egsec

I work in AppSec for a Very Large Company. I've worked in large companies before. These are not new trends. We have programmers who do F# and other functional programming. I would think the bigger inhibitor to functional programming is that most of the existing apps are Java or .Net so unless you are building a brand new team, you reuse the skills and technology you already have working for you.

Our devs use plenty of small open source projects. We [Security] like to recommend software that we are comfortable with, but any determination of "stacks" we leave to the actual software engineering teams. If something is pretty bad, not updated, constantly having problems, etc - we might ban it... but what's your case for using poorly engineer software given alternatives?

Not sure if mom and pop is supposed to mean commercial, but not OSS? OSS we can patch and modify if necessary. We can even PR patches back based on what our "scanners" and manual testing find.

Generally, we don't care about language, most issues are in implementation not the language, and less so in more modern languages where the creators have heard about security.

The basic type of code scanning needed for PCI and other compliance is a commodity offering and is manageable cost compared to marketing and relationship management costs needed to pursue big clients.

I am not sure the OP understands what a SOC2 report says/does. It talks about pretty high level controls and practices. You certify an app/service, not a stack. If you scan and fix your bugs and have a proactive security training, it doesn't care about how you do it. There is no golden stack that will help you pass a SOC2. You may be able to make your life easier with certain services/SaaS, but the issues come up in your practices and in the actual code implemented. If you have bugs in procedural or functional programming, its the same problem from this perspective.

Vendor due diligence? Some companies have their own questions, there are also agreed standards for these that some companies opt into. I am not sure why a big company should risk their bottom line on something unproven or that isn't ready for prime-time. It's like getting an inspection when you buy a house. In the same way, your org can improve and make improvements. This is no different then adding in features some customer wants in order to win your business.

I don't understand the ultimate point, people who build functional apps shouldn't have to care about security? It's just another non-functional requirement that helps you win a broad audience. It's the same argument that says government should regulate this or that, that financial advisers shouldn't need to act as fiduciaries. It's the cost of doing business.

Maybe the OP has some weird experiences where auditors jumped on functional programming as an issue to justify not doing more work or make their lives easier, but I don't think this is something that is a commonly held belief across audit and security (if people even know what functional programming is).

I think a good parallel is OWASP for web app security. The content is free and open for the internet. OWASP doesn't directly focus on curating the content and it is left up to the community. The content grows old and stale, errors do not get corrected, and the writing is often what I would call draft quality even when its published.

There are always a lot more consumers than creators of content on any platform. Most people going to use a resource are not the same who can write about it, not everyone on YouTube has something to share or make a video. And why give it away for free when you can make a paid course, give a talk, charge consulting fees, sell a solution to a problem?

You need to align incentives. Again, why contribute to something and possibly deal with the pain of moderation for free (costs instead of gain). Should we blindly trust the wisdom of the crowds? The other cost of free, is that the community may not be capable or not interested in sufficient moderation - this leads to low quality content which chases people away, even if there is good content right next to it.

OWASP's incentives and objectives have never been 100% clear to me. There are some big security players involved, but it seems more interested in research, community, grants, etc versus content. When you look at MDN, Mozilla has a clear incentive to document these things so developers build more "standard" vs "Chrome-focused" web apps, which helps keep users on FireFox since all of their favorite sites are less likely to break without FireFox simply copying decision made by Chrome. By documenting expected action and quirks, it forces Google et al. to try to move back towards agreed upon standards.

In security, I am generally more reliant upon vendor write ups and content from people with a reputation. Security has a much smaller population than web dev. Also, for web dev a lot of people pick it up and feel comfortable writing publicly even when they are just starting out (See Dev.To). I am not sure if companies pump millions of dollars into commercial web tools beyond graphics and CMS type stuff, so I wonder if a more decentralized collection of guidance is practical for the web, not to mention that there is a lot of nuance between browsers and even recent versions.

In addition to recording, you may want to make some stills for download or for custom formatting, highlighting, etc. You can use Carbon - https://carbon.now.sh/ - which will do some auto formatting, but allow you to override. This is a bit better than just screen-shooting the IDE.

You may not want to just make one big long video - its hard to follow and then find specific key points in time. Unless you are showing a lot of interactive things and just input/output, copy and paste-able code is going to be easier for students to see and adopt. You may want more of a long tutorial document with small videos where it makes sense or you want to show something interactive.

In addition, its a lot more editing if you want something good without mistakes, etc (there are a lot of videos from big name schools online where professors do not correct themselves and just post the single unedited take). I would actually use video selectively. If you want students to easily run something you may want to utilize one of the many only IDEs that can execute code.

Depending on the tools available from your school or what you can find online you can make something very useful and interactive or you could try to use something like https://www.adaptlearning.org/

It may be zero sum or not zero sum depending on different situations.

