bensedat

Synopsys Software Integrity Group | Software Engineer, Senior II | Full-time | US On-site or Remote | Elixir

The Synopsys Software Integrity Group (SIG) builds security tools used by companies around the world to secure software. The DevSec Tools team is building innovative API testing products primarily using Elixir. We're a small team at a fascinating intersection of both software and security engineering and using them together to make security easier and faster. Apply at https://tinfoilsecurity.com/go/job_SWEsr2.

Tinfoil Security (Synopsys Software Integrity Group) | Software Engineer | San Francisco, CA / Mountain View | ONSITE, REMOTE | Full-time

We're hiring for the Tinfoil Security engineering team at Synopsys! We're looking for senior engineers to help develop Tinfoil's Webapp and API security tools. We have a close-knit team and a diverse tech stack (Elixir, Ruby, Javascript/Typescript, Go).

The role is listed here: https://tinfoil.co/go/job_SWEsr2

Email borski@synopsys.com and bsedat@synopsys.com with a github and resume; we'd love to hear from you!

Tinfoil Security (Synopsys Software Integrity Group) | Software Engineer | San Francisco, CA / Mountain View, CA | Full-time

We're hiring for the Tinfoil Security engineering team at Synopsys! We're looking for engineers at all skill levels to continue developing Tinfoil's Webapp and API security tools. We have a close-knit team and a diverse tech stack (Elixir, Ruby, Javascript/Typescript, Go).

https://tinfoil.co/go/job_SWE2 https://tinfoil.co/go/job_SWEsr2

My experience with Runscope is limited but it seems best suited to monitor existing production APIs and verify happy-paths. Our API Pulse actively takes an adversarial approach to examine how an API behaves when fuzzing inputs and also checks for various best practices.

Tinfoil Security | Mountain View, CA USA | Full-time | Onsite

At Tinfoil Security we're working to make the internet a more secure place. We write tools that are used to secure the largest web applications and APIs in the world. If you've ever watched a video or streamed music online, your data has probably been secured by code we've written. To date, our software has found and fixed over two million security vulnerabilities in the web. Our goal is to reduce the time it takes to find and fix vulnerabilities and make it a part of the software building process.

Software Engineer: We work in many different domains in a highly collaborative environment. This involves everything from distributed systems to static analysis to information architecture. We value speed, but we value stability and an approachable user experience more. Our software stack is primarily Elixir, Ruby, and Go, but we're advocates of choosing the best tool for the job. If something like Elm is going to help you solve a problem more effectively then we want to provide you a place to convince us of that and keep our software moving forward.

Lead Front-end Engineer: You will be responsible for leading our front-end efforts, using cutting-edge technology and design methodologies. You will take charge of defining and implementing our design system, and will be trusted to put that design system into practice by building new interfaces and revolutionizing our old ones.

Sound interesting? Check out more info at https://www.tinfoilsecurity.com/jobs.

Tinfoil Security | Mountain View, CA USA | Software Engineers | Full-time | Onsite

At Tinfoil Security we're working to make the internet a more secure place. We write tools that are used to secure the largest web applications and APIs in the world. If you've ever watched a video or streamed music online, your data has probably been secured by code we've written. To date, our software has found and fixed over two million security vulnerabilities in the web. Our goal is to reduce the time it takes to find and fix vulnerabilities and make it a part of the software building process.

We work in many different domains in a highly collaborative environment. This involves everything from distributed systems to static analysis to information architecture. We value speed, but we value stability and an approachable user experience more. Our software stack is primarily Elixir, Ruby, and Go, but we're advocates of choosing the best tool for the job. If something like Elm is going to help you solve a problem more effectively then we want to provide you a place to convince us of that and keep our software moving forward.

Sound interesting? Check out more info at https://www.tinfoilsecurity.com/jobs.

I've been lucky enough to watch this throughout all of the evolutions and help test it. It's been great learning more about how the cooking process actually works and perfecting my technique.

EDIT: More information was requested so here goes: I've always been interested in food science and trying to make food more predictable. I think that's why I like baking so much. Pantelligent has given me the tools and visualizations to figure out what is actually happening on my stove. I've learned how to gauge the temperature of the pan, and how my electric stove has a really huge carryover heat capacity. I can pretty much turn the stove off halfway through the cooking process and coast the rest of the way with residual heat and still cook all the way through, without overcooking.

Rather than go through self-publishing, you can use the personal documents service to upload a short document and send it down to the device. Details are at http://www.amazon.com/gp/help/customer/display.html/ref=hp_p.... There are fees if the user isn't on WiFi though...

If you'd like to test your SSL config against POODLE, we've updated our tester (https://www.tinfoilsecurity.com/poodle) to call out unsafe ciphers.

If you're applying a patch manually to Rails 4.0/4.1, there was a regression and new versions have been issued: https://groups.google.com/forum/#!topic/rubyonrails-security...

Looks like the Rails 3.2 update drags along a few other unrelated changes, although they appear to be fairly minor: https://github.com/rails/rails/compare/v3.2.18...v3.2.19

as compared to: https://github.com/rails/rails/compare/v4.1.2...v4.1.3 and https://github.com/rails/rails/compare/v4.0.6...v4.0.7

I wonder if it'll be able to cross compile to other platforms?

Also just wanted to mention: if you run a Rails app it's worth subscribing to the rubyonrails-security google group. Low traffic except for blasts like these to alert you to urgent patches.

Sorry about that! Things should be working again now :)

I've run into that before on VPNs using AWS. Likely the public IP my server is using was used for abuse before I got it, especially as they usually only stick very ephemerally unless you upgrade to an Elastic IP.

Thank you very much for the timings and pull request!

This VPN won't anonymize any traffic, just encrypt the traffic between you and the server. The Rackspace account would be tied to you, so any piracy-type violations will go to them first, which they will pass along to you.

Will do!

Definitely agree. We hopefully answer some of those questions on our FAQ (https://www.tinfoilsecurity.com/vpn/faq). We also link to the script we run if you want to set it up yourself.

Yeah, mobile support was a bit tricky to set up for us as well, but we managed it with just OpenVPN. The OpenVPN app for iPhone at least was able to be configured without too much headache, although it only supports a subset of the OpenVPN options. It should be compatible with the config in the article.

Looks like Chromebooks may support it right out of the box: https://support.google.com/chromeos/answer/1282338

This answer possibly explains some of the differences between the two: http://superuser.com/a/423615

Oops, a lot of that looks to be coming from the article share links. Sorry!

Good point! I made the change when using the VPN at DefCon but haven't updated the post. I'll do that now.

Definitely true that cheaper is definitely possible, but a DigitalOcean droplet or an EC2 micro can be pretty cheap and you don't have to worry about the other VPN clients as much.

Good call! The more you can use the principle of least-privilege the easier things tend to be in the long run.

That's normally very true. What we didn't say in the article was that we have some customers whose corporate IT departments haven't upgraded yet and we didn't want to drop them on the wayside :)

https://www.tinfoilsecurity.com is a hosted automated security tool (Disclaimer: I work for Tinfoil)

Ah, that solves that :) I've seen recommendations of using Github Pages instead, but again I can't find any official Github stance on it. I'm guessing they reserve the right to cut you off if you start using large amounts of bandwidth.

This looks quite awesome! As a quick suggestion, the wiki (https://github.com/polychart/polychart2/wiki) recommends using github as the CDN which I thought was highly discouraged. However I can't find any official stance on this anymore..did it change?