abritishguy

*she

It's a very good question. The stand-in system itself has been built to have basically no external dependencies itself.

So, the question you are really asking is "to what extent are the other parties involved in the processing of payments resilient to AWS failure" – e.g. Stripe probably isn't and that's probably a decent chunk of e-commerce.

I definitely don't think this would be anything close to smooth sailing if AWS was to fully go down, but we do have the benefit that underlying payment infra is still dominated by on-prem with leased lines etc. My best guess of the actual behaviour would be that bank transfers would keep working, the card networks themselves would keep working but the average e-commerce website would not.

Naturally, we can only control for what we can control for – and for us the primary benefit of stand-in is what it gives us in the much more likely scenario of an incident in our platform.

Personal accountability only applies to execs and is already a thing in financial services in the UK post financial crisis.

That's correct.

Just in case it is relevant for anyone here this is what our security team have established thus far:

- Can be mitigated by enabling the root user with a strong password

- Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";`

- You can see what time the root account was enabled using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" WHERE key = "accountPolicyData";` then base 64 decoding that into a file and then running `plutil -convert xml1` and looking at the `passwordLastSetTime` field.

Note: osquery needs to be running with `sudo` but if you have it deployed across a fleet of macs as a daemon then it will be running with `sudo` anyway.

If you have `osquery` deployed to your fleet you can detect compromise with this query:

SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;

Is there any way to store state?

I use ligatures in atom and they are 100% aware of context. I disable them in contexts where they don't make sense e.g comments and I disable them on the line the cursor is on.

I've not had any issues. The => ligature looking like the right arrow character is just like a cyrillic A looking like a latin A - it's a problem that never manifests itself.

The author has a very subjective opinion that they try and present as fact.

But if you aren't paying then they must be making money elsewhere.

Wirecard are the issuing bank but not the card processor.

The illusion of knowledge about crypto is very dangerous. People get this stuff wrong all the time and introducing more examples with really bad mistakes will only make the situation work.

Latency from my London flat:

8.8.8.8 ~4ms 80.80.80.80 ~95ms

Google has one repository, not one monolithic codebase.

Kinesis is very poor

In general, yes. But I'd consider posting an anonymised email demonstrating such incompetence to be whistleblowing.

Name and shame, this auditor is actively damaging security and should be shut down.

OAuth is a framework not a protocol. The security it provides can vary greatly between implementations.

Fosite (which is what this is based on) is a very good implementation from a security perspective: https://github.com/ory-am/fosite#a-word-on-security

Maybe you should read? The secure enclave is completely separate to TrustZone on an iPhone and has nothing to do with Qualcomm.

I think this shows a fundamental difference between Amazon (AWS) and Google Cloud.

AWSs offerings seem fairly vanilla and boring. Google are offering more and more really useful stuff:

- cloud machine learning

- custom hardware

- live migration of hosts without downtime

- Cold storage with access in seconds

- bigquery

- dataflow

When I read the title I thought this would be a toolkit for writing databases.

A lot of the work involved in writing a database is systems stuff such as being sure that a commit log has actually been committed. Having a toolkit that does all that stuff for you would make it a lot easier to write your own database.

Not everyone has a fibre connection. I get 250KB/s at home.

2-factor authentication does not protect against that.

The victim does not know they are being MITMd and enters the 2FA code.

The aim is therefore to remove the reliance on it being genuine. If you don't have passwords then there is no passwords to steal.

r/bitcoin is calling bullshit: https://www.reddit.com/r/Bitcoin/comments/4hflr3/craig_wrigh...

Xbox live runs on azure

The more I find out about Stephen Deerhake the more I don't want him anywhere near anything important.

As a factor in a multi-factor authentication scenario it is pretty good.

With great difficulty it seems.

I'm curious as to what makes you think that Java is preferable to Go for a large webapp that "spends most of its time talking to databases or message queues".

I would have thought that the Go's concurrency model would give it an edge.

Electron (formerly called Atom-shell) was created for Atom.

The source you cited even says this!