If all employees values transparency and fairness and would rather have a lower but more fair pay, them the transparency may work.

However, the employer typically derives more profit per unit of work if they employee makes less. Also, if you are a good negotiator or you are the type to always threaten to leave if not given more pay you benefit from the opaqueness. If the company has a lot of good negotiators it may make sense to be more transparent to keep the overall wages down since no one can exercise that benefit.

There are probably other factors such as supply and demand beyond individuals at specific points in time which need to be taken into account (surge pricing?) we need someone for this project now, so we will pay them a premium even if we would normally pay them the same as everyone else, even in consideration of long terms costs this may make sense.

If isolation is an issue, perhaps there is a co-working space or public space at which you can work. If you don't want to work in public, maybe you just need to go to some meetups, professional organization, makerspace, or some other type of group where people come to socialize. You may want to try a mix of tech and non-tech type groups. I found when I was running my own business in my early 20s that a local user group provided a good way to meet new customers and interact with people. I also tried things like board game meetups, "young professional" groups, etc. even if I didn't like the people or never went back, I found it a good to break up my routine. I would also make sure to spend time outside, at the public library, just leave the apartment for lunch, etc.

I have often thought about leaving tech or going to a different area within tech, I can empathize that its scary to think you are a specialized cog that can't really do anything else. It may be helpful to reach out to a career professional for some advice - for example if you went to a college/university, they usually provide career counseling for alumni, local libraries also often have resources or people who may help. If you are thinking of staying in your own business, you may want to try your local Small Business Association chapter (or equivalent if you are outside of the US).

Remember, your greatest asset is often not what you know, but that you know how to think and make critical decisions. I am sure you have learned a new programming language or figured out how to deal with a bad customer. Those are skills which can be generalized and applied in other areas. It may be hard or scary to take the step on how to apply these skills in a different area, but you may be able to think of low risk ways of trying it out. Maybe there is some type of freelancing gig outside your realm or even outside of tech you could try. Some of the networking ideas about may help you bump into someone who needs your skills - even if its not paid work, they may buy you a coffee just to pick you mind.

I would also second some of the other comments on getting a mindless or corporate job for a while, taking a vacation, tech detox, etc.

In sum, the first step is to break out of your routine and try something. You may have heard of paralysis by analysis... sometime you have to just take that first step and not worry about having the perfect optimal, zero risk plan in place.

I know many people who graduated from this school district....

"What white middle-class parents do not always understand, she said, is how much pressure recent immigrants feel to boost their children into the middle class."

This may be a great general quote, but should not be applied to this town. Immigrants moving here are not poor, not "off the boat". West Windsor is a township with mostly upper middle class people (Median Income per 2010 census was $156,110[1]) and a very high number of people with advanced degrees per capita (41% have graduate/professional degree as of 2013[2]), most of these immigrants came here with advanced degrees. People are not moving here to get ahead, they are already well established in the upper middle class. Houses are insanely expensive in West Windsor and Plainsboro, you will find people selling 3 bedroom condos in the 600k range, this is a town with a long commute to NYC or Philadelphia.

There are plenty of people of all races on both sides, I think the author is taking some liberties to up the page view count.

There likely is a backlash from a tiger mom like segment, but this article seems like a NYT reporter just trying to get something out on the heels of the recent Atlantic article[3] on the kids in Silicon Valley being so stressed at school they committ suicide.

[1] https://en.wikipedia.org/wiki/West_Windsor_Township,_New_Jer...

[2] http://www.west-windsor-plainsboro.k12.nj.us/common/pages/Di... p. 10

[3] http://www.theatlantic.com/magazine/archive/2015/12/the-sili...

Note 1: Moving things to GitHub or elsewhere does not remove them from SourceForge. So SF can continue to host and enjoy links on unmaintained websites, search engines etc.

Note 2: If their business model is offering popular binaries and source, they can just copy these from other sites and repackage them. Open source software allows you to do this. If no one else is interesting in bundling and monetizing, then they can buy traffic and still succeed.

Note 3: Remember that academy award winning movie from 1943? Not so great it today's light. While perhaps one of the goals of the Internet and cheap storage is to keep a copy of everything, and its often better to not re-invent the wheel, if something fall by the wayside, and its needed, it will be created.

Note 4: There are plenty of websites which catalog useful abandonware, that someone had to find a physical disk drive from. If the software has value, chances are someone will eventually repost it somewhere without a massive organized effort.

----

There is clearly value in moving over some project to GitHub or elsewhere, but if some things are not migrated or moved life will go on.

Finally, we will be old enough to rent "ultraporn" (160+ years old). [1][2]

[1][http://en.wikiquote.org/wiki/Futurama] [2][http://futurama.wikia.com/wiki/Hubert_J._Farnsworth]

The pricing model looks much more similar for KMS: http://aws.amazon.com/kms/

Am I comparing the right things for the pricing on AWS Cloud HSM vs Azure Key Vault?

