howlett

I'm using getmail (https://pyropus.ca./software/getmail/) as a cronjob every night to download it all and then sync with an offsite backup

If I'm not mistaken gitea stores codebases/projects on the filesystem, so having a hardcoded database password makes no difference. If someone gets into the server they can simply copy the files without touching the database.

As others have indicated, a VPN server of your choosing (openvpn/wireguard) can solve your issues. Even if at some point there's an "unauthenticated RCE" exploit for gitea, having it behind a VPN will mitigate that.

I think you're just stuck because your current employer doesn't have clear paths of progression. Usually in 3 years pentesters move to an either team lead role or pivot to other areas like simulated attack (red/purple teaming).

If you enjoy pentesting, I'd just look for another job, especially since the demand for ex-devs in pentesting is huge. Have a look at a previous comment I posted: https://news.ycombinator.com/item?id=32303528#32305561

I'm not 100% certain if I'm understanding the requirement correctly - but would something like this help?

https://github.com/ctxis/SnitchDNS

You can gear yourself write security related tooling as /u/uaas mentioned, but you'd effectively still be a developer and not a pentester. If that's what you're after, you'll get exposure to InfoSec but you will never do actual pentesting to find vulnerabilities etc. I mean you might, but the companies that offer you both are very few.

I made that exact jump from development to pentesting 6 years ago, after about 10 years of development. Will you miss development? Absolutely. Are there opportunities to scratch that itch? Yes there are - but it's with scripting. The things that can be scripted to make you more efficient are insane. Your ability to understand not only what is broken but also why it's broken will help you advance yourself. You have probably even coded that exact bug in the past so you know where else to look, and you know how to do code reviews. In general, the need for pentesters with a dev background is very very high, especially since now companies worry about supply chain attacks, SDLC, etc.

My solution was to keep coding in my spare time, when I have an MVP I show it at work and then ask for time to work on it. I've significantly improved internall processes, and I've released a few offensive security tools, two of them I even presented at security conferences - as in full blown applications rather than "here's a script that does X". This way I get to pentest and provide solutions to industry-related problems. One thing to note is that most of the security tooling out there (the open sourced ones) is very python/C#/Go centric. I've seen applications written in Rails/Java that didn't get the love they deserved just because it's a pain to install them. I had to learn both python and C#, but it was totally worth it.

If you do make the jump, get ready to take a salary hit as you'd be hired as a mid-level consultant at best - and that's only if you've proven that you know a lot about cyber security, OWASP vulnerabilities, etc. But don't let that stop you, I've seen people join the industry as juniors and in 6 years making over 6 digits (UK). YMMV, but if you put in the time and effort, it's worth it.

I totally agree with you, but the common "this is why we can't have nice things" end result of such scenarios is that people will VPN via India in order to buy your product. And then you have to identify VPNs in order to avoid this, etc.

I don't have a solution for this, I just think the effort/reward should be considered.

As a user I hate it when I get localised prices, especially if the at-the-time exchange rate ends up being more expensive for me. If I see something sold for $9.99 but I get £9.99 I think "why am I paying more for this", simply because the exchange rate is more favourable since I'm in the UK. But when I only see USD prices I'm more likely to buy something as it's not overly complicated.

If you want you could pull real-time exchange rates and have a button that indicates the conversion for someone who wants to see the "most likely" price (depending on when they actually pay for it).

For example if you sell something for $9.99 just leave it as such, and Stripe will make the conversion and you'll always sell at the same price regardless from where someone is coming from.

That's how I feel about it anyway!

If you have been taking exports as backup, be aware that any attachments you have were not exported - https://news.ycombinator.com/item?id=31702594

I've had lasik about 10 years ago, best decision of my life, no side effects. It only took 10 minutes, and I can only assume that the technology advanced further the last decade.

I know 2 people who had it around the same time as me, and only one has -1 in one eye after another 7 years. The other person is still glass-free.

My advice is to not go cheap. Don't choose a doctor that "also does eye surgery" (there are a few like that), go to someone who specialises in it and only does that.

Unfortunately I don't have anyone to recommend in the UK as I've done mine in Greece, but I've had -5 on both eyes and lasik did wonders.

Also, in Chrome Ctrl-Shift-T will not work in private mode however in Firefox it does.

I've been trying to reproduce this since I saw this post without any luck. The only data I see going out is generic usage data (when you have the "anonymous usage data" enabled) - however I'm not logged into Postman.

I suspect it only sends data to them server if you are logged in so you can use the functionality such as "sync between devices", which kind of makes sense.

I use getmail[0] on my rpi. Download everything from gmail and fastmail using IMAP (sync) overnight into a truecrypt container, and then offsite backup to rsync.net. It's also storing everything into an mbox so you can easily import that file anywhere.

[0] http://pyropus.ca/software/getmail/

I wrote the original post. The main issue I was trying to highlight is that you can make signed apps run your code from a local perspective. Here's a real life scenario that happened :

I was doing a security assessment for a client, and after gaining foothold on the host we needed to establish persistence. As the endpoint protection was blocking anything non signed, I used slack to inject a powershell payload that's executed on startup and gains us access back to the internal network.

So the risk is there, but not the individual user but the organisations using it. I didn't expect this to become a big deal over "redistribution" but I hoped for the command execution without modifying the binary.

Having said that, this can be solved with a simple integrity check of the asar files. Sure, the attacker can modify the binary file too, but then it's not signed anymore.

I tried switching a couple of times but every time I face the same issue - the "touch" response is just _bad_ and I can't seem to be able to fix it. For example the "[-]" link on hackernews is almost impossible to click. I have to brute-force it by clicking multiple times, same applies for other websites where it doesn't seem to pickup the closest link I click.

