HN user

WelcomeShorty

856 karma

A security-focused professional based in Switzerland who brings extensive experience in both technical and regulatory aspects of cybersecurity. Particularly active in discussions about EV technology, security vulnerabilities, and European tech regulations, while often sharing personal experiences and practical advice drawn from a long career in tech.

Roast

Spends so much time talking about EV charging that they probably have range anxiety while walking Claims to be security-focused but probably still uses 'password123' for their coffee machine So Swiss they probably organize their HN bookmarks with the precision of a Geneva watch

Thanks to: https://hn-wrapped.kadoa.com/WelcomeShorty?share

Posts9
Comments241
View on HN

- May not require a membership. Must accept credit cards. May not charge more without a membership. Must display price per KwH before charging. Phone-based and car-based payment interfaces allowed but must not be required of the customer.

Cries in European. It'd solve some of my absolute pet peeves with charging: no membership, no over charging without membership AND display price BEFORE charging.

The "bill shock" experience is real here. It happens I pay 2x the average price at random locations without any possibility to see that before I'm finished.

I am "forced" to allow "our" domains to be DNSSEC because... an auditor suggested it as a possible improvement and some manager thought it a good idea to do whatever said auditor proposes.

The argument that absolutely nothing that the world relies on, is not being singed (google Facebook reddit Cisco MicroSoft etc) holds no clout with the believers, unfortunately.

Priorities.

We all have 24 hours, there is no "finding time", it is just prioritising one thing over the another.

In the mids of my booming (cough) career, I was blessed with 4 children within 5 years. My prios shifted and still I was able to progress in my job, maintain social contacts and sleep :)

Turns out I was maxing my work hours to the absolute max before, and with far less pure time spend doing my job, I reached the same quality & respect. I had been spending my energy / time wrong / sub optimal.

Since that "revelation" I can do soo much more, that I deem important. Including spending very serious quality time with my children & partner. Much more than I was able before.

Simply because I've been driving TVs for a while and "in the beginning" when there was no rules for brake lights to be turned on when regenerative breaking, I got into trouble (German highways) with cars driving behind me and not being able to anticipate / react fast enough when I used it.

I quickly learned to force the break lights and started to follow this issue closely. That's how I became aware of the number.

How the EU saddled for 1.3 and not 1.2 or 1.4 is beyond my knowledge.

The European Union has a regulation that requires EVs to illuminate their brake lights anytime the regenerative-braking system’s deceleration rate exceeds 1.3 meters per second squared, or about 0.13 g.

Cloudflare's Warp:

Proxy Score: 55/100 - Very likely a Proxy VPN Score: 15/55 - Could be a VPN (But Unlikely) Client Score: no client threat

And ipinfo gives me:

privacy: Object, vpn: false, proxy: false, tor: false, relay: false, hosting: true, service: "",

Being from that time: it was't.

We spend much "downtime" learning, reading and writing (pseudo) code. Remember, coding was new, access to existing "examples" close to zero, so we had to figure a lot of stuff out.

Paper (no whiteboards either) was an excellent way to tinker, show off and bounce off ideas.

I still find myself writing / drawing a lot before I actually touch a keyboard.

I had the pleasure to deal with both authorities and the business side of securing platforms that handle the container checks & harbour access.

The forces who are, let's call it "not happy" with any form of security (access control, logging, monitoring, malware, RATs etc.) is insane.

At times I felt nearly half of all involved parties were corrupt. Top to bottom. Commercial and governmental.

Sold absolutely zero solutions and decided to never again deal with the whole industry.

Edit: for completeness I should add that many did not want any additional security measures since this might leave the traffickers no other choice but to get more physical.

"Engineer" is the protected term, and you have to be licensed to use it.

The IEEE documented that a little different:

It is the IEEE-USA position that:

• Individuals who have graduated with an engineering degree from an ABET/EAC accredited program of engineering education should not be prohibited from using the title “Engineer.”

• The protected titles “Professional Engineer,” “Licensed Engineer,” “Registered Engineer,” and variations thereof, should be reserved for those whose education and experience qualify them to practice in a manner that protects public health, safety and welfare -- and who have been licensed to practice engineering by a jurisdiction.

From: https://ieeeusa.org/assets/public-policy/positions/workforce...

To be effective, you need to either be prepared to hide behind google, Cloudflare or AWS, OR you need some pretty expensive deal with you (large) ISP who can (quickly) filter on their edge.

Sitting at the end of whatever network, you will not be able to do anything against a sufficient volume attack.

The "99% of reports were incoherent garbage" is exactly what I become from unsolicited sources. They come mainly in via our (security.txt) email.

Since (2019) we have an externally managed bug bounty program (they have and manage the platform the initial triage of reports and paying the bounties (we decide what is accepted and how high the bounty is), our success rate (actionable reports) has sky rocketed.

Our devs love the reports since these are verified to be 1: documented so well, everyone can reproduce them, 2: scored reasonable (much less in house fighting if it's a low or a critical), 3: simple interaction with the individual who triaged | filed the finding (and eliminating the horrible interaction via 3 or more steps).

The money we spend on the bounties AND the service are easily offset by the quick turnaround times and saved internal struggles & meetings.