ASW Cloud HSM - http://aws.amazon.com/cloudhsm/pricing/

Azure Key Vault - http://azure.microsoft.com/en-us/pricing/details/key-vault/

The metrics they use are not the same, so I am not sure if the AWS option is something dedicated vs the MSFT one is something you share? Is there something different from AWS that is more comparable?

"you can enter any arbitrary text afterwards is so that if someone is looking over you shoulder they can't tell that it only accepts 8"

Except it is public knowledge that there is an 8-character limit. Very basic footprinting would make it clear to only pay attention to the first 8 characters.

Correct, I am referencing the new nocaptcha system. Those images would get stale as opposed to those in the traditional scanned book, street signs, house numbers in the recaptcha.

How many photos are in the universe of possible photos? How long would it take for outsourcing the process to tag all photos so a script could then do the matching?

Is the whole point of this to encourage hackers to get working on this AI challenge of identifying similar photos?

Either they need to hire a lot of people to sit around making these sets or they have an automated way of creating these sets which can be reversed. It would seem to be an arms race where google is paying people, but attackers can have people break it at a cost less than creating them (takes less time to match them up then to find good photos, clean them up, tag them, etc.).

An attacker would also just target the database where this is all stored. With the text recaptcha, it would seem that they have all of these photos and scanned books and you have 8+ character strings of [a-zA-Z0-9], random guessing would not be good enough, so the attacker needed to solve the OCR problem.

However, given the option to select x of 9 images, if you assume that the extremes are less likely of 1/9, 2/9, 8/9, 9/9- then I can hope to get lucky picking 4 or 5 each time, the order does not matter. If you distribute the attack to get around rate limits, etc. - perhaps just picking the first through fifth images gives you a sufficiently high success rate.

At a macro vantage point, this is cool and great. On a micro-economic standpoint I don't need the convenience and I don't want the privacy risk. I would rather download all of wikipedia weekly and pay $500 for the voice recognition software under my control. I think there is some great first world problem potential, but it auto updates and I have little control. If something went screwy on Windows, people would notice it very quickly - there are suits in corporations watching and reviewing these things. On consumer grade electronics only enthusiasts and security researchers would know if something went funny.

bartering section on craigslist?

Check out my Cubby example. I saw the accepted answer and the others and then added mine. Thought the others were still pretty technical or too long. [http://security.stackexchange.com/a/53912/36538]

You should add a page with these benefits and also some information on industry experience you or your team have so customer's know its not just some IT guy with no understanding of their business.

Past performance is not an indicator of future results. If you want to look at the future, you need to combine previous results with possible future scenarios. Is business to a particular restaurant different based on the season, are there cash flow problems to consider? Regression or historic modeling is not that great - this includes where it is frequently used such as network analysis, stocks, etc. However, some of the drill down type things might be useful to monitoring food cost or helping to do future modeling. It depends on what features you have when you are near an MVP.

I am also not sure what this dones that a spreadsheet template couldn't do at this point. For the rainy day scenario, are you asking them to put this in, or will you take their location with weather data to automate this analysis?

Is this from final offers or a combination of all offers from initial to lowest? Or does it only include final, purchased, confirmed offers?

I recently used Car Woo as part of my car buying process. I wouldn't rely upon these numbers or those from TrueCar, Edmunds, etc. I have been using my bank's car buying service, TrueCar, and direct emailing of dealers. New Car pricing is highly variable on the dealer, dealer's stock, sales, per-dealer deals from, hold back, quota-bonuses, per salesman specific bonuses etc.

It is important to remember that a middleman service operates either on a flat fee or a commission. This is money the dealer cannot use to negotiate down with you. I do not know CarWoo's sales structure, but TrueCar makes 300-400[1][2] per sale. So if this is data based on CarWoo deals it will not reflect the best deals, because the cars all had to include this price. Now, that said most people are not prepared or comfortable buying a car or negotiating. Given that you get some degree of anonymity and can haggle back and forth online is nice and you are paying for the convenience. Many people will likely save more money than if they tried to do it on their own.

This is an application of the wisdom of crowds to determine a market price. It is a good indication of what the market is willing to pay, but not the best deal you can get. Savings as a representation of MSRP are misleading; think about how many things you buy off the shelf and the price is usually much less than MSRP for any number of per-store pricing or sales, coupons, etc. Car buying is no different.

In the case of the model I am looking for, the CarWoo price is close to the two offers I got on CarWoo, but the offers I got directly or through my bank are much lower( Best Direct quote I received was through my Bank's no haggle direct car buying service, which is about 7% lower than the CarWoo average).

Mean averages on their own are not very helpful in evaluating offers, perhaps if we saw a distribution or standard deviation? Prices over time (later in the model year should higher prices be used in the average, are they still relevant or should they at least be weighted?) would also be good for the car buyer.

I also have a hard time believing CarWoo would publish this information if it were not in the best interest of their customers (the dealers, car buyers are the product). Therefore, I would be lead to believe that this data only serves to keep buyers from trying to negotiate lower rates based on the average. Then again, maybe a tech startup has not yet considered this and just thought it would be cool to share data and be transparent.

It's a cool service and it's probably a good fit for many people. You could also just create a new email address and use a google voice number for privacy reasons. At any rate, I would advise you to do your research and try every tactic and service you can to optimize your wallet spent and time spend.

[1] http://www.dealerelite.net/profiles/blogs/true-car-and-zag-c... [2] http://www.thetruthaboutcars.com/2011/12/truecar-versus-hond...

Nothing says security like a site with passwords, payments, and no TLS

Also says PayPal and then links out via Stripe.

Interested, but not the site for this.

Looks nice, nothing new - https://github.com/kolber/stacey - http://bolt80.com/piecrust/

The video was down for me, but maybe the uploader makes it easier then some other systems? When I try to teach non tech people to use a db-less CMS with no online admin, they get Markdown (they can at least copy and paste my example pages). But uploading files, WinSCP, FileZilla, etc and opening its NOT in word... this blows their minds. So if anyone has seen the uploader and it makes it super simple, it might be worth checking out.

Is this is just a cloud provider for something similar to a de-coupled CMS, ala Symfony CMF (http://cmf.symfony.com/) ?

The idea is that the content is not locked to your CMS, like an old Joomla system where the content and meta-data are hard-coded in the schema. I would be concerned about latency, etc for hosting something like this.

There service holds and organizeds the DB storage for you. The advantage would have to come with redundnacy/latency versus rolling your own datastore. If you are doing a NoSQL or JSON type storage that allows an arbitrary format, then you are free to reuse it wherever.

For those who don't know what the "alpha-grip" is --> http://www.alphagrips.com/ - its a keyboard in the feel of a controller.

20,230 is what is reported by the US Government: http://www.bls.gov/oes/current/oes412011.htm

So the number stated is the mean, not the mode or median.

Remember, on the web content is king. The problem with most social media is that its a lot of crap content, that no one would preserve. Would you even want a historical dump of your facebook wall history?

Facebook is designed so you will create current-related content to drive relevant ads for what you want now. It removes the effort to thinking and proofing even something like a Xanga or Live Journal.

Even with the rise of "easy" CMS systems like drupal or joomla, there is still a large hurdle to entry.

Neocities fills that gap for those who don't want to worry about what is going on under the web page, and is going one step past the pendulum swing of jekyll, pelican, etc.

This seems like a path in the right direction to allow people to put stuff out in public which may be niche and may not be just word-content like on a free blog system like blogger.

I don't know if anyone read the onsite comments, but I don't know if this is funny or true:

"Simple question, why wasn’t Snowden’s girlfriend a Spook? Back in the 1990s, if any nerd/geek/brain had access to Top Secret data then one of 17 U.S. agencies would have paired such a person with a beautiful girlfriend with similar level of clearance with whom he could talk just so he wouldn’t run away or leak, and said girlfriend would go on to become wife and pop out a kid or two, preventing said nerd/geek/brain from ever leaking (even if he ran away) just to avoid starving his kid/s because their mommy would lose her security clearance. What happened to America after 9-11? Fear got rid of all the common sense? lol.

Let me guess, the Carlyles went Boozing with Allen and Hamilton and they supplied the intelligence community with so many thousands of geeks and nerds that America’s 17 intelligence services ran out of beautiful women with whom to keep them in line. Ofcourse Snowden would leave his pole dancing, nature loving girlfriend of 8 years (with whom he couldn’t talk about anything and who couldn’t share the burden to his conscience because she had no security clearance) to blow the whistle and expose the alarming surveillance of innocent Americans who have no way to prove their innocence if their innocent words and second or third degree online associations mistakenly put them under suspicion and surveillance just because some computer algorithm got triggered. Just how many Americans are under suspicion right now? What are the numbers exactly? Thousands? Millions? lol."

"I understand how the engines work now. It came to me in a dream. The engines don't move the ship at all. The ship stays where it is and the engines move the universe around it." ―Cubert Farnsworth

[http://futurama.wikia.com/wiki/Dark_Matter_Engine]

Not sure if this search would be good, but your responses triggers the id of a distributed code review like reCAPTHA. Possibly a pattern search brings up suspicious code and then there is distributed review and once enough people flag it as SQL injection, it could be flagged on Github and someone could submit a patch, etc. Clearly not bulletproof, but this would provide a way of doing code review on projects you might have no other interest in helping.

Secure password safe anyone? Keepass...