HN user
I do info security at OpenAI. http://www.linkedin.com/in/drewhintz
my email address is drew@overt.org
I’ve had luck with a workflow similar to:
git clone a repo
Open goose with that directory
Instruct it to discover what the repo does
Ask it to make changes to the code, being detailed with my instructions.
I haven't tried computerController, only Goose’s main functionality.
I tell it to discover that itself by asking leading questions: “What does this repo do?” “How do you run its unit tests?” “What does file foo do?”
I'm guessing an "internal tools scaffold" is something like Goose: https://github.com/block/goose
Instead of just generating a patch (copilot style), it generates the patch, applies the patch, runs the code, and then iterates based on the execution output.
Square | AppSec, vulnerability discovery, pen testing | Remote in North America
We're hiring people to find vulnerabilities in Square products and services! The team is brand-new with lots of opportunity to choose the type of AppSec work you want to focus on. Fully remote is an option. There are more details here: https://smrtr.io/6T58-
We're also hiring for lots of other security roles. Please feel free to email me: dhintz@squareup.com
"Consumer Gmail content will not be used or scanned for any ads personalization after this change."
Original post: https://blog.google/products/gmail/g-suite-gains-traction-in...
Disclaimer: I work for Google, but not on this.
Here's the tweet:
"The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request."
Sure thing, I'm happy to help. Our code is at https://github.com/google/password-alert and feel free to email me any questions at drew@overt.org
However we haven't published a good design document about the client. If you're interested, let me know and I'll try to publish one.
isTrusted can apparently be spoofed
isTrusted cannot be spoofed in this situation, which is its intended use in Chrome. A Chrome extension in the isolated world is receiving events from the main world and checking isTrusted for those events.
Yes, we're pushing the notification to a new tab (which can't be blocked or interfered with)
We went through a similar iteration with Password Alert. If you're setting focus on the new tab, an onBlur event could indicate that the current page has lost focus, perhaps due to the warning tab. I think notifying the user is still net-positive for the user's security.
This can be protected against by the extension looking at keyboardEvents and verifying the isTrusted attribute. Here are details about how we do this in Password Alert: https://github.com/google/password-alert/blob/master/SECURIT...
Before Chrome implemented isTrusted, it was a bit more tricky and we had to rely on a variety of attributes that did not have as much of a security guarantee.
LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake
Interesting! How does it do this?
I agree that it's not yet ready for general use, but what hardening do you expect to happen in the coming months?
I'm one of the original end-to-end authors, but haven't worked on it recently.
Thanks, that's a fair point. However I've been surprised to see that in well-executed attacks, even the best of us can at least occasionally fall for password phishing.
A while ago this was sort of leaked on HN, but someone called it "really unlikely": https://news.ycombinator.com/item?id=8566485 https://news.ycombinator.com/item?id=8566022
Now we've publicly released my project. It's a bit different than most phishing detection -- it detects phishing by noticing where the user has typed their password. Please try it and let me know what you think. The source code is here: https://github.com/google/password-alert It's available in the Chrome Web Store here: https://chrome.google.com/webstore/detail/password-alert/noo...
This diff appears to contain the patch: https://launchpadlibrarian.net/185571456/apt_0.7.25.3ubuntu9...
For example, you can see the change in cdrom: handling code as mentioned in the security notice.
It's not actually related to Project Zero. There are quite a few people here at Google, both on Project Zero and on other projects and teams, that routinely find vulnerabilities. Here's a list of some of the vulnerabilities: http://www.google.com/about/appsecurity/research/
Just someone reading source code. Coincidentally, the same way Heartbleed was found.
Is there any evidence of this having been used in the wild anywhere?
No.
You're welcome! I know this because I work on the same team with him. I'm not familiar with what Codenomicon did and won't publicly speculate.
No. Neel found it by auditing code. See CVE-2011-0014 for a previous OpenSSL bug he found by auditing code. See CVE-2010-0239 to witness his awesome ability to find bugs by auditing assembly code.
A good friend saw the SXSW screening of the first two episodes and loved it. He's founded a failed company, founded a successful small company, coded for a failed company, and is currently in SF coding for a startup.
A lot of the jokes are tech-hilarious and well-informed about the tech culture here. Mike Judge's long-time residence, Austin, has plenty of tech and some startups, but of course not as much as the Bay Area.
It's a comedy so I expect it to poke fun at our culture.
If your browser gets JavaScript crypto from webmail.example.com every time you visit webmail.example.com then there's nothing stopping webmail.example.com from serving malicious JavaScript crypto that steals your keys or unencrypted data. Even though the JavaScript runs locally, the code is supplied by webmail.example.com. There's a discussion of this and a few other issues here: http://www.matasano.com/articles/javascript-cryptography/
JavaScript in web browsers also has a few other issues, such as side-channel timing attacks and the lack of control of memory.
For XHR, don't forget the option to do stateless CSRF protection by requiring a custom HTTP header: https://code.google.com/p/browsersec/wiki/Part2#Same-origin_...
In March 2013, the Director of National Intelligence specifically told Senator Ron Wyden that the NSA does not wittingly collect any type of data on millions of Americans: http://www.youtube.com/watch?v=QwiUVUJmGjs&feature=youtu...
> ceoportal
Sounds about right.
[Edit: Looks like I currently have no invites left. As I get more, I'll give them out and update this post.]
I think I have a few invites to give out. Let me know if you'd like one.
P.S. I'm Resistance using the name drew
It looks like it will be available for purchase on November 13. You can sign up to be notified when it is for sale here: https://play.google.com/store/devices/details?id=nexus_4_8gb...
Hi Rudhir, Drew from the Google Security team here. Actually, the authentication cookies that are set on mail.google.com aren't sent when you visit google.com, so the scenario you described wouldn't work. Those secure cookies are only sent over SSL. That's good news for the people in your scenario!