On the other hand, the "Firefox Focus" app and Chrome do not seem to have this issue. Is there any way to fix this, because it's literally the only thing that stopping me.

I use getmail (http://pyropus.ca/software/getmail/) which isn't bound to a specific provider. Currently I backup my gmail and fastmail accounts using this. Here is my daily process:

- mount truecrypt container

- run getmail for each account I want to backup (separate .conf files)

- unmount container

- sync offsite to rsync.net

All of this runs on my raspberry pi 2 and it's really easy to setup (it's practically a bash file with 4 commands).

The output is an mbox file which you can import into Thunderbird or any other client that supports them.

I saw Sketch2Code in HN a few weeks ago, hope it helps: https://github.com/Microsoft/ailab/tree/master/Sketch2Code

It's because there are 4 "w" in the link - try https://www.cronote.com/

Here are a few resources:

https://www.reddit.com/r/netsec/ General news about netsec

https://github.com/enaqx/awesome-pentest List of tools and resources

https://github.com/wtsxDev/Penetration-Testing Another list of tools and resources

https://www.hackthebox.eu/ Hands on hacking (OSCP style) but free, unless you want to pay for a VIP version and get access to even more machines.

https://www.vulnhub.com/ Individual VMs you can hack into, most of them providing walkthroughs.

Web application wise I'd suggest starting with https://www.owasp.org/index.php/OWASP_Juice_Shop_Project which is a modern version of the "damn vulnerable web app (DVWA)".

These may look quite "massive" for a beginner but I think it's the best way to start. The approach I would suggest would be to go download a VM from vulnhub and read its walkthrough. Then learn to use the tools in that walkthrough (each machine may use a tool in a different way) until you're confident enough to make an attempt on your own.

Hope this is helpful!

I built https://www.remotepassword.com because I didn't want to hardcode passwords in my scripts and wanted a way to disable them remotely (ie my raspberry pi has been stolen and I don't want them to mount my backup truecrypt containers).

It works fine and gave me some peace of mind!

I've made a very similar thing: https://www.remotepassword.com

Works on both Windows and Linux but the passwords are stored online (GPG encrypted). The main idea was to be able to revoke a password if a machine has been compromised.

Did that change about year ago, I've commented on an older thread about this: https://news.ycombinator.com/item?id=14188283

But it also depends where you are located (country wise I mean).

Are you logged into Amazon with your account on the second computer?

Don't know if it's a "great" side project but I wanted a way to avoid hardcoding passwords in scripts, but in a way that I could revoke them if my RPi had been compromised (my RPi is used for backups/sync).

So I made https://www.remotepassword.com where you can store a GPG encrypted version of the password and then call-decrypt-passthrough the password to the command line. If the device is compromised, you can deactivate the online password and no-one can get access to your data.

I was in the same position as you a couple of months ago and I went for Linode - the $5 plan. You're probably conscious not to spend a lot of money from the start as - let's face it - you don't know if your project will be as popular as you hope it will be (mine wasn't!). On Linode you can easily upgrade by adding ram/disk etc and the pricing is straight forward.

If your project lifts off and Linode doesn't cover you, you can look at AWS then.

The reason I switched was because pen testing is in really high demand and will stay that way for a few years to come. Also, I didn't want to get full time into management at this point.

My security skills were average (hobby for about 10 years but mostly because I was a web developer) but like I said the OSCP did most of the work in terms of getting the interview and doing any technical test. The course itself took about 2 months, 6 hours every day after work, and fulltime weekends!

My suggestion would be to do the OSCP course and if you like it then go for it. There is also vulnhub.com which has a lot of CTF VMs where you can practice (I personally dislike CTFs because I find them unrealistic).

I went from lead dev (and head of development with 10 years experience) to security consultant about 6 months ago, as security was always a hobby of mine.

If you look at my previous comments I always say the same thing: get the OSCP certification. It will definitely get you an interview but the course is hard and demanding.

Also, get ready to take a paycut and a role downgrade as 4 years of pentesting have more value than 10 years of development.

Obviously you bring other skills to the table like better client communication and knowing how things work under the hood, but you'll have to take a step back before you take two steps forward.

I definitely recommend you go that way, but think hard before you do, and please be sure it's not because you're "bored".

Last but not least, prepare to travel to clients. Sure there is the "internet" and "vpn" but a lot of clients have internal apps need testing and do not give you remote access.

If you have any questions I'll be happy to help out.

I'm on the same Samsung boat, have an S5 mini (3 years now) and want to move away from it.

Battery-wise, the "best" one I've found is the Lenovo P2 which has 5100mAh (S8 Plus has 3500) but not sure if its hardware is any good. I'm planning however to get OnePlus 3t which has 3400mAh and seems like a better long-term choice.

I've used swagger quite a lot the last couple of years but I have a problem which I still haven't found an elegant solution for.

How can I self host the API documentation (as reference) without setting up the whole UI? Everything I've tried is "experimental", "not tested" and "almost working".

I think what you mean is security researcher rather than security engineer.

The easiest thing you can do is e-mail all penetration testing companies who can find near (or far) from where you live and ask if they are looking for interns or graduates. Even if they don't advertise at the moment, there's a good chance you'll get a positive reply, because the demand is greater than the supply.

Most security companies have a research department which you'll be able to apply for, after you've joined (at least in the UK such departments require security clearance).

Also, having an OSCP or OSCE certificate will definitely get you an interview.

Have a certificate like OSCP to your name, you'll get an interview.

That's the way I personally moved to security and can't recommend it enough. It's a bit expensive but you definitely get your money's worth.