, SF, Austin, DC, and more) and because I do remote work I can work anywhere, and I chose to move here as the best pla
10.
by scottpiper 10y ago
From https://summitroute.com/blog/2017/01/07/news_summaries/ , some have already been mentioned. - Downclimb (my own), for weekly infosec news summaries: https://summitroute.com/blog
11.
by scottpiper 10y ago
I'm the creator if you have any questions.
12.
by scottpiper 10y ago
Probably just at the end. My goal is disaster recovery (AWS disappears as a service to the world because an Amazon employee accidentally `rm -rf` everything, or my own admin `rm -rf`'s my account on accident) so for those situations,
13.
by scottpiper 10y ago
I'm the author of the blog post in question (and have no idea why HN won't let me reply to the original post). For some clarity here, the "untrusted" third party is Google, whom I don't want to read my data, but I
14.
by scottpiper 10y ago
These are both accurate. For 1, I ensure that an attacker can not modify my archives after they've been uploaded by giving the backup service "put" only privileges. This is not possible with GCE from the article unfortunatel
15.
by scottpiper 10y ago
If you're doing backups for your business, I've written on how to properly encrypt backups[1] and how to use Google Compute Engine for backups[2]. I'm working on write-ups for AWS and Azure that should post within the new few
16.
by scottpiper 10y ago
For static analysis to check for best practices, there aren't any free tools that come to mind that give you easily digestible info without usually doing some manual reversing and a lot of extra knowledge. HBGary once created a tool c
17.
by scottpiper 10y ago
Assuming the program has no vulnerabilities, these will do nothing. They are mitigations for memory corruption vulns, such as buffer overflows and use-after-frees. Sanitizing inputs doesn't really help for some of these. These mitigat
18.
by scottpiper 10y ago
I'm the author if you have any questions
19.
by scottpiper 11y ago
http://highscalability.com/ - For news related to building large web apps and software. https://summitroute.com/blog/ - (mine) Infosec news. http://ben-evans.com/#newsletter - Email on
20.
by scottpiper 11y ago
And go:linkname, go:nointerface, and go:nowritebarrier You can see the lexer for these here: https://github.com/golang/go/blob/88c08b06b97296e41fc3069f4a...
21.
by scottpiper 12y ago
An important consideration when deciding if it is a good alternative is how good is it's security and ability to keep you anonymous? Since that's the whole point of using it anyway. When evaluating, it's important to look at
22.
by scottpiper 12y ago
KryptosLogic has a good write-up on this showing how it can be detected with Z3: http://kryptoslogic.blogspot.com/2015/01/openssls-squaring-b...
23.
by scottpiper 12y ago
Moyix's Panda will get you most of what you want: http://moyix.blogspot.com/2014/12/reproducible-malware-analy...
24.
by scottpiper 12y ago
The author of that article is also the author of the Goji framework (very nice web framework for Golang): https://goji